Lexim011/Compliance huggingface dataset:
CCI-003336 (policy): Require the developer of the system, system component, or system service to design and structure the security-relevant firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (a)
CCI-003337 (policy): Require the developer of the system, system component, or system service to internally structure the security-relevant hardware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (b)
CCI-003338 (policy): Require the developer of the system, system component, or system service to internally structure the security-relevant software with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (b)
CCI-003339 (policy): Require the developer of the system, system component, or system service to internally structure the security-relevant firmware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (b)
CCI-003340 (policy): Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate testing.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (6) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (6)
CCI-003341 (policy): Require the developer of the system, component, or system service to structure security-relevant software to facilitate testing.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (6) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (6)
CCI-003342 (policy): Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate testing.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (6) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (6)
CCI-003343 (policy): Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate controlling access with least privilege.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (7) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (7)
CCI-003344 (policy): Require the developer of the system, component, or system service to structure security-relevant software to facilitate controlling access with least privilege.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (7) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (7)
CCI-003345 (policy): Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate controlling access with least privilege.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (7) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (7)
CCI-004845 (policy): Design organization-defined critical systems or system components with coordinated behavior to implement organization-defined capabilities, by system or component.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (8)
CCI-004846 (policy): Defines the critical systems or system components for implementing organization-defined capabilities, by system or component.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (8)
CCI-004847 (policy): Defines the capabilities, by system or component, for designing organization-defined critical systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (8)
CCI-004848 (policy): Use different designs for organization-defined critical systems or system components to satisfy a common set of requirements or to provide equivalent functionality.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (9)
CCI-004849 (policy): Defines the critical systems or system components for satisfying a common set of requirements or to provide equivalent functionality.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (9)
CCI-003386 (policy): Defines the critical system components to re-implement or custom develop.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-20 NIST: NIST SP 800-53 Revision 5 (v5): SA-20
CCI-003387 (policy): Re-implement or custom develops organization-defined critical system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-20 NIST: NIST SP 800-53 Revision 5 (v5): SA-20
CCI-003384 (policy): Defines the system, system component, or system service which requires the system developer to have appropriate access authorizations, satisfy additional personnel screening criteria, and provide information that the access authorizations and screening criteria are satisfied.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-21 NIST: NIST SP 800-53 Revision 5 (v5): SA-21
CCI-003383 (policy): Defines the official government duties to be assigned to the developer of an organization-defined system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-21 a NIST: NIST SP 800-53 Revision 5 (v5): SA-21 a
CCI-003385 (policy): Require that the developer of an organization-defined system, system component, or system service has appropriate access authorizations as determined by assigned organization-defined official government duties.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-21 a NIST: NIST SP 800-53 Revision 5 (v5): SA-21 a
CCI-003381 (policy): Defines additional personnel screening criteria that must be satisfied by the developer of an organization-defined system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-21 b NIST: NIST SP 800-53 Revision 5 (v5): SA-21 b
CCI-003382 (policy): Require that the developer of an organization-defined information system, system component, or information system service satisfies organization-defined additional personnel screening criteria.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-21 b NIST: NIST SP 800-53 Revision 5 (v5): SA-21 b
CCI-003376 (policy): Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-22 a NIST: NIST SP 800-53 Revision 5 (v5): SA-22 a
CCI-003372 (policy): Define the support from external providers to be provided for alternative sources for continued support for unsupported system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-22 (1) NIST: NIST SP 800-53 Revision 5 (v5): SA-22 b
CCI-003373 (policy): Provide in-house support and/or organization-defined support from external providers for alternative sources for continued support for unsupported components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-22 (1) NIST: NIST SP 800-53 Revision 5 (v5): SA-22 b
CCI-004850 (policy): Employ design; modification; augmentation; and/or reconfiguration on organization-defined systems or system components supporting mission essential services or functions to increase the trustworthiness in those systems or components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-23
CCI-004851 (policy): Defines the systems or system components for supporting mission essential services or functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-23
CCI-001075 (policy): Disseminates to organization-defined personnel or roles the organization-level; mission/business process-level; and/or system-level system and communications protection policy.
References: NIST: NIST SP 800-53 (v3): SC-1 a NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 1 NIST: NIST SP 800-53A (v1): SC-1.1 (iii)
CCI-001079 (policy): Disseminates to organization-defined personnel or roles the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.
