Lexim011/Compliance huggingface dataset:
CCI-004419 (policy): Develop and document organization-wide procedures for appeals of adverse decisions on correction or deletion requests.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-22 d
CCI-004420 (policy): Establish a Data Governance Body consisting of organization-defined roles with organization-defined responsibilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-23
CCI-004421 (policy): Defines the roles that are established by the Data Governance Body.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-23
CCI-004422 (policy): Defines the responsibilities the Data Governance Body establishes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-23
CCI-004423 (policy): Establish a Data Integrity Board to review proposals to conduct or participate in a matching program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-24 a
CCI-004424 (policy): Establish a Data Integrity Board to conduct an annual review of all matching programs in which the agency has participated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-24 b
CCI-004425 (policy): Develop and document policies that address the use of personally identifiable information for internal testing, training, and research.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 a
CCI-004426 (policy): Develop and document procedures that address the use of personally identifiable information for internal testing, training, and research.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 a
CCI-004427 (policy): Implement policies that address the use of personally identifiable information for internal testing, training, and research.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 a
CCI-004428 (policy): Implement procedures that address the use of personally identifiable information for internal testing, training, and research.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 a
CCI-004429 (policy): Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 b
CCI-004430 (policy): Authorize the use of personally identifiable information when such information is required for internal testing, training, and research.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 c
CCI-004431 (policy): Review and update policies on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 d
CCI-004432 (policy): Defines the frequency of which the policies should be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 d
CCI-004433 (policy): Review and update procedures on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 d
CCI-004434 (policy): Defines the frequency of which the procedures should be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-25 d
CCI-004435 (policy): Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational security practices.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26
CCI-004436 (policy): Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational privacy practices.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26
CCI-004437 (policy): Implement mechanisms that are easy to use.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26 a
CCI-004438 (policy): Implement mechanisms that are readily available by the public.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26 a
CCI-004439 (policy): Implement all information necessary for successfully filing complaints.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26 b
CCI-004440 (policy): Implement tracking mechanisms to ensure all complaints received are reviewed and appropriately addressed within an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26 c
CCI-004441 (policy): Defines the time period of which the tracking mechanisms to ensure all complaints received are reviewed and addressed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26 c
CCI-004442 (policy): Implement acknowledgement of receipt of complaints, concerns, or questions from individuals within an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26 d
CCI-004443 (policy): Defines the time period for acknowledging the receipt of complaints, concerns, or questions from individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26 d
CCI-004444 (policy): Implement response to complaints, concerns, or questions from individuals within an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26 e
CCI-004445 (policy): Defines the time period for response to complaints, concerns, or questions from individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-26 e
CCI-004446 (policy): Develop organization-defined privacy reports.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-27
CCI-004447 (policy): Defines the privacy reports that are to be developed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-27
CCI-004448 (policy): Disseminate privacy reports to organization-defined oversight bodies to demonstrate accountability with statutory, regulatory, and policy privacy program mandates.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-27 a 1
CCI-004449 (policy): Develop privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program progress and compliance.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-27 a 2
CCI-004450 (policy): Disseminate privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program compliance.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-27 a 2
CCI-004451 (policy): Defines the officials responsible for monitoring privacy program compliance.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-27 a 2
CCI-004452 (policy): Review and update privacy reports on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-27 b
CCI-004453 (policy): Defines the frequency of which the privacy reports are reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-27 b
CCI-004454 (policy): Identify and document assumptions affecting risk assessments, risk response, and risk monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-28 a 1
CCI-004455 (policy): Identify and document constraints affecting risk assessments, risk response, and risk monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-28 a 2
CCI-004456 (policy): Identify and document priorities and trade-offs considered by the organization for managing risk.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-28 a 3
CCI-004457 (policy): Identify and document the organizational risk tolerance.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-28 a 4
CCI-004458 (policy): Distribute the results of risk framing activities to organization-defined personnel.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-28 b
CCI-004459 (policy): Defines the personnel to distribute the results of risk framing activities.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-28 b
CCI-004460 (policy): Review and update risk framing considerations on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-28 c
CCI-004461 (policy): Defines the frequency for reviewing and updating risk framing considerations.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-28 c
