Lexim011/Compliance huggingface dataset:
CCI-000661 (policy): The organization provides exceptions to the source code requirement only when no alternative solutions are available to support compelling mission/operational requirements.
References: NIST: NIST SP 800-53 (v3): SA-6 (1) (b) NIST: NIST SP 800-53A (v1): SA-6 (1).1 (ii)
CCI-000662 (policy): The organization obtains express written consent of the authorizing official for exceptions to the source code requirement.
References: NIST: NIST SP 800-53 (v3): SA-6 (1) (b) NIST: NIST SP 800-53A (v1): SA-6 (1).1 (iii)
CCI-000663 (technical): The organization (or information system) enforces explicit rules governing the installation of software by users.
References: NIST: NIST SP 800-53 (v3): SA-7 NIST: NIST SP 800-53A (v1): SA-7.1 (ii)
CCI-000670 (policy): The organization requires that providers of external information system services employ organization-defined security controls in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
References: NIST: NIST SP 800-53 (v3): SA-9 a NIST: NIST SP 800-53 Revision 4 (v4): SA-9 a NIST: NIST SP 800-53A (v1): SA-9.1 (i)
CCI-000671 (policy): The organization defines government oversight with regard to external information system services.
References: NIST: NIST SP 800-53 (v3): SA-9 b NIST: NIST SP 800-53 Revision 4 (v4): SA-9 b NIST: NIST SP 800-53A (v1): SA-9.1 (ii)
CCI-000672 (policy): The organization documents government oversight with regard to external information system services.
References: NIST: NIST SP 800-53 (v3): SA-9 b NIST: NIST SP 800-53 Revision 4 (v4): SA-9 b NIST: NIST SP 800-53A (v1): SA-9.1 (ii)
CCI-000673 (policy): The organization defines user roles and responsibilities with regard to external information system services.
References: NIST: NIST SP 800-53 (v3): SA-9 b NIST: NIST SP 800-53 Revision 4 (v4): SA-9 b NIST: NIST SP 800-53A (v1): SA-9.1 (ii)
CCI-000674 (policy): The organization documents user roles and responsibilities with regard to external information system services.
References: NIST: NIST SP 800-53 (v3): SA-9 b NIST: NIST SP 800-53 Revision 4 (v4): SA-9 b NIST: NIST SP 800-53A (v1): SA-9.1 (ii)
CCI-000675 (policy): The organization monitors security control compliance by external service providers.
References: NIST: NIST SP 800-53 (v3): SA-9 c NIST: NIST SP 800-53A (v1): SA-9.1 (iii)
CCI-000676 (policy): The organization conducts an organizational assessment of risk prior to the acquisition of dedicated information security services.
References: NIST: NIST SP 800-53 (v3): SA-9 (1) (a) NIST: NIST SP 800-53A (v1): SA-9 (1).1 (i)
CCI-000677 (policy): The organization conducts an organizational assessment of risk prior to the outsourcing of dedicated information security services.
References: NIST: NIST SP 800-53 (v3): SA-9 (1) (a) NIST: NIST SP 800-53A (v1): SA-9 (1).1 (i)
CCI-000678 (policy): The organization defines the senior organizational official designated to approve acquisition of dedicated information security services.
References: NIST: NIST SP 800-53 (v3): SA-9 (1) (b) NIST: NIST SP 800-53A (v1): SA-9 (1).1 (ii)
CCI-000679 (policy): The organization defines the senior organizational official designated to approve outsourcing of dedicated information security services.
References: NIST: NIST SP 800-53 (v3): SA-9 (1) (b) NIST: NIST SP 800-53A (v1): SA-9 (1).1 (ii)
CCI-000680 (policy): The organization ensures the acquisition of dedicated information security services is approved by an organization-designated senior organizational official.
References: NIST: NIST SP 800-53 (v3): SA-9 (1) (b) NIST: NIST SP 800-53A (v1): SA-9 (1).1 (iii)
CCI-000681 (policy): The organization ensures the outsourcing of dedicated information security services is approved by an organization-designated senior organizational official.
References: NIST: NIST SP 800-53 (v3): SA-9 (1) (b) NIST: NIST SP 800-53A (v1): SA-9 (1).1 (iii)
CCI-000682 (policy): The organization requires information system developers to perform configuration management during information system design.
References: NIST: NIST SP 800-53 (v3): SA-10 (a) NIST: NIST SP 800-53A (v1): SA-10.1 (i)
CCI-000683 (policy): The organization requires information system developers to perform configuration management during information system development.
References: NIST: NIST SP 800-53 (v3): SA-10 (a) NIST: NIST SP 800-53A (v1): SA-10.1 (i)
CCI-000684 (policy): The organization requires information system developers to perform configuration management during information system implementation.
References: NIST: NIST SP 800-53 (v3): SA-10 (a) NIST: NIST SP 800-53A (v1): SA-10.1 (i)
CCI-000685 (policy): The organization requires information system developers to perform configuration management during information system operation.
References: NIST: NIST SP 800-53 (v3): SA-10 (a) NIST: NIST SP 800-53A (v1): SA-10.1 (i)
CCI-000686 (policy): The organization requires information system integrators to perform configuration management during information system design.
References: NIST: NIST SP 800-53 (v3): SA-10 (a) NIST: NIST SP 800-53A (v1): SA-10.1 (i)
CCI-000687 (policy): The organization requires information system integrators to perform configuration management during information system development.
References: NIST: NIST SP 800-53 (v3): SA-10 (a) NIST: NIST SP 800-53A (v1): SA-10.1 (i)
CCI-000688 (policy): The organization requires information system integrators to perform configuration management during information system implementation.
