Lexim011/Compliance huggingface dataset:
CCI-002063 (policy): The organization defines the level of independence for assessors or assessment teams to conduct security control assessments of organizational information systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (1)
CCI-002064 (policy): The organization selects one or more security assessment techniques to be conducted.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2)
CCI-002072 (policy): The organization defines the unclassified, national security systems that are prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (1)
CCI-002073 (policy): The organization defines the boundary protection device to be used to connect organization-defined unclassified, national security systems to an external network.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (1)
CCI-002074 (policy): The organization defines the boundary protection device to be used for the direct connection of classified, national security system to an external network.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (2)
CCI-002075 (policy): The organization prohibits the direct connection of an organization-defined unclassified, non-national security system to an external network without the use of organization-defined boundary protection device.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (3)
CCI-002076 (policy): The organization defines the unclassified, non-national security system that is prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (3)
CCI-002077 (policy): The organization defines the boundary protection device to be used to directly connect an organization-defined unclassified, non-national security system to an external network.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (3)
CCI-002078 (policy): The organization prohibits the direct connection of an organization-defined information system to a public network.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (4)
CCI-002079 (policy): The organization defines the information system that is prohibited from directly connecting to a public network.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (4)
CCI-002080 (policy): The organization employs either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (5)
CCI-002081 (policy): The organization defines the information systems that employ either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing connections to external information systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (5)
CCI-002082 (policy): The organization selects either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (5)
CCI-002085 (policy): The organization defines the level of independence the assessors or assessment teams must have to monitor the security controls in the information system on an ongoing basis.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-7 (1)
CCI-002089 (policy): The organization establishes and defines the frequencies for assessments supporting continuous monitoring.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-7 b
CCI-002098 (policy): The organization defines rules of engagement for red team exercises to simulate attempts by adversaries to compromise organizational information systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-8 (2)
CCI-002106 (policy): The organization documents the access control policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1
CCI-002109 (policy): The organization documents procedures to facilitate the implementation of the access control policy and associated access controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 2
CCI-002110 (policy): The organization defines the information system account types that support the organizational missions/business functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 a
CCI-002111 (policy): The organization identifies and selects the organization-defined information system account types of information system accounts which support organizational missions/business functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 a
CCI-002113 (policy): The organization establishes conditions for role membership.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 c
CCI-002114 (policy): The organization specifies authorized users of the information system for each account.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d
CCI-002131 (policy): The organization defines the personnel or roles to be notified on account creation, modification, enabling, disabling, and removal actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4)
CCI-002132 (technical): The information system notifies organization-defined personnel or roles for account enabling actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4)
CCI-002136 (policy): The organization defines the actions to be taken when privileged role assignments are no longer appropriate.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (c)
CCI-002142 (technical): The information system terminates shared/group account credentials when members leave the group.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (10)
CCI-002167 (policy): The organization defines the subjects over which the information system will enforce a role-based access control policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7)
CCI-002168 (policy): The organization defines the objects over which the information system will enforce a role-based access control policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7)
CCI-002171 (technical): The information system enforces a role-based access control policy over organization-defined subjects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7)
CCI-002172 (technical): The information system enforces a role-based access control policy over organization-defined objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7)
CCI-002175 (technical): The information system controls access based upon organization-defined roles authorized to assume such roles, employing the organization-defined role-based access control policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7)
CCI-002176 (technical): The information system controls access based upon organization-defined users authorized to assume such roles, employing the organization-defined role-based access control policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7)
CCI-002206 (technical): The information system uniquely authenticates source by organization, system, application, and/or individual for information transfer.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (17)
CCI-002208 (technical): The information system uniquely authenticates destination by organization, system, application, and/or individual for information transfer.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (17)
CCI-002209 (policy): The organization defines the techniques to be used to bind security attributes to information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (18)
CCI-002210 (technical): The information system binds security attributes to information using organization-defined binding techniques to facilitate information flow policy enforcement.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (18)
CCI-002251 (technical): The information system notifies the user, upon successful logon (access), of the date and time of the last logon (access).