References: NIST: NIST SP 800-53 (v3): SC-1 b NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 2 NIST: NIST SP 800-53A (v1): SC-1.1 (vi)
CCI-002378 (policy): Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level system and communications protection policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 1
CCI-002380 (policy): Defines the personnel or roles to be recipients of the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 2
CCI-004852 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 1 (a)
CCI-004853 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level a system and communications protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 1 (b)
CCI-004854 (policy): Develop and document system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 2
CCI-004855 (policy): Designate an organization-defined official to manage the development and documentation of the system and communications protection policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b
CCI-004856 (policy): Designate an organization-defined official to manage the development and documentation of the system and communications protection procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b
CCI-004857 (policy): Designate an organization-defined official to manage the dissemination of the system and communications protection policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b
CCI-004858 (policy): Designate an organization-defined official to manage the dissemination of the system and communications protection procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b
CCI-004859 (policy): Defines the official to manage the development, documentation, and dissemination of the system and communications protection policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b
CCI-004860 (policy): Defines the official to manage the development, documentation, and dissemination of the system and communications protection procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b
CCI-001076 (policy): Review and update the current system and communications protection policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SC-1 a NIST: NIST SP 800-53 Revision 4 (v4): SC-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 1 NIST: NIST SP 800-53A (v1): SC-1.2 (ii)
CCI-001077 (policy): Defines the frequency for reviewing and updating the current system and communications protection policy.
References: NIST: NIST SP 800-53 (v3): SC-1 a NIST: NIST SP 800-53 Revision 4 (v4): SC-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 1 NIST: NIST SP 800-53A (v1): SC-1.2 (i)
CCI-001080 (policy): Review and update the current system and communications protection procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SC-1 b NIST: NIST SP 800-53 Revision 4 (v4): SC-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 2 NIST: NIST SP 800-53A (v1): SC-1.2 (iv)
CCI-001081 (policy): Defines the frequency for reviewing and updating the current system and communications protection procedures.
References: NIST: NIST SP 800-53 (v3): SC-1 b NIST: NIST SP 800-53 Revision 4 (v4): SC-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 2 NIST: NIST SP 800-53A (v1): SC-1.2 (iii)
CCI-004861 (policy): Review and update the current system and communications protection policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 1
CCI-004862 (policy): Defines the events following reviewing and updating the current system and communications protection policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 1
CCI-004863 (policy): Review and update the current system and communications protection procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 2
CCI-004864 (policy): Defines the events following reviewing and updating the current system and communications protection procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 2
CCI-001082 (technical): Separate user functionality, including user interface services, from system management functionality.
References: NIST: NIST SP 800-53 (v3): SC-2 NIST: NIST SP 800-53 Revision 4 (v4): SC-2 NIST: NIST SP 800-53 Revision 5 (v5): SC-2 NIST: NIST SP 800-53A (v1): SC-2.1
CCI-001083 (technical): Prevent the presentation of system management functionality at an interface for non-privileged users.
References: NIST: NIST SP 800-53 (v3): SC-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-2 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-2 (1) NIST: NIST SP 800-53A (v1): SC-2 (1).1
CCI-004865 (technical): Store state information from applications and software separately.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-2 (2)
CCI-001084 (technical): Isolate security functions from nonsecurity functions.
References: NIST: NIST SP 800-53 (v3): SC-3 NIST: NIST SP 800-53 Revision 4 (v4): SC-3 NIST: NIST SP 800-53 Revision 5 (v5): SC-3 NIST: NIST SP 800-53A (v1): SC-3.1 (ii)
CCI-001085 (technical): Employ hardware separation mechanisms to implement security function isolation.
References: NIST: NIST SP 800-53 (v3): SC-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (1) NIST: NIST SP 800-53A (v1): SC-3 (1).1
CCI-001086 (technical): Isolate security functions enforcing access and information flow control from both nonsecurity functions and from other security functions.
References: NIST: NIST SP 800-53 (v3): SC-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (2) NIST: NIST SP 800-53A (v1): SC-3 (2).1
CCI-002381 (technical): Minimize the number of nonsecurity functions included within the isolation boundary containing security functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (3)
CCI-002382 (technical): Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (4)
CCI-001089 (technical): Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
References: NIST: NIST SP 800-53 (v3): SC-3 (5) NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (5) NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (5) NIST: NIST SP 800-53A (v1): SC-3 (5).1
CCI-001090 (technical): Prevent unauthorized and unintended information transfer via shared system resources.