CCI-004462 (policy): Appoint a Senior Accountable Official for Risk Management to align organizational information security management processes with strategic, operational, and budgetary planning processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-29 a
CCI-004463 (policy): Appoint a Senior Accountable Official for Risk Management to align organizational information privacy management processes with strategic, operational, and budgetary planning processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-29 a
CCI-004464 (policy): Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-29 b
CCI-004465 (policy): Establish a Risk Executive (function) to ensure management of risk is consistent across the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-29 b
CCI-004466 (policy): Develop an organization-wide strategy for managing supply chain risks associated with the development of systems, system components, and system services.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-30 a
CCI-004467 (policy): Develop an organization-wide strategy for managing supply chain risks associated with the acquisition of systems, system components, and system services.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-30 a
CCI-004468 (policy): Develop an organization-wide strategy for managing supply chain risks associated with the maintenance of systems, system components, and system services.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-30 a
CCI-004469 (policy): Develop an organization-wide strategy for managing supply chain risks associated with the disposal of systems, system components, and system services.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-30 a
CCI-004470 (policy): Implement the supply chain risk management strategy consistently across the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-30 b
CCI-004471 (policy): Review and update the supply chain risk management strategy on an organization-defined frequency or as required, to address organizational changes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-30 c
CCI-004472 (policy): Defines the frequency of which the supply chain risk management strategy will be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-30 c
CCI-005150 (policy): Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-30 (1)
CCI-004473 (policy): Develop an organization-wide continuous monitoring strategy establishing organization-defined metrics to be monitored.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 a
CCI-004474 (policy): Implement continuous monitoring programs that include establishing organization-wide metrics to be monitored.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 a
CCI-004475 (policy): Defines the metrics for developing and implementing continuous monitoring programs.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 a
CCI-004476 (policy): Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b
CCI-004477 (policy): Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for assessment of control effectiveness.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b
CCI-004478 (policy): Defines the frequencies for developing and implementing continuous monitoring programs for monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b
CCI-004479 (policy): Implement continuous monitoring programs that include establishing organization-wide frequencies for monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b
CCI-004480 (policy): Implement continuous monitoring programs that include establishing organization-wide frequencies for assessment of control effectiveness.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b
CCI-004481 (policy): Defines the frequencies for developing and implementing continuous monitoring programs for assessment of control effectiveness.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b
CCI-004482 (policy): Develop an organization-wide continuous monitoring strategy for ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 c
CCI-004483 (policy): Implement continuous monitoring programs that include ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 c
CCI-004484 (policy): Develop an organization-wide continuous monitoring strategy for correlation and analysis of information generated by control assessments and monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 d
CCI-004485 (policy): Implement continuous monitoring programs that include correlation and analysis of information generated by control assessments and monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 d
CCI-004486 (policy): Develop an organization-wide continuous monitoring strategy for response actions to address results of the analysis of control assessment and monitoring information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 e
CCI-004487 (policy): Implement continuous monitoring programs that include response actions to address results of the analysis of control assessment and monitoring information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 e
CCI-004488 (policy): Develop an organization-wide continuous monitoring strategy for reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f
CCI-004489 (policy): Develop an organization-wide continuous monitoring strategy for reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f
CCI-004490 (policy): Implement continuous monitoring programs that include reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f
CCI-004491 (policy): Implement continuous monitoring programs that include reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f
CCI-004492 (policy): Defines the personnel or roles for whom to report the security status of organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f
CCI-004493 (policy): Defines the personnel or roles for whom to report the privacy status of organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f
CCI-004494 (policy): Defines the frequency of reporting the security status of organizational systems to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f
CCI-004495 (policy): Defines the frequency of reporting the privacy status of organizational systems to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f
CCI-004496 (policy): Analyze organization-defined systems or system components supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-32
CCI-004497 (policy): Defines the systems or system components that are used to analyze mission essential services or functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-32
CCI-001504 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): PS-1 a NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 1 (a) NIST: NIST SP 800-53A (v1): PS-1.1 (i) (ii)
CCI-001505 (policy): Disseminate an organization-level; mission/business process-level; and/or system-level personnel security policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): PS-1 a NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 1 NIST: NIST SP 800-53A (v1): PS-1.1 (iii)
CCI-001509 (policy): Develop and document procedures to facilitate the implementation of the personnel security policy and associated personnel security controls.