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (4)
CCI-002253 (policy): The organization defines the account types for which the information system will limit the number of concurrent sessions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-10
CCI-002254 (policy): The organization defines the conditions or trigger events requiring session disconnect to be employed by the information system when automatically terminating a user session.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-12
CCI-002255 (policy): The organization defines the user actions that can be performed on the information system without identification and authentication.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-14 a
CCI-002276 (policy): The organization identifies the individuals authorized to define the value of associated security attributes.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (2)
CCI-002285 (policy): The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined subjects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4)
CCI-002305 (policy): The organization identifies individuals authorized to define or change the type and value of security attributes available for association with subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10)
CCI-002313 (technical): The information system controls remote access methods.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (1)
CCI-002315 (policy): The organization defines the number of managed network access control points through which the information system routes all remote access.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (3)
CCI-002333 (policy): The organization permits authorized individuals to use an external information system to access the information system only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (a)
CCI-002334 (policy): The organization permits authorized individuals to use an external information system to process organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (a)
CCI-002335 (policy): The organization permits authorized individuals to use an external information system to store organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (a)
CCI-002336 (policy): The organization permits authorized individuals to use an external information system to transmit organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (a)
CCI-002365 (policy): The organization manages information system authenticators by requiring individuals to take specific security safeguards to protect authenticators.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 i
CCI-002366 (policy): The organization manages information system authenticators by having devices implement specific security safeguards to protect authenticators.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 i
CCI-002367 (policy): The organization ensures unencrypted static authenticators are not embedded in applications.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (7)
CCI-002377 (policy): The organization documents the system and communications protection policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 1
CCI-002379 (policy): The organization documents procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 2
CCI-002386 (policy): The organization defines the security safeguards to be employed to protect the information system against, or limit the effects of, denial of service attacks.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-5
CCI-002412 (policy): The organization defines the information system components supporting organization-defined missions and/or business functions that are to be separated using boundary protection mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (21)
CCI-002419 (policy): The organization defines the alternative physical safeguards to be employed when cryptographic mechanisms are not implemented to protect information during transmission.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (1)
CCI-002491 (policy): The organization changes the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (3)
CCI-002558 (policy): The organization prohibits the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (3)
CCI-002588 (policy): The organization employs organization-defined tests of downgrading equipment in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (2)
CCI-002589 (policy): The organization employs procedures to verify correct performance of organization-defined tests of downgrading equipment in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (2)
CCI-002590 (policy): The organization defines tests to employ for downgrading equipment.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (2)
CCI-002592 (policy): The organization defines Controlled Unclassified Information (CUI).
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (3)
CCI-002595 (policy): The organization establishes an organization-defined information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 a
CCI-002596 (policy): The organization establishes and defines an information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 a
CCI-002597 (policy): The organization defines strength and integrity for downgrading mechanisms to establish an organization-defined information system media downgrading process.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 a
CCI-002598 (policy): The organization ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 b
CCI-002599 (policy): The organization defines and identifies the information system media requiring downgrading.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 c
CCI-002619 (policy): The organization employs malicious code protection mechanisms at information system entry points to detect malicious code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 a
CCI-002620 (policy): The organization employs malicious code protection mechanisms at information system exit points to detect malicious code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 a
CCI-002621 (policy): The organization employs malicious code protection mechanisms at information system entry points to eradicate malicious code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 a
CCI-002622 (policy): The organization employs malicious code protection mechanisms at information system exit points to eradicate malicious code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 a
CCI-002627 (technical): The information system implements nonsignature-based malicious code detection mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (7)
CCI-002632 (policy): The organization defines the remote commands that are to be authenticated using organization-defined safeguards for malicious code protection.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (9)
CCI-002633 (policy): The organization defines the security safeguards to be implemented to authenticate organization-defined remote commands for malicious code protection.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (9)
CCI-002637 (technical): The information system implements organization-defined security safeguards to authenticate organization-defined remote commands for malicious code protection.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (9)
CCI-002647 (policy): The organization protects information obtained from intrusion-monitoring tools from unauthorized access.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 d