References: NIST: NIST SP 800-53 (v3): SA-10 (a) NIST: NIST SP 800-53A (v1): SA-10.1 (i)
CCI-000689 (policy): The organization requires information system integrators to perform configuration management during information system operation.
References: NIST: NIST SP 800-53 (v3): SA-10 (a) NIST: NIST SP 800-53A (v1): SA-10.1 (i)
CCI-000690 (policy): The organization requires information system developers to manage and control changes to the information system during design.
References: NIST: NIST SP 800-53 (v3): SA-10 (b) NIST: NIST SP 800-53A (v1): SA-10.1 (ii)
CCI-000691 (policy): The organization requires information system integrators to manage and control changes to the information system during design.
References: NIST: NIST SP 800-53 (v3): SA-10 (b) NIST: NIST SP 800-53A (v1): SA-10.1 (ii)
CCI-000693 (policy): The organization requires information system integrators to implement only organization-approved changes.
References: NIST: NIST SP 800-53 (v3): SA-10 (c) NIST: NIST SP 800-53A (v1): SA-10.1 (iii)
CCI-000695 (policy): The organization requires information system integrators to document approved changes to the information system.
References: NIST: NIST SP 800-53 (v3): SA-10 (d) NIST: NIST SP 800-53A (v1): SA-10.1 (iv)
CCI-000696 (policy): The organization requires that information system developers track security flaws and flaw resolution.
References: NIST: NIST SP 800-53 (v3): SA-10 (e) NIST: NIST SP 800-53A (v1): SA-10.1 (v)
CCI-000697 (policy): The organization requires information system integrators to track security flaws and flaw resolution.
References: NIST: NIST SP 800-53 (v3): SA-10 (e) NIST: NIST SP 800-53A (v1): SA-10.1 (v)
CCI-000699 (policy): The organization requires information system integrators to provide an integrity check of software to facilitate organizational verification of software integrity after delivery.
References: NIST: NIST SP 800-53 (v3): SA-10 (1) NIST: NIST SP 800-53A (v1): SA-10 (1).1
CCI-000701 (policy): The organization provides an alternative configuration management process with organizational personnel in the absence of a dedicated integrator configuration management team.
References: NIST: NIST SP 800-53 (v3): SA-10 (2) NIST: NIST SP 800-53A (v1): SA-10 (2).1
CCI-000702 (policy): The organization requires information system developers, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.
References: NIST: NIST SP 800-53 (v3): SA-11 (a) NIST: NIST SP 800-53A (v1): SA-11.1 SA-11(3).1 (i)
CCI-000703 (policy): The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.
References: NIST: NIST SP 800-53 (v3): SA-11 (a) NIST: NIST SP 800-53A (v1): SA-11.1
CCI-000704 (policy): The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.
References: NIST: NIST SP 800-53 (v3): SA-11 (a) NIST: NIST SP 800-53A (v1): SA-11.1 SA-11(3).1 (i)
CCI-000705 (policy): The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.
References: NIST: NIST SP 800-53 (v3): SA-11 (a) NIST: NIST SP 800-53A (v1): SA-11.1
CCI-000706 (policy): The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.
References: NIST: NIST SP 800-53 (v3): SA-11 (b) NIST: NIST SP 800-53A (v1): SA-11.1
CCI-000707 (policy): The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.
References: NIST: NIST SP 800-53 (v3): SA-11 (b) NIST: NIST SP 800-53A (v1): SA-11.1
CCI-000708 (policy): The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.
References: NIST: NIST SP 800-53 (v3): SA-11 (c) NIST: NIST SP 800-53A (v1): SA-11.1
CCI-000709 (policy): The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.
References: NIST: NIST SP 800-53 (v3): SA-11 (c) NIST: NIST SP 800-53A (v1): SA-11.1
CCI-000710 (policy): The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.
References: NIST: NIST SP 800-53 (v3): SA-11 (c) NIST: NIST SP 800-53A (v1): SA-11.1
CCI-000711 (policy): The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.
References: NIST: NIST SP 800-53 (v3): SA-11 (c) NIST: NIST SP 800-53A (v1): SA-11.1
CCI-000712 (policy): The organization requires information system developers to employ code analysis tools to examine software for common flaws and document the results of the analysis.
References: NIST: NIST SP 800-53 (v3): SA-11 (1) NIST: NIST SP 800-53A (v1): SA-11 (1).1 (i) (ii)
CCI-000713 (policy): The organization requires information system integrators to employ code analysis tools to examine software for common flaws and document the results of the analysis.
References: NIST: NIST SP 800-53 (v3): SA-11 (1) NIST: NIST SP 800-53A (v1): SA-11 (1).1 (i) (ii)
CCI-000714 (policy): The organization requires information system developers to perform a vulnerability analysis to document vulnerabilities.
References: NIST: NIST SP 800-53 (v3): SA-11 (2) NIST: NIST SP 800-53A (v1): SA-11 (*2).1
CCI-000715 (policy): The organization requires information system developers to perform a vulnerability analysis to document exploitation potential.
References: NIST: NIST SP 800-53 (v3): SA-11 (2) NIST: NIST SP 800-53A (v1): SA-11 (2).1
CCI-000716 (policy): The organization requires information system developers to perform a vulnerability analysis to document risk mitigations.
References: NIST: NIST SP 800-53 (v3): SA-11 (2) NIST: NIST SP 800-53A (v1): SA-11 (2).1
CCI-000717 (policy): The organization requires information system integrators to perform a vulnerability analysis to document vulnerabilities.
References: NIST: NIST SP 800-53 (v3): SA-11 (2) NIST: NIST SP 800-53A (v1): SA-11 (2).1
CCI-000718 (policy): The organization requires information system integrators to perform a vulnerability analysis to document exploitation potential.