References: NIST: NIST SP 800-53 (v3): SC-4 NIST: NIST SP 800-53 Revision 4 (v4): SC-4 NIST: NIST SP 800-53 Revision 5 (v5): SC-4 NIST: NIST SP 800-53A (v1): SC-4.1
CCI-002383 (policy): Defines the procedures to be employed to prevent unauthorized information transfer via shared resources when system processing explicitly switches between different information classification levels or security categories.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-4 (2)
CCI-002384 (technical): Prevent unauthorized information transfer via shared resources in accordance with organization-defined procedures when system processing explicitly switches between different information classification levels or security categories.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-4 (2)
CCI-001093 (policy): Defines the types of denial of service events for protecting against or limiting the effects of the denial-of-service events.
References: NIST: NIST SP 800-53 (v3): SC-5 NIST: NIST SP 800-53 Revision 4 (v4): SC-5 NIST: NIST SP 800-53 Revision 5 (v5): SC-5 a NIST: NIST SP 800-53A (v1): SC-5.1 (i)
CCI-002385 (technical): Protect against or limit the effects of organization-defined types of denial of service events.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-5 NIST: NIST SP 800-53 Revision 5 (v5): SC-5 a
CCI-004866 (technical): Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-5 b
CCI-004867 (technical): Defines the controls by type of denial-of-service event by employing the controls to achieve the denial-of-service objective.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-5 b
CCI-001094 (technical): Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems.
References: NIST: NIST SP 800-53 (v3): SC-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (1) NIST: NIST SP 800-53A (v1): SC-5 (1).1
CCI-002387 (policy): Defines the denial of service attacks against other systems that the system is to restrict the ability of individuals to launch.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (1)
CCI-001095 (technical): Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.
References: NIST: NIST SP 800-53 (v3): SC-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (2) NIST: NIST SP 800-53A (v1): SC-5 (2).1
CCI-002388 (policy): Defines the monitoring tools to be employed to detect indicators of denial of service attacks against the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (3) (a)
CCI-002389 (policy): Employ organization-defined monitoring tools to detect indicators of denial of service attacks against, or launched from, the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (3) (a)
CCI-002390 (policy): Defines the system resources to be monitored to determine if sufficient resources exist to prevent effective denial of service attacks.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (3) (b)
CCI-002391 (policy): Monitor organization-defined system resources to determine if sufficient resources exist to prevent effective denial of service attacks.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (3) (b)
CCI-002392 (policy): Defines the resources to be allocated to protect the availability of system resources.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-6 NIST: NIST SP 800-53 Revision 5 (v5): SC-6
CCI-002393 (policy): Defines the controls to be employed to protect the availability of system resources.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-6 NIST: NIST SP 800-53 Revision 5 (v5): SC-6
CCI-002394 (technical): Protect the availability of resources by allocating organization-defined resources based on priority, quota, and/or organization-defined controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-6 NIST: NIST SP 800-53 Revision 5 (v5): SC-6
CCI-001097 (policy, technical): Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.
References: NIST: NIST SP 800-53 (v3): SC-7 a NIST: NIST SP 800-53 Revision 4 (v4): SC-7 a NIST: NIST SP 800-53 Revision 5 (v5): SC-7 a NIST: NIST SP 800-53A (v1): SC-7.1 (iii)
CCI-002395 (policy): Implement subnetworks for publicly accessible system components that are physically and/or logically separated from internal organizational networks.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 b NIST: NIST SP 800-53 Revision 5 (v5): SC-7 b
CCI-001098 (policy): Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
References: NIST: NIST SP 800-53 (v3): SC-7 b NIST: NIST SP 800-53 Revision 4 (v4): SC-7 c NIST: NIST SP 800-53 Revision 5 (v5): SC-7 c NIST: NIST SP 800-53A (v1): SC-7.1 (iv)
CCI-004868 (technical): Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational privacy architecture.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 c
CCI-001101 (policy): Limit the number of external network connections to the system.
References: NIST: NIST SP 800-53 (v3): SC-7 (3) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (3) NIST: NIST SP 800-53A (v1): SC-7 (3).1
CCI-001102 (policy): Implement a managed interface for each external telecommunication service.
References: NIST: NIST SP 800-53 (v3): SC-7 (4) (a) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (a) NIST: NIST SP 800-53A (v1): SC-7 (4).1 (ii)
CCI-001103 (policy): Establish a traffic flow policy for each managed interface for each external telecommunication service.