CCI-002648 (policy): The organization protects information obtained from intrusion-monitoring tools from unauthorized modification.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 d
CCI-002649 (policy): The organization protects information obtained from intrusion-monitoring tools from unauthorized deletion.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 d
CCI-002653 (policy): The organization provides organization-defined information system monitoring information to organization-defined personnel or roles as needed or per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4
CCI-002691 (technical): The information system uses indicators of compromise.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (24)
CCI-002730 (policy): The organization defines the user-installed software that is to be executed in a confined physical or virtual machine environment with limited privileges.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (11)
CCI-002731 (policy): The organization requires that organization-defined user-installed software execute in a confined physical or virtual machine environment with limited privileges.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (11)
CCI-002735 (policy): The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only in confined physical or virtual machine environments.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (13)
CCI-002736 (policy): The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only with the explicit approval of organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (13)
CCI-002737 (policy): The organization prohibits the use of binary or machine-executable code from sources with limited or no warranty and without the provision of source code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (14) (a)
CCI-002738 (policy): The organization provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (14) (b)
CCI-002772 (policy): The organization defines the security safeguards to be implemented to protect the information system's memory from unauthorized code execution.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-15
CCI-002783 (policy): The organization coordinates an incident handling capability for insider threats across organization-defined components or elements of the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (7)
CCI-002784 (policy): The organization defines components or elements of the organization across which an incident handling capability for insider threats will be coordinated.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (7)
CCI-002813 (policy): The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (1)
CCI-002814 (policy): The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (1)
CCI-002815 (policy): The organization defines personnel or roles to whom responsibility for responding to information spills will be assigned.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (1)
CCI-002822 (policy): The organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-10
CCI-002863 (policy): The organization employs automated mechanisms to schedule, conduct, and document repairs.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 (2) (a)
CCI-002867 (policy): The organization performs maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a
CCI-002871 (policy): The organization performs repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a
CCI-002877 (policy): The organization prevents the unauthorized removal of maintenance equipment containing organizational information by verifying that there is no organizational information contained on the equipment.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (a)
CCI-002878 (policy): The organization prevents the unauthorized removal of maintenance equipment containing organizational information by sanitizing or destroying the equipment.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (b)
CCI-002879 (policy): The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (c)
CCI-002880 (policy): The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (c)
CCI-002881 (policy): The organization prevents the unauthorized removal of maintenance equipment containing organizational information by obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (d)
CCI-002892 (policy): The organization develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (1) (b)
CCI-002905 (policy): The organization employs automated mechanisms to schedule, conduct, and document maintenance.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 (2) (a)
CCI-002932 (policy): The organization controls physical access to output from organization-defined output devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (1) (a)
CCI-002933 (policy): The organization defines output devices for which physical access to output is controlled.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (1) (a)
CCI-002934 (policy): The organization ensures that only authorized individuals receive output from organization-defined output devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (1) (b)
CCI-002935 (policy): The information system controls physical access to output from organization-defined output devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (2) (a)
CCI-002936 (policy): The information system links individual identity to receipt of output from organization-defined output devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (2) (b)
CCI-002937 (policy): The organization marks organization-defined information system output devices indicating the appropriate security marking of the information permitted to be output from the device.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (3)
CCI-002938 (policy): The organization defines the information system output devices marked indicating the appropriate security marking of the information permitted to be output from the device.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (3)
CCI-002972 (policy): The organization employs automated mechanisms to detect the presence of water in the vicinity of the information system and alerts organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-15 (1)
CCI-002977 (policy): The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-18 (1)
CCI-002978 (policy): The organization considers the physical and environmental hazards in its risk mitigation strategy for existing facilities.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-18 (1)
CCI-002983 (policy): The organization ensures that asset location technologies are employed in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-20 b
CCI-002992 (policy): The organization implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems are reported in accordance with OMB FISMA reporting requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-4 a 3
CCI-003016 (policy): The organization, upon termination of individual employment, notifies organization-defined personnel or roles within an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 f
CCI-003025 (policy): The organization defines personnel or roles to notify upon termination of individual employment.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 f
CCI-003026 (policy): The organization defines the time period within which to notify organization-defined personnel or roles upon termination of individual employment.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 f