References: NIST: NIST SP 800-53 (v3): SA-11 (2) NIST: NIST SP 800-53A (v1): SA-11 (2).1
CCI-000719 (policy): The organization requires information system integrators perform a vulnerability analysis to document risk mitigations.
References: NIST: NIST SP 800-53 (v3): SA-11 (2) NIST: NIST SP 800-53A (v1): SA-11 (2).1
CCI-000720 (policy): The organization requires information system developers implement the security test and evaluation plan under the witness of an independent verification and validation agent.
References: NIST: NIST SP 800-53 (v3): SA-11 (3) NIST: NIST SP 800-53A (v1): SA-1 1(3).1 (ii)
CCI-000721 (policy): The organization requires information system integrators to implement the security test and evaluation plan under the witness of an independent verification and validation agent.
References: NIST: NIST SP 800-53 (v3): SA-11 (3) NIST: NIST SP 800-53A (v1): SA-1 1(3).1 (ii)
CCI-000722 (policy): The organization defines the security safeguards to employ to protect against supply chain threats to the information system, system component, or information system service.
References: NIST: NIST SP 800-53 (v3): SA-12 NIST: NIST SP 800-53 Revision 4 (v4): SA-12 NIST: NIST SP 800-53A (v1): SA-12.1 (i)
CCI-000723 (policy): The organization protects against supply chain threats to the information system, system component, or information system service by employing organization-defined security safeguards as part of a comprehensive, defense-in-breadth information security strategy.
References: NIST: NIST SP 800-53 (v3): SA-12 NIST: NIST SP 800-53 Revision 4 (v4): SA-12 NIST: NIST SP 800-53A (v1): SA-12.1 (ii)
CCI-000724 (policy): The organization purchases all anticipated information system components and spares in the initial acquisition.
References: NIST: NIST SP 800-53 (v3): SA-12 (1) NIST: NIST SP 800-53A (v1): SA-12 (1).1
CCI-000725 (policy): The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system hardware.
References: NIST: NIST SP 800-53 (v3): SA-12 (2) NIST: NIST SP 800-53A (v1): SA-12 (2).1
CCI-000726 (policy): The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system software.
References: NIST: NIST SP 800-53 (v3): SA-12 (2) NIST: NIST SP 800-53A (v1): SA-12 (2).1
CCI-000727 (policy): The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system firmware.
References: NIST: NIST SP 800-53 (v3): SA-12 (2) NIST: NIST SP 800-53A (v1): SA-12 (2).1
CCI-000728 (policy): The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system services.
References: NIST: NIST SP 800-53 (v3): SA-12 (2) NIST: NIST SP 800-53A (v1): SA-12 (2).1
CCI-000729 (policy): The organization uses trusted shipping for information systems.
References: NIST: NIST SP 800-53 (v3): SA-12 (3) NIST: NIST SP 800-53A (v1): SA-12 (3).1
CCI-000730 (policy): The organization uses trusted shipping for information system components.
References: NIST: NIST SP 800-53 (v3): SA-12 (3) NIST: NIST SP 800-53A (v1): SA-12 (3).1
CCI-000731 (policy): The organization uses trusted shipping for information technology products.
References: NIST: NIST SP 800-53 (v3): SA-12 (3) NIST: NIST SP 800-53A (v1): SA-12 (3).1
CCI-000732 (policy): The organization uses trusted warehousing for information systems.
References: NIST: NIST SP 800-53 (v3): SA-12 (3) NIST: NIST SP 800-53A (v1): SA-12 (3).1
CCI-000733 (policy): The organization uses trusted warehousing for information system components.
References: NIST: NIST SP 800-53 (v3): SA-12 (3) NIST: NIST SP 800-53A (v1): SA-12 (3).1
CCI-000734 (policy): The organization uses trusted warehousing for information technology products.
References: NIST: NIST SP 800-53 (v3): SA-12 (3) NIST: NIST SP 800-53A (v1): SA-12 (3).1
CCI-000735 (policy): The organization employs a diverse set of suppliers for information systems.
References: NIST: NIST SP 800-53 (v3): SA-12 (4) NIST: NIST SP 800-53A (v1): SA-12 (4).1
CCI-000736 (policy): The organization employs a diverse set of suppliers for information system components.
References: NIST: NIST SP 800-53 (v3): SA-12 (4) NIST: NIST SP 800-53A (v1): SA-12 (4).1
CCI-000737 (policy): The organization employs a diverse set of suppliers for information technology products.
References: NIST: NIST SP 800-53 (v3): SA-12 (4) NIST: NIST SP 800-53A (v1): SA-12 (4).1
CCI-000738 (policy): The organization employs a diverse set of suppliers for information system services.
References: NIST: NIST SP 800-53 (v3): SA-12 (4) NIST: NIST SP 800-53A (v1): SA-12 (4).1
CCI-000739 (policy): The organization employs standard configurations for information systems.
References: NIST: NIST SP 800-53 (v3): SA-12 (5) NIST: NIST SP 800-53A (v1): SA-12 (5).1
CCI-000740 (policy): The organization employs standard configurations for information system components.
References: NIST: NIST SP 800-53 (v3): SA-12 (5) NIST: NIST SP 800-53A (v1): SA-12 (5).1
CCI-000741 (policy): The organization employs standard configurations for information technology products.
References: NIST: NIST SP 800-53 (v3): SA-12 (5) NIST: NIST SP 800-53A (v1): SA-12 (5).1
CCI-000742 (policy): The organization minimizes the time between purchase decisions and delivery of information systems.