References: NIST: NIST SP 800-53 (v3): SC-7 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (b) NIST: NIST SP 800-53A (v1): SC-7 (4).1 (iii)
CCI-002396 (policy): Protect the confidentiality and integrity of the information being transmitted across each interface for each external telecommunication service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (c)
CCI-001105 (policy): Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need.
References: NIST: NIST SP 800-53 (v3): SC-7 (4) (d) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (d) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (d) NIST: NIST SP 800-53A (v1): SC-7 (4).1 (v)
CCI-001106 (policy): Review exceptions to the traffic flow policy on an organization-defined frequency for each external telecommunication service.
References: NIST: NIST SP 800-53 (v3): SC-7 (4) (e) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (e) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (e) NIST: NIST SP 800-53A (v1): SC-7 (4).1 (vi)
CCI-001107 (policy): Defines a frequency for the review of exceptions to the traffic flow policy for each external telecommunication service.
References: NIST: NIST SP 800-53 (v3): SC-7 (4) (e) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (e) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (e) NIST: NIST SP 800-53A (v1): SC-7 (4).1 (i)
CCI-001108 (policy): Remove traffic flow policy exceptions that are no longer supported by an explicit mission or business need for each external telecommunication service.
References: NIST: NIST SP 800-53 (v3): SC-7 (4) (f) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (e) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (e) NIST: NIST SP 800-53A (v1): SC-7 (4).1 (vii)
CCI-004869 (policy): Prevent unauthorized exchange of control plane traffic with external networks.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (f)
CCI-004870 (policy): Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (g)
CCI-004871 (policy): Filter unauthorized control plane traffic from external networks.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (h)
CCI-001109 (technical): Deny network communications traffic by default and allow network communications traffic by exception at managed interfaces; and/or for organization-defined systems.
References: NIST: NIST SP 800-53 (v3): SC-7 (5) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (5) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (5) NIST: NIST SP 800-53A (v1): SC-7 (5).1 (i) (ii)
CCI-004872 (technical): Defines the systems that will deny network communications traffic by default and allow network communications traffic by exception.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (5)
CCI-002397 (technical): Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using organization-defined safeguards.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (7) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (7)
CCI-004873 (technical): Defines the safeguards to prevent split tunneling for remote devices connecting to organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (7)
CCI-001112 (policy): Route organization-defined internal communications traffic to organization-defined external networks through authenticated proxy servers at managed interfaces.
References: NIST: NIST SP 800-53 (v3): SC-7 (8) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (8) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (8) NIST: NIST SP 800-53A (v1): SC-7 (8).1 (iii)
CCI-001113 (policy): Defines the internal communications traffic to be routed to external networks.
References: NIST: NIST SP 800-53 (v3): SC-7 (8) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (8) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (8) NIST: NIST SP 800-53A (v1): SC-7 (8).1 (i)
CCI-001114 (policy): Defines the external networks to which organization-defined internal communications traffic should be routed.
References: NIST: NIST SP 800-53 (v3): SC-7 (8) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (8) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (8) NIST: NIST SP 800-53A (v1): SC-7 (8).1 (ii)
CCI-002398 (policy): Detect outgoing communications traffic posing a threat to external systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (9) (a) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (9) (a)
CCI-002399 (policy): Deny outgoing communications traffic posing a threat to external systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (9) (a) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (9) (a)
CCI-002400 (technical): Audit the identity of internal users associated with denied outgoing communications traffic posing a threat to external systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (9) (b) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (9) (b)
CCI-001116 (policy): Prevent the unauthorized exfiltration of information.
References: NIST: NIST SP 800-53 (v3): SC-7 (10) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (10) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (10) (a) NIST: NIST SP 800-53A (v1): SC-7 (10).1
CCI-004874 (technical): Conduct exfiltration tests at an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (10) (b)
CCI-004875 (technical): Defines the frequency to conduct exfiltration tests.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (10) (b)
CCI-002401 (policy): Defines the authorized sources from which the system will allow incoming communications.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (11) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (11)
CCI-002402 (policy): Defines the authorized destinations for routing inbound communications.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (11) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (11)
CCI-002403 (technical): Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (11) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (11)
CCI-002404 (policy): Defines the host-based boundary protection mechanisms that are to be implemented at organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (12) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (12)
CCI-002405 (policy): Defines the system components at which organization-defined host-based boundary protection mechanisms will be implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (12) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (12)
CCI-002406 (policy): Implement organization-defined host-based boundary protection mechanisms at organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (12) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (12)
CCI-001119 (policy): Isolate organization-defined information security tools, mechanisms, and support components from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.