CCI-003036 (policy): The organization ensures that individuals requiring access to organizational information and information systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-6 c 2
CCI-003037 (policy): The organization defines the frequency for individuals requiring access to organization information and information systems to re-sign access agreements.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-6 c 2
CCI-003040 (policy): The organization requires third-party providers to comply with personnel security policies and procedures established by the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-7 b
CCI-003058 (policy): The organization distributes copies of the security plan to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b
CCI-003065 (policy): The organization plans and coordinates security-related activities affecting the information system with organization-defined individuals or groups before conducting such activities in order to reduce the impact on other organizational entities.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 (3)
CCI-003066 (policy): The organization defines the individuals or groups with whom security-related activities are planned and coordinated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 (3)
CCI-003067 (policy): The organization defines the individuals or groups with whom security-related activities are planned and coordinated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 (3)
CCI-003107 (policy): The organization requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes organization-defined state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (3)
CCI-003108 (policy): The organization defines the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service is required to include when demonstrating the use of a system development life cycle.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (3)
CCI-003113 (policy): The organization defines the level of detail to be contained in the plan for the continuous monitoring of security control effectiveness that the developer of the information system, system component, or information system services is required to produce.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (8)
CCI-003115 (policy): The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (9)
CCI-003134 (policy): The organization protects information system, system component, or information system service documentation as required, in accordance with the risk management strategy.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 d
CCI-003137 (policy): The organization defines security controls that providers of external information system services employ in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 a
CCI-003190 (policy): The organization requires the developer of the information system, system component, or information system service to perform penetration testing at an organization-defined breadth/depth and with organization-defined constraints.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (5)
CCI-003198 (policy): The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1)
CCI-003199 (policy): The organization defines tailored acquisition strategies, contract tools, and procurement methods to employ for the purchase of the information system, system component, or information system service from suppliers.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1)
CCI-003200 (policy): The organization conducts a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (2)
CCI-003201 (policy): The organization employs organization-defined security safeguards to limit harm from potential adversaries identifying and targeting the organizational supply chain.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (5)
CCI-003202 (policy): The organization defines security safeguards to employ to limit harm from potential adversaries identifying and targeting the organizational supply chain.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (5)
CCI-003203 (policy): The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (7)
CCI-003204 (policy): The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (7)
CCI-003205 (policy): The organization uses all-source intelligence analysis of suppliers and potential suppliers of the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (8)
CCI-003206 (policy): The organization employs organization-defined Operations Security (OPSEC) safeguards in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (9)
CCI-003207 (policy): The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1)
CCI-003208 (policy): The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1)
CCI-003209 (policy): The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1)
CCI-003210 (policy): The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (9)
CCI-003211 (policy): The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (9)
CCI-003212 (policy): The organization employs organization-defined security safeguards to validate that the information system or system component received is genuine and has not been altered.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (10)
CCI-003213 (policy): The organization defines the security safeguards to be employed to validate that the information system or system component received is genuine and has not been altered.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (10)
CCI-003214 (policy): The organization employs organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of organization-defined supply chain elements, processes, and actors associated with the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (11)
CCI-003215 (policy): The organization defines the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (11)
CCI-003216 (policy): The organization establishes inter-organizational agreements with entities involved in the supply chain for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (12)
CCI-003217 (policy): The organization establishes inter-organizational procedures with entities involved in the supply chain for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (12)
CCI-003218 (policy): The organization employs organization-defined security safeguards to ensure an adequate supply of organization-defined critical information system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (13)
CCI-003219 (policy): The organization defines the security safeguards to be employed to ensure an adequate supply of organization-defined critical information system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (13)
CCI-003220 (policy): The organization defines the critical information system components for which organization-defined security safeguards are employed to ensure adequate supply.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (13)
CCI-003221 (policy): The organization establishes unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (14)
CCI-003222 (policy): The organization retains unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (14)
CCI-003223 (policy): The organization defines the supply chain elements, processes, and actors for the information system, system component, or information system service to establish and retain unique identification.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (14)
CCI-003224 (policy): The organization establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (15)