References: NIST: NIST SP 800-53 (v3): SA-12 (6) NIST: NIST SP 800-53A (v1): SA-12 (6).1
CCI-000743 (policy): The organization minimizes the time between purchase decisions and delivery of information system components.
References: NIST: NIST SP 800-53 (v3): SA-12 (6) NIST: NIST SP 800-53A (v1): SA-12 (6).1
CCI-000744 (policy): The organization minimizes the time between purchase decisions and delivery of information technology products.
References: NIST: NIST SP 800-53 (v3): SA-12 (6) NIST: NIST SP 800-53A (v1): SA-12 (6).1
CCI-000745 (policy): The organization employs independent analysis and penetration testing against delivered information systems.
References: NIST: NIST SP 800-53 (v3): SA-12 (7) NIST: NIST SP 800-53A (v1): SA-12 (7).1
CCI-000746 (policy): The organization employs independent analysis and penetration testing against delivered information system components.
References: NIST: NIST SP 800-53 (v3): SA-12 (7) NIST: NIST SP 800-53A (v1): SA-12 (7).1
CCI-000747 (policy): The organization employs independent analysis and penetration testing against delivered information technology products.
References: NIST: NIST SP 800-53 (v3): SA-12 (7) NIST: NIST SP 800-53A (v1): SA-12 (7).1
CCI-000748 (policy): The organization defines level of trustworthiness for the information system.
References: NIST: NIST SP 800-53 (v3): SA-13 NIST: NIST SP 800-53A (v1): SA-13.1 (i)
CCI-000749 (policy): The organization requires that the information system meets the organization-defined level of trustworthiness.
References: NIST: NIST SP 800-53 (v3): SA-13 NIST: NIST SP 800-53A (v1): SA-13.1 (ii)
CCI-000750 (policy): The organization defines the list of critical information system components that require re-implementation.
References: NIST: NIST SP 800-53 (v3): SA-14 NIST: NIST SP 800-53A (v1): SA-14.1 (i)
CCI-000751 (policy): The organization determines the organization-defined list of critical information system components that require re-implementation.
References: NIST: NIST SP 800-53 (v3): SA-14 a NIST: NIST SP 800-53A (v1): SA-14
CCI-000752 (policy): The organization re-implements organization-defined critical information system components.
References: NIST: NIST SP 800-53 (v3): SA-14 b NIST: NIST SP 800-53A (v1): SA-14.1 (ii)
CCI-000753 (policy): The organization identifies information system components for which alternative sourcing is not viable.
References: NIST: NIST SP 800-53 (v3): SA-14 (1) (a) NIST: NIST SP 800-53A (v1): SA-14 (1).1 (i)
CCI-000754 (policy): The organization defines measures to be employed to prevent critical security controls for information system components from being compromised.
References: NIST: NIST SP 800-53 (v3): SA-14 (1) (b) NIST: NIST SP 800-53A (v1): SA-14 (1).1 (ii)
CCI-000755 (policy): The organization employs organization-defined measures to ensure critical security controls for the information system components are not compromised.
References: NIST: NIST SP 800-53 (v3): SA-14 (1) (b) NIST: NIST SP 800-53A (v1): SA-14 (1).1 (iii)
CCI-000756 (policy): The organization develops an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): IA-1 a NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 1 NIST: NIST SP 800-53A (v1): IA-1.1 (i) (ii)
CCI-000760 (policy): The organization develops procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.
References: NIST: NIST SP 800-53 (v3): IA-1 b NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 2 NIST: NIST SP 800-53A (v1): IA-1.1 (v)
CCI-000761 (policy): The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.
References: NIST: NIST SP 800-53 (v3): IA-1 b NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 2 NIST: NIST SP 800-53A (v1): IA-1.1 (vi)
CCI-000767 (technical): The information system implements multifactor authentication for local access to privileged accounts.
References: NIST: NIST SP 800-53 (v3): IA-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (3) NIST: NIST SP 800-53A (v1): IA-2 (3).1
CCI-000768 (technical): The information system implements multifactor authentication for local access to non-privileged accounts.
References: NIST: NIST SP 800-53 (v3): IA-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (4) NIST: NIST SP 800-53A (v1): IA-2 (4).1
CCI-000769 (policy): The organization allows the use of group authenticators only when used in conjunction with an individual/unique authenticator.
References: NIST: NIST SP 800-53 (v3): IA-2 (5) (a) NIST: NIST SP 800-53A (v1): IA-2 (5).1 (i)
CCI-000770 (policy, technical): The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.
References: NIST: NIST SP 800-53 (v3): IA-2 (5) (b) NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (5) NIST: NIST SP 800-53A (v1): IA-2 (5).2 (ii)
CCI-000771 (technical): The information system uses multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the information system being accessed.
References: NIST: NIST SP 800-53 (v3): IA-2 (6) NIST: NIST SP 800-53A (v1): IA-2 (6).1
CCI-000772 (technical): The information system uses multifactor authentication for network access to non-privileged accounts where one of the factors is provided by a device separate from the information system being accessed.
References: NIST: NIST SP 800-53 (v3): IA-2 (7) NIST: NIST SP 800-53A (v1): IA-2 (7).1
CCI-000773 (policy): The organization defines replay-resistant authentication mechanisms to be used for network access to privileged accounts.
References: NIST: NIST SP 800-53 (v3): IA-2 (8) NIST: NIST SP 800-53A (v1): IA-2 (8).1 (i)
CCI-000774 (technical): The information system uses organization-defined replay-resistant authentication mechanisms for network access to privileged accounts.