References: NIST: NIST SP 800-53 (v3): SC-7 (13) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (13) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (13) NIST: NIST SP 800-53A (v1): SC-7 (13).1 (ii)
CCI-001120 (policy): Defines the information security tools, mechanisms, and support components to be isolated.
References: NIST: NIST SP 800-53 (v3): SC-7 (13) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (13) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (13) NIST: NIST SP 800-53A (v1): SC-7 (13).1 (iii)
CCI-001121 (policy): Protect against unauthorized physical connections at organization-defined managed interfaces.
References: NIST: NIST SP 800-53 (v3): SC-7 (14) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (14) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (14) NIST: NIST SP 800-53A (v1): SC-7 (14).1 (iii)
CCI-002407 (policy): Defines the managed interfaces at which protect against unauthorized physical connections.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (14) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (14)
CCI-001123 (policy, technical): Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.
References: NIST: NIST SP 800-53 (v3): SC-7 (15) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (15) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (15) NIST: NIST SP 800-53A (v1): SC-7 (15).1 (i) (ii)
CCI-001124 (technical): Prevent discovery of specific system components that represent a managed interface.
References: NIST: NIST SP 800-53 (v3): SC-7 (16) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (16) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (16) NIST: NIST SP 800-53A (v1): SC-7 (16).1
CCI-001125 (technical): Enforce adherence to protocol formats.
References: NIST: NIST SP 800-53 (v3): SC-7 (17) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (17) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (17) NIST: NIST SP 800-53A (v1): SC-7 (17).1
CCI-001126 (technical): Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.
References: NIST: NIST SP 800-53 (v3): SC-7 (18) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (18) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (18) NIST: NIST SP 800-53A (v1): SC-7 (18)
CCI-002408 (policy): Defines the communication clients that are independently configured by end users and external service providers which will block both inbound and outbound communications traffic.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (19) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (19)
CCI-002409 (technical): Block inbound and outbound communications traffic between organization-defined communication clients that are independently configured by end users and external service providers.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (19) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (19)
CCI-002410 (policy): Defines system components that are to be dynamically isolated from other system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (20) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (20)
CCI-002411 (technical): Provide the capability to dynamically isolate organization-defined system components from other system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (20) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (20)
CCI-002413 (policy): Defines the system components supporting organization-defined missions and/or business functions that are to be isolated using boundary protection mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (21) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (21)
CCI-002414 (policy): Defines the missions and/or business functions for which boundary protection mechanisms will be employed to isolate the supporting organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (21) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (21)
CCI-002415 (policy): Employ boundary protection mechanisms to isolate organization-defined system components supporting organization-defined missions and/or business functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (21) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (21)
CCI-002416 (policy): Implement separate network addresses to connect to systems in different security domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (22) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (22)
CCI-002417 (technical): Disable feedback to senders on protocol format validation failure.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (23) NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (23)
CCI-004876 (policy, technical): For systems that process personally identifiable information, apply organization-defined processing rules to data elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (a)
CCI-004877 (policy, technical): Defines processing rules to be applied to data elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (a)
CCI-004878 (policy, technical): For systems that process personally identifiable information, monitor for permitted processing at the external boundary of the system and at key internal boundaries within the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (b)
CCI-004879 (policy, technical): For systems that process personally identifiable information, document each processing exception.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (c)
CCI-004880 (policy, technical): For systems that process personally identifiable information, review and remove exceptions that are no longer supported.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (d)
CCI-004881 (policy): Prohibit the direct connection of organization-defined unclassified national security system to an external network without the use of organization-defined boundary protection device.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (25)
CCI-004882 (policy): Defines the unclassified national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (25)
CCI-004883 (policy): Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified national security system to an external system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (25)
CCI-004884 (policy): Prohibit the direct connection of a classified national security system to an external network without the use of organization-defined boundary protection device.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (26)
CCI-004885 (policy): Defines the boundary protection device that prohibits the direct connection of a classified national security system to an external system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (26)
CCI-004886 (policy): Prohibit the direct connection of organization-defined unclassified non-national security system to an external network without the use of organization-defined boundary protection device.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (27)
CCI-004887 (policy): Defines the unclassified non-national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (27)