CCI-003225 (policy): The organization describes the trustworthiness required in the organization-defined information system, information system component, or information system service supporting its critical missions/business functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-13 a
CCI-003226 (policy): The organization defines the information system, information system component, or information system service supporting its critical missions/business functions in which the trustworthiness must be described.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-13 a
CCI-003227 (policy): The organization implements an organization-defined assurance overlay to achieve trustworthiness required to support its critical missions/business functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-13 b
CCI-003228 (policy): The organization defines an assurance overlay to be implemented to achieve trustworthiness required to support its critical missions/business functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-13 b
CCI-003229 (policy): The organization identifies critical information system components by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-14
CCI-003230 (policy): The organization identifies critical information system functions by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-14
CCI-003231 (policy): The organization defines the information systems, information system components, or information system services for which the organization identifies critical information system components and functions for criticality analysis.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-14
CCI-003232 (policy): The organization defines the decision points in the system development life cycle at which to perform a criticality analysis to identify critical information system components and functions for organization-defined information systems, information system components, or information system services.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-14
CCI-003253 (policy): The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at an organization-defined breadth/depth and at organization-defined decision points in the system development life cycle.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (3)
CCI-003256 (policy): The organization requires that developers perform threat modeling for the information system at an organization-defined breadth/depth.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4)
CCI-003257 (policy): The organization requires that developers perform a vulnerability analysis for the information system at an organization-defined breadth/depth.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4)
CCI-003258 (policy): The organization defines the breadth/depth at which threat modeling for the information system must be performed by developers.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4)
CCI-003259 (policy): The organization defines the breadth/depth at which vulnerability analysis for the information system must be performed by developers.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4)
CCI-003260 (policy): Threat modeling performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (a)
CCI-003261 (policy): Vulnerability analysis performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (a)
CCI-003262 (policy): The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform threat modeling for the information system by the developer.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (a)
CCI-003263 (policy): The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform a vulnerability analysis for the information system by the developer.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (a)
CCI-003264 (policy): The organization requires the threat modeling performed by the developers employ organization-defined tools and methods.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (b)
CCI-003265 (policy): The organization requires the vulnerability analysis performed by the developers employ organization-defined tools and methods.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (b)
CCI-003266 (policy): The organization defines tools and methods to be employed to perform threat modeling for the information system by the developer.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (b)
CCI-003267 (policy): The organization defines tools and methods to be employed to perform a vulnerability analysis for the information system by the developer.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (b)
CCI-003268 (policy): The organization requires that developers performing threat modeling for the information system produce evidence that meets organization-defined acceptance criteria.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (c)
CCI-003269 (policy): The organization requires that developers performing vulnerability analysis for the information system produce evidence that meets organization-defined acceptance criteria.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (c)
CCI-003270 (policy): The organization defines the acceptance criteria that must be met when threat modeling of the information system is performed by the developer.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (c)
CCI-003271 (policy): The organization defines the acceptance criteria that must be met when vulnerability analysis of the information system is performed by the developer.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (c)
CCI-003283 (policy): The organization approves the use of live data in development environments for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9)
CCI-003284 (policy): The organization approves the use of live data in test environments for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9)
CCI-003285 (policy): The organization documents the use of live data in development environments for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9)
CCI-003286 (policy): The organization documents the use of live data in test environments for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9)
CCI-003287 (policy): The organization controls the use of live data in development environments for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9)
CCI-003288 (policy): The organization controls the use of live data in test environments for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9)
CCI-003302 (policy): The organization requires the developer of the information system, system component, or information system service to define security-relevant hardware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a)
CCI-003346 (policy): The organization implements a tamper protection program for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18
CCI-003347 (policy): The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including design.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1)
CCI-003348 (policy): The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including development.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1)
CCI-003349 (policy): The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including integration.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1)
CCI-003350 (policy): The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including operations.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1)
CCI-003351 (policy): The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including maintenance.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1)