References: NIST: NIST SP 800-53 (v3): IA-2 (8) NIST: NIST SP 800-53A (v1): IA-2 (8).1 (ii)
CCI-000775 (policy): The organization defines replay-resistant authentication mechanisms to be used for network access to non-privileged accounts.
References: NIST: NIST SP 800-53 (v3): IA-2 (9) NIST: NIST SP 800-53A (v1): IA-2 (9).1 (i)
CCI-000776 (technical): The information system uses organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts.
References: NIST: NIST SP 800-53 (v3): IA-2 (9) NIST: NIST SP 800-53A (v1): IA-2 (9).1 (ii)
CCI-000779 (technical): The information system authenticates devices before establishing remote network connections using bidirectional authentication between devices that is cryptographically based.
References: NIST: NIST SP 800-53 (v3): IA-3 (1) NIST: NIST SP 800-53A (v1): IA-3 (1).1 (i)
CCI-000780 (technical): The information system authenticates devices before establishing wireless network connections using bidirectional authentication between devices that is cryptographically based.
References: NIST: NIST SP 800-53 (v3): IA-3 (1) NIST: NIST SP 800-53A (v1): IA-3 (1).1 (ii)
CCI-000781 (technical): The information system authenticates devices before establishing network connections using bidirectional authentication between devices that is cryptographically based.
References: NIST: NIST SP 800-53 (v3): IA-3 (2) NIST: NIST SP 800-53A (v1): IA-3 (2).1
CCI-000782 (policy): The organization standardizes, with regard to dynamic address allocation, Dynamic Host Control Protocol (DHCP) lease information and the time assigned to DHCP-enabled devices.
References: NIST: NIST SP 800-53 (v3): IA-3 (3) NIST: NIST SP 800-53A (v1): IA-3 (3).1 (i)
CCI-000784 (policy): The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a user identifier.
References: NIST: NIST SP 800-53 (v3): IA-4 a NIST: NIST SP 800-53A (v1): IA-4.1 (iii)
CCI-000785 (policy): The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a device identifier.
References: NIST: NIST SP 800-53 (v3): IA-4 a NIST: NIST SP 800-53A (v1): IA-4.1 (iii)
CCI-000786 (policy): The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies an individual.
References: NIST: NIST SP 800-53 (v3): IA-4 b NIST: NIST SP 800-53A (v1): IA-4.1 (iii)
CCI-000787 (policy): The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies a device.
References: NIST: NIST SP 800-53 (v3): IA-4 b NIST: NIST SP 800-53A (v1): IA-4.1 (iii)
CCI-000788 (policy): The organization manages information system identifiers for users and devices by assigning the user identifier to the intended party.
References: NIST: NIST SP 800-53 (v3): IA-4 c NIST: NIST SP 800-53A (v1): IA-4.1 (iii)
CCI-000789 (policy): The organization manages information system identifiers for users and devices by assigning the device identifier to the intended device.
References: NIST: NIST SP 800-53 (v3): IA-4 c NIST: NIST SP 800-53A (v1): IA-4.1 (iii)
CCI-000790 (policy): The organization defines a time period for which the reuse of user identifiers is prohibited.
References: NIST: NIST SP 800-53 (v3): IA-4 d NIST: NIST SP 800-53A (v1): IA-4.1 (i)
CCI-000791 (policy): The organization defines a time period for which the reuse of device identifiers is prohibited.
References: NIST: NIST SP 800-53 (v3): IA-4 d NIST: NIST SP 800-53A (v1): IA-4.1 (i)
CCI-000792 (policy): The organization manages information system identifiers for users and devices by preventing reuse of user identifiers for an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): IA-4 d NIST: NIST SP 800-53A (v1): IA-4.1 (iii)
CCI-000793 (policy): The organization manages information system identifiers for users and devices by preventing reuse of device identifiers for an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): IA-4 d NIST: NIST SP 800-53A (v1): IA-4.1 (iii)
CCI-000794 (policy): The organization defines a time period of inactivity after which the identifier is disabled.
References: NIST: NIST SP 800-53 (v3): IA-4 e NIST: NIST SP 800-53 Revision 4 (v4): IA-4 e NIST: NIST SP 800-53A (v1): IA-4.1 (ii)
CCI-000795 (policy, technical): The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.
References: NIST: NIST SP 800-53 (v3): IA-4 e NIST: NIST SP 800-53 Revision 4 (v4): IA-4 e NIST: NIST SP 800-53A (v1): IA-4.1 (iii)
CCI-000797 (policy): The organization requires that registration to receive a user ID and password include authorization by a supervisor.
References: NIST: NIST SP 800-53 (v3): IA-4 (2) NIST: NIST SP 800-53A (v1): IA-4 (2) (i)
CCI-000798 (policy): The organization requires that registration to receive a user ID and password be done in person before a designated registration authority.
References: NIST: NIST SP 800-53 (v3): IA-4 (2) NIST: NIST SP 800-53A (v1): IA-4 (2) (ii)
CCI-000799 (policy): The organization requires multiple forms of certification of individual identification, such as documentary evidence or a combination of documents and biometrics, be presented to the registration authority.
References: NIST: NIST SP 800-53 (v3): IA-4 (3) NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (3) NIST: NIST SP 800-53A (v1): IA-4 (3).1
CCI-000802 (technical): The information system dynamically manages identifiers, attributes, and associated access authorizations.
References: NIST: NIST SP 800-53 (v3): IA-4 (5) NIST: NIST SP 800-53A (v1): IA-4 (5).1
CCI-000824 (policy): The organization incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises.
References: NIST: NIST SP 800-53 (v3): IR-4 c NIST: NIST SP 800-53 Revision 4 (v4): IR-4 c NIST: NIST SP 800-53A (v1): IR-4.1 (iii)
CCI-000833 (policy): The organization employs automated mechanisms to assist in the tracking of security incidents.