References: NIST: NIST SP 800-53 (v3): PS-1 b NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 2 NIST: NIST SP 800-53A (v1): PS-1.1 (iv) (v)
CCI-001510 (policy): Disseminate personnel security procedures to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): PS-1 b NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 2 NIST: NIST SP 800-53A (v1): PS-1.1 (vi)
CCI-003017 (policy): Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level personnel security policy is disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 1
CCI-003018 (policy): Defines the personnel or roles to whom the personnel security procedures are disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 2
CCI-004498 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 1 (b)
CCI-004499 (policy): Designate an organization-defined official to manage the development and documentation of the personnel security policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b
CCI-004500 (policy): Designate an organization-defined official to manage the dissemination of the personnel security policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b
CCI-004501 (policy): Defines the official who will manage the personnel security policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b
CCI-004502 (policy): Designate an organization-defined official to manage development and documentation of the personnel security procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b
CCI-004503 (policy): Designate an organization-defined official to manage the dissemination of the personnel security procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b
CCI-004504 (policy): Defines the official who will manage the personnel security procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b
CCI-001506 (policy): Review and update the current personnel security policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PS-1 a NIST: NIST SP 800-53 Revision 4 (v4): PS-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 1 NIST: NIST SP 800-53A (v1): PS-1.2 (ii)
CCI-001507 (policy): Defines the frequency with which to review and update the current personnel security policy.
References: NIST: NIST SP 800-53 (v3): PS-1 a NIST: NIST SP 800-53 Revision 4 (v4): PS-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 1 NIST: NIST SP 800-53A (v1): PS-1.2 (i)
CCI-001508 (policy): Defines the frequency with which to review and update the current personnel security procedures.
References: NIST: NIST SP 800-53 (v3): PS-1 b NIST: NIST SP 800-53 Revision 4 (v4): PS-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 2 NIST: NIST SP 800-53A (v1): PS-1.2 (iii)
CCI-001511 (policy): Review and update the current personnel security procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PS-1 b NIST: NIST SP 800-53 Revision 4 (v4): PS-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 2 NIST: NIST SP 800-53A (v1): PS-1.2 (iv)
CCI-004505 (policy): Review and update the current personnel security policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 1
CCI-004506 (policy): Defines the events following reviewing and updating the current personnel security policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 1
CCI-004507 (policy): Review and update the current personnel security procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 2
CCI-004508 (policy): Defines the events following reviewing and updating the current personnel security procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 2
CCI-001512 (policy): Assign a risk designation to all organizational positions.
References: NIST: NIST SP 800-53 (v3): PS-2 a NIST: NIST SP 800-53 Revision 4 (v4): PS-2 a NIST: NIST SP 800-53 Revision 5 (v5): PS-2 a NIST: NIST SP 800-53A (v1): PS-2.1 (i)
CCI-001513 (policy): Establish screening criteria for individuals filling organizational positions.
References: NIST: NIST SP 800-53 (v3): PS-2 b NIST: NIST SP 800-53 Revision 4 (v4): PS-2 b NIST: NIST SP 800-53 Revision 5 (v5): PS-2 b NIST: NIST SP 800-53A (v1): PS-2.1 (ii)
CCI-001514 (policy): Review and update position risk designations in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PS-2 c NIST: NIST SP 800-53 Revision 4 (v4): PS-2 c NIST: NIST SP 800-53 Revision 5 (v5): PS-2 c NIST: NIST SP 800-53A (v1): PS-2.1 (iv)
CCI-001515 (policy): Defines the frequency with which to review and update position risk designations.
References: NIST: NIST SP 800-53 (v3): PS-2 c NIST: NIST SP 800-53 Revision 4 (v4): PS-2 c NIST: NIST SP 800-53 Revision 5 (v5): PS-2 c NIST: NIST SP 800-53A (v1): PS-2.1 (iii)
CCI-001516 (policy): Screen individuals prior to authorizing access to the system.