CCI-004888 (policy): Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified non-national security system to an external system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (27)
CCI-004889 (policy): Prohibit the direct connection of organization-defined system to a public network.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (28)
CCI-004890 (policy): Defines the system that prohibits the direct connection to a public network.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (28)
CCI-004891 (technical): Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (29)
CCI-004892 (technical): Defines the critical system components to implement physically or logically separate subnetworks.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (29)
CCI-002418 (policy, technical): Protect the confidentiality and/or integrity of transmitted information.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-8 NIST: NIST SP 800-53 Revision 5 (v5): SC-8
CCI-002421 (technical): Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (1)
CCI-002420 (technical): Maintain the confidentiality and/or integrity of information during preparation for transmission.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (2)
CCI-002422 (technical): Maintain the confidentiality and/or integrity of information during reception.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (2)
CCI-002423 (technical): Implement cryptographic mechanisms to protect message externals unless otherwise protected by organization-defined alternative physical controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (3)
CCI-002427 (policy): Defines the alternative physical controls to be employed to protect message externals when cryptographic mechanisms are not implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (3)
CCI-002424 (policy): Defines the alternative physical controls to be employed when cryptographic mechanisms to conceal or randomize communication patterns are not implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (4)
CCI-002425 (technical): Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by organization-defined alternative physical controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (4)
CCI-004893 (technical): Implement organization-defined protection distribution system to prevent unauthorized disclosure of information, and/or detect changes to information during transmission.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (5)
CCI-004894 (technical): Defines the protected distribution system for preventing unauthorized disclosure of information, and/or detect changes to information during transmission.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (5)
CCI-001133 (technical): Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
References: NIST: NIST SP 800-53 (v3): SC-10 NIST: NIST SP 800-53 Revision 4 (v4): SC-10 NIST: NIST SP 800-53 Revision 5 (v5): SC-10 NIST: NIST SP 800-53A (v1): SC-10.1 (ii)
CCI-001134 (policy): Defines the time period of inactivity after which the system terminates a network connection associated with a communications session.
References: NIST: NIST SP 800-53 (v3): SC-10 NIST: NIST SP 800-53 Revision 4 (v4): SC-10 NIST: NIST SP 800-53 Revision 5 (v5): SC-10 NIST: NIST SP 800-53A (v1): SC-10.1 (i)
CCI-001135 (policy, technical): Provide a physically or logically isolated trusted communication path for communication between the user and the trusted components of the system.
References: NIST: NIST SP 800-53 (v3): SC-11 NIST: NIST SP 800-53 Revision 4 (v4): SC-11 NIST: NIST SP 800-53 Revision 5 (v5): SC-11 a NIST: NIST SP 800-53A (v1): SC-11.1 (iii)
CCI-001661 (policy): Defines the security functions, to at a minimum, include system authentication and re-authentication, for permitting users to invoke the trusted communications path.
References: NIST: NIST SP 800-53 (v3): SC-11 NIST: NIST SP 800-53 Revision 4 (v4): SC-11 NIST: NIST SP 800-53 Revision 5 (v5): SC-11 b NIST: NIST SP 800-53A (v1): SC-11.1 (i)
CCI-004895 (technical): Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-11 b
CCI-002426 (technical): Provide a trusted communications path that is irrefutably distinguishable from other communications paths.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-11 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-11 (1) (a)
CCI-004896 (technical): Initiates the trusted communications path for communications between the organization-defined security functions of the system and the user.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-11 (1) (b)
CCI-004897 (technical): Defines the security functions to be initiated between the system and the user for trusted communications path for communications.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-11 (1) (b)
CCI-002428 (policy): Defines the requirements for cryptographic key generation to be employed within the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002429 (policy): Defines the requirements for cryptographic key distribution to be employed within the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002430 (policy): Defines the requirements for cryptographic key storage to be employed within the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002431 (policy): Defines the requirements for cryptographic key access to be employed within the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002432 (policy): Defines the requirements for cryptographic key destruction to be employed within the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002433 (policy): Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key generation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002434 (policy): Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002435 (policy): Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002436 (policy): Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002437 (policy): Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002438 (policy): Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key generation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002439 (policy): Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002440 (policy): Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002441 (policy): Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-002442 (policy): Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 NIST: NIST SP 800-53 Revision 5 (v5): SC-12
CCI-001139 (policy): Maintain availability of information in the event of the loss of cryptographic keys by users.
References: NIST: NIST SP 800-53 (v3): SC-12 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (1) NIST: NIST SP 800-53A (v1): SC-12 (1).1
CCI-002443 (policy): Produce symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (2)
CCI-002444 (policy): Control symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (2)
CCI-002445 (policy): Distribute symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (2)
CCI-002446 (policy): Produces asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (3)
CCI-002447 (policy): Control asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (3)