References: NIST: NIST SP 800-53 (v3): IR-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): IR-5 (1) NIST: NIST SP 800-53A (v1): IR-5 (1).1 (i)
CCI-000840 (policy): The organization employs automated mechanisms to increase the availability of incident response-related information and support.
References: NIST: NIST SP 800-53 (v3): IR-7 (1) NIST: NIST SP 800-53 Revision 4 (v4): IR-7 (1) NIST: NIST SP 800-53A (v1): IR-7 (1).1
CCI-000843 (policy): The organization develops an incident response plan that provides the organization with a roadmap for implementing its incident response capability; describes the structure and organization of the incident response capability; provides a high-level approach for how the incident response capability fits into the overall organization; meets the unique requirements of the organization, which relate to mission, size, structure, and functions; defines reportable incidents; provides metrics for measuring the incident response capability within the organization; and defines the resources and management support needed to effectively maintain and mature an incident response capability.
References: NIST: NIST SP 800-53 (v3): IR-8 a NIST: NIST SP 800-53A (v1): IR-8.1
CCI-000847 (policy): The organization defines the frequency for reviewing the incident response plan.
References: NIST: NIST SP 800-53 (v3): IR-8 c NIST: NIST SP 800-53 Revision 4 (v4): IR-8 c NIST: NIST SP 800-53A (v1): IR-8.2 (iii)
CCI-000848 (policy): The organization reviews the incident response plan on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): IR-8 c NIST: NIST SP 800-53 Revision 4 (v4): IR-8 c NIST: NIST SP 800-53A (v1): IR-8.2 (iv)
CCI-000858 (policy): The organization schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 (v3): MA-2 a NIST: NIST SP 800-53A (v1): MA-2.1 (i)
CCI-000859 (policy): The organization approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.
References: NIST: NIST SP 800-53 (v3): MA-2 b NIST: NIST SP 800-53 Revision 4 (v4): MA-2 b NIST: NIST SP 800-53A (v1): MA-2.1 (ii)
CCI-000863 (policy): The organization maintains maintenance records for the information system that include the date and time of maintenance, the name of the individual performing the maintenance, the name of escort, if necessary, a description of the maintenance performed, and a list of equipment removed or replaced (including identification numbers, if applicable).
References: NIST: NIST SP 800-53 (v3): MA-2 (1) (a)(b)(c)(d)(e) NIST: NIST SP 800-53A (v1): MA-2 (1).1
CCI-000864 (policy): The organization employs automated mechanisms to schedule, conduct, and document maintenance and repairs as required.
References: NIST: NIST SP 800-53 (v3): MA-2 (2) NIST: NIST SP 800-53A (v1): MA-2 (2).1(i)
CCI-000868 (policy): The organization maintains, on an ongoing basis, information system maintenance tools.
References: NIST: NIST SP 800-53 (v3): MA-3 NIST: NIST SP 800-53A (v1): MA-3.1 (ii)
CCI-000872 (policy, technical): The organization employs automated mechanisms to restrict the use of maintenance tools to authorized personnel only.
References: NIST: NIST SP 800-53 (v3): MA-3 (4) NIST: NIST SP 800-53A (v1): MA-3 (4).1
CCI-000875 (policy): The organization controls non-local maintenance and diagnostic activities.
References: NIST: NIST SP 800-53 (v3): MA-4 a NIST: NIST SP 800-53A (v1): MA-4.1 (i)
CCI-000879 (technical): The organization terminates sessions and network connections when nonlocal maintenance is completed.
References: NIST: NIST SP 800-53 (v3): MA-4 e NIST: NIST SP 800-53 Revision 4 (v4): MA-4 e NIST: NIST SP 800-53A (v1): MA-4.1 (vi)
CCI-000880 (technical): The organization audits non-local maintenance and diagnostic sessions.
References: NIST: NIST SP 800-53 (v3): MA-4 (1) NIST: NIST SP 800-53A (v1): MA-4 (1).1 (i)
CCI-000881 (policy): The organization documents, in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.
References: NIST: NIST SP 800-53 (v3): MA-4 (2) NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (2) NIST: NIST SP 800-53A (v1): MA-4 (2).1
CCI-000885 (policy): The organization requires that maintenance personnel notify organization-defined personnel when non-local maintenance is planned (i.e., date/time).
References: NIST: NIST SP 800-53 (v3): MA-4 (5) (a) NIST: NIST SP 800-53A (v1): MA-4 (5).1 (ii)
CCI-000888 (technical): The organization employs cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications.
References: NIST: NIST SP 800-53 (v3): MA-4 (6) NIST: NIST SP 800-53A (v1): MA-4 (6).1
CCI-000889 (policy): The organization employs remote disconnect verification at the termination of non-local maintenance and diagnostic sessions.
References: NIST: NIST SP 800-53 (v3): MA-4 (7) NIST: NIST SP 800-53A (v1): MA-4 (7).1
CCI-000892 (policy): The organization ensures that personnel performing maintenance on the information system have required access authorizations or designates organizational personnel with required access authorizations and technical competence deemed necessary to supervise information system maintenance.
References: NIST: NIST SP 800-53 (v3): MA-5 b NIST: NIST SP 800-53A (v1): MA-5.1 (iii)
CCI-000896 (policy): The organization requires that in the event an information system component cannot be sanitized, the procedures contained in the security plan for the system be enforced.
References: NIST: NIST SP 800-53 (v3): MA-5 (1) (c) NIST: NIST SP 800-53A (v1): MA-5 (1).1
CCI-000901 (policy): The organization defines a list of security-critical information system components and/or key information technology components for which it will obtain maintenance support and/or spare parts.
References: NIST: NIST SP 800-53 (v3): MA-6 NIST: NIST SP 800-53A (v1): MA-6.1 (i)
CCI-000902 (policy): The organization defines a time period for obtaining maintenance support and/or spare parts for security-critical information system components and/or key information technology components.
References: NIST: NIST SP 800-53 (v3): MA-6 NIST: NIST SP 800-53A (v1): MA-6.1 (ii)
CCI-000918 (policy): The organization restricts physical access to the facility containing an information system that processes classified information to authorized personnel with appropriate clearances and access authorizations.
References: NIST: NIST SP 800-53 (v3): PE-2 (3) NIST: NIST SP 800-53A (v1): PE-2 (3).1 (ii)
CCI-000919 (policy): The organization enforces physical access authorizations at organization-defined entry/exit points to the facility where the information system resides.
References: NIST: NIST SP 800-53 (v3): PE-3 a NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a NIST: NIST SP 800-53A (v1): PE-3.1 (i)
CCI-000921 (policy): The organization controls ingress/egress to the facility where the information system resides using one or more organization-defined physical access control systems/devices or guards.
References: NIST: NIST SP 800-53 (v3): PE-3 c NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a 2 NIST: NIST SP 800-53A (v1): PE-3.1 (iii)
CCI-000922 (policy): The organization controls access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.
References: NIST: NIST SP 800-53 (v3): PE-3 d NIST: NIST SP 800-53A (v1): PE-3.1 (iv)
CCI-000934 (policy): The organization employs a penetration testing process that includes unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PE-3 (6) NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (6) NIST: NIST SP 800-53A (v1): PE-3 (6).1 (ii)
CCI-000935 (policy): The organization defines the frequency of unannounced attempts to be included in a penetration testing process to bypass or circumvent security controls associated with physical access points to the facility.
References: NIST: NIST SP 800-53 (v3): PE-3 (6) NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (6) NIST: NIST SP 800-53A (v1): PE-3 (6).1 (i)
CCI-000938 (policy): The organization monitors physical access to the information system to detect and respond to physical security incidents.
References: NIST: NIST SP 800-53 (v3): PE-6 a NIST: NIST SP 800-53A (v1): PE-6.1 (i)
CCI-000943 (policy): The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions.
References: NIST: NIST SP 800-53 (v3): PE-6 (2) NIST: NIST SP 800-53A (v1): PE-6 (2).1
CCI-000944 (policy): The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible.
References: NIST: NIST SP 800-53 (v3): PE-7 NIST: NIST SP 800-53A (v1): PE-7.1
CCI-000945 (policy): The organization escorts visitors and monitors visitor activity, when required.
References: NIST: NIST SP 800-53 (v3): PE-7 (1) NIST: NIST SP 800-53A (v1): PE-7 (1).1
CCI-000946 (policy): The organization requires two forms of identification for visitor access to the facility.
References: NIST: NIST SP 800-53 (v3): PE-7 (2) NIST: NIST SP 800-53A (v1): PE-7 (2).1
CCI-000951 (policy): The organization maintains a record of all physical access, both visitor and authorized individuals.
References: NIST: NIST SP 800-53 (v3): PE-8 (2) NIST: NIST SP 800-53A (v1): PE-8 (2).1
CCI-000953 (policy): The organization employs redundant and parallel power cabling paths.
References: NIST: NIST SP 800-53 (v3): PE-9 (1) NIST: NIST SP 800-53A (v1): PE-9 (1).1
CCI-000960 (policy): The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system in the event of a primary power source loss.
References: NIST: NIST SP 800-53 (v3): PE-11 NIST: NIST SP 800-53A (v1): PE-11.1
CCI-000962 (policy): The organization provides a long-term alternate power supply for the information system that is self-contained and not reliant on external power generation.
References: NIST: NIST SP 800-53 (v3): PE-11 (2) NIST: NIST SP 800-53A (v1): PE-11 (2).1
CCI-000964 (policy): The organization provides emergency lighting for all areas within the facility supporting essential missions and business functions.
References: NIST: NIST SP 800-53 (v3): PE-12 (1) NIST: NIST SP 800-53A (v1): PE-12 (1).1
CCI-000966 (policy): The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire.
References: NIST: NIST SP 800-53 (v3): PE-13 (1) NIST: NIST SP 800-53A (v1): PE-13 (1).1
CCI-000967 (policy): The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to the organization and emergency responders.
References: NIST: NIST SP 800-53 (v3): PE-13 (2) NIST: NIST SP 800-53A (v1): PE-13 (2).1
CCI-000969 (policy): The organization ensures that the facility undergoes, on an organization-defined frequency, fire marshal inspections and promptly resolves identified deficiencies.
References: NIST: NIST SP 800-53 (v3): PE-13 (4) NIST: NIST SP 800-53A (v1): PE-13 (4).1 (ii and iii)
CCI-000970 (policy): The organization defines a frequency for fire marshal inspections.
References: NIST: NIST SP 800-53 (v3): PE-13 (4) NIST: NIST SP 800-53A (v1): PE-13 (4).1 (i)
CCI-000980 (policy): The organization employs mechanisms that, without the need for manual intervention, protect the information system from water damage in the event of a water leak.
References: NIST: NIST SP 800-53 (v3): PE-15 (1) NIST: NIST SP 800-53A (v1): PE-15 (1).1
CCI-000982 (policy): The organization monitors organization-defined types of information system components entering and exiting the facility.
References: NIST: NIST SP 800-53 (v3): PE-16 NIST: NIST SP 800-53 Revision 4 (v4): PE-16 NIST: NIST SP 800-53A (v1): PE-16.1 (ii)
CCI-000986 (policy): The organization defines management, operational, and technical information system security controls to be employed at alternate work sites.
References: NIST: NIST SP 800-53 (v3): PE-17 a NIST: NIST SP 800-53A (v1): PE-17.1 (i)
CCI-000990 (policy): The organization positions information system components within the facility to minimize potential damage from environmental hazards.
References: NIST: NIST SP 800-53 (v3): PE-18 NIST: NIST SP 800-53A (v1): PE-18.1 (i)
CCI-000992 (policy): The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards, and for existing facilities, considers the physical and environmental hazards in its risk mitigation strategy.
References: NIST: NIST SP 800-53 (v3): PE-18 (1) NIST: NIST SP 800-53A (v1): PE-18 (1).1 (i and ii)
CCI-000994 (policy): The organization ensures that information system components, associated data communications, and networks are protected in accordance with national emissions and TEMPEST policies and procedures based on the security category or classification of the information.
References: NIST: NIST SP 800-53 (v3): PE-19 (1) NIST: NIST SP 800-53 Revision 4 (v4): PE-19 (1) NIST: NIST SP 800-53A (v1): PE-19 (1).1
CCI-001006 (policy): The organization defines security measures for restricting access to media.
References: NIST: NIST SP 800-53 (v3): MP-2 NIST: NIST SP 800-53A (v1): MP-2.1 (i)
CCI-001009 (technical): The information system uses cryptographic mechanisms to protect and restrict access to information on portable digital media.
References: NIST: NIST SP 800-53 (v3): MP-2 (2) NIST: NIST SP 800-53A (v1): MP-2 (2).1
CCI-001014 (policy): The organization physically controls and securely stores organization-defined types of digital and/or non-digital media within organization-defined controlled areas.
References: NIST: NIST SP 800-53 (v3): MP-4 a NIST: NIST SP 800-53 Revision 4 (v4): MP-4 a NIST: NIST SP 800-53A (v1): MP-4.1 (ii)
CCI-001017 (policy): The organization defines security measures for securing media storage.
References: NIST: NIST SP 800-53 (v3): MP-4 a NIST: NIST SP 800-53A (v1): MP-4.1 (i)
CCI-001018 (policy): The organization protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
References: NIST: NIST SP 800-53 (v3): MP-4 b NIST: NIST SP 800-53 Revision 4 (v4): MP-4 b NIST: NIST SP 800-53A (v1): MP-4.1 (iii)
CCI-001019 (technical): The organization employs cryptographic mechanisms to protect information in storage.
References: NIST: NIST SP 800-53 (v3): MP-4 (1) NIST: NIST SP 800-53A (v1): MP-4 (1).1
CCI-001020 (policy): The organization protects and controls organization-defined types of information system media during transport outside of controlled areas using organization-defined security safeguards.
References: NIST: NIST SP 800-53 (v3): MP-5 a NIST: NIST SP 800-53 Revision 4 (v4): MP-5 a NIST: NIST SP 800-53A (v1): MP-5.1 (ii)
CCI-001027 (policy): The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.
References: NIST: NIST SP 800-53 (v3): MP-5 (4) NIST: NIST SP 800-53 Revision 4 (v4): MP-5 (4) NIST: NIST SP 800-53A (v1): MP-5 (4).1
CCI-001029 (policy): The organization tracks, documents, and verifies media sanitization and disposal actions.
References: NIST: NIST SP 800-53 (v3): MP-6 (1) NIST: NIST SP 800-53A (v1): MP-6 (1).1
CCI-001030 (policy): The organization tests sanitization equipment and procedures in accordance with the organization-defined frequency to verify that the intended sanitization is being achieved.
References: NIST: NIST SP 800-53 (v3): MP-6 (2) NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (2) NIST: NIST SP 800-53A (v1): MP-6 (2).1 (ii)
CCI-001034 (policy): The organization sanitizes information system media containing Controlled Unclassified Information (CUI) or other sensitive information in accordance with applicable organizational and/or federal standards and policies.
References: NIST: NIST SP 800-53 (v3): MP-6 (4) NIST: NIST SP 800-53A (v1): MP-6 (4).1 (ii)
CCI-001035 (policy): The organization sanitizes information system media containing classified information in accordance with NSA standards and policies.
References: NIST: NIST SP 800-53 (v3): MP-6 (5) NIST: NIST SP 800-53A (v1): MP-6 (5).1 (ii)
CCI-001036 (policy): The organization destroys information system media that cannot be sanitized.
References: NIST: NIST SP 800-53 (v3): MP-6 (6) NIST: NIST SP 800-53A (v1): MP-6 (6).1 (ii)
CCI-001045 (policy): The organization categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
References: NIST: NIST SP 800-53 (v3): RA-2 a NIST: NIST SP 800-53 Revision 4 (v4): RA-2 a NIST: NIST SP 800-53A (v1): RA-2.1 (i)
CCI-001062 (policy): The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.
References: NIST: NIST SP 800-53 (v3): RA-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (1) NIST: NIST SP 800-53A (v1): RA-5 (1).1
CCI-001065 (policy): The organization employs vulnerability scanning procedures that can demonstrate the breadth of coverage (i.e., information system components scanned).
References: NIST: NIST SP 800-53 (v3): RA-5 (3) NIST: NIST SP 800-53A (v1): RA-5 (3).1 (i)
CCI-001069 (technical): The organization employs automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): RA-5 (7) NIST: NIST SP 800-53A (v1): RA-5 (7).1 (ii)