References: NIST: NIST SP 800-53 (v3): PS-3 a NIST: NIST SP 800-53 Revision 4 (v4): PS-3 a NIST: NIST SP 800-53 Revision 5 (v5): PS-3 a NIST: NIST SP 800-53A (v1): PS-3.1 (i)
CCI-001517 (policy): Rescreen individuals with authorized access to the system in accordance with organization-defined conditions requiring rescreening, and where rescreening is so indicated, on the organization-defined frequency of rescreening.
References: NIST: NIST SP 800-53 (v3): PS-3 b NIST: NIST SP 800-53 Revision 4 (v4): PS-3 b NIST: NIST SP 800-53 Revision 5 (v5): PS-3 b NIST: NIST SP 800-53A (v1): PS-3.1 (iii)
CCI-001518 (policy): Defines the conditions requiring rescreening of individuals with authorized access to the system.
References: NIST: NIST SP 800-53 (v3): PS-3 b NIST: NIST SP 800-53 Revision 4 (v4): PS-3 b NIST: NIST SP 800-53 Revision 5 (v5): PS-3 b NIST: NIST SP 800-53A (v1): PS-3.1 (ii)
CCI-001519 (policy): Defines the frequency for rescreening individuals with authorized access to the information system when organization-defined conditions requiring rescreening are met.
References: NIST: NIST SP 800-53 (v3): PS-3 b NIST: NIST SP 800-53 Revision 4 (v4): PS-3 b NIST: NIST SP 800-53 Revision 5 (v5): PS-3 b NIST: NIST SP 800-53A (v1): PS-3.1 (ii)
CCI-001520 (policy): Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.
References: NIST: NIST SP 800-53 (v3): PS-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (1) NIST: NIST SP 800-53A (v1): PS-3 (1).1 (i) (ii)
CCI-001521 (policy): Verify that individuals accessing a system processing, storing, or transmitting types of classified information which require formal indoctrination, are formally indoctrinated for all of the relevant types of information to which they have access on the system.
References: NIST: NIST SP 800-53 (v3): PS-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (2) NIST: NIST SP 800-53A (v1): PS-3 (2).1
CCI-003019 (policy): Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (3) (a)
CCI-003020 (policy): Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy organization-defined additional personnel screening criteria.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (3) (b)
CCI-003021 (policy): Defines additional personnel screening criteria that individuals accessing a system processing, storing, or transmitting information requiring protection must satisfy.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (3) (b)
CCI-004509 (policy): Verify that individuals accessing a system processing, storing, or transmitting organization-defined information types meet organization-defined citizenship requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (4)
CCI-004510 (policy): Defines the information types that meet the organization-defined citizenship requirement.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (4)
CCI-004511 (policy): Defines the citizenship requirements for individuals accessing a system, storing, or transmitting organization-defined information types.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (4)
CCI-001522 (policy): Upon termination of individual employment, disable system access within an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): PS-4 a NIST: NIST SP 800-53 Revision 4 (v4): PS-4 a NIST: NIST SP 800-53 Revision 5 (v5): PS-4 a NIST: NIST SP 800-53A (v1): PS-4.1 (i)
CCI-003022 (policy): Defines the time period within which to disable system access upon termination of individual employment.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 a NIST: NIST SP 800-53 Revision 5 (v5): PS-4 a
CCI-003023 (policy): Upon termination of individual employment, terminate or revoke any authenticators and credentials associated with the individual.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 b NIST: NIST SP 800-53 Revision 5 (v5): PS-4 b
CCI-001523 (policy): Upon termination of individual employment, conduct exit interviews that include a discussion of organization-defined information security topics.
References: NIST: NIST SP 800-53 (v3): PS-4 b NIST: NIST SP 800-53 Revision 4 (v4): PS-4 c NIST: NIST SP 800-53 Revision 5 (v5): PS-4 c NIST: NIST SP 800-53A (v1): PS-4.1 (ii)
CCI-003024 (policy): Defines information security topics to be discussed while conducting exit interviews.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 c NIST: NIST SP 800-53 Revision 5 (v5): PS-4 c
CCI-001524 (policy): Upon termination of individual employment, retrieve all security-related organizational system-related property.
References: NIST: NIST SP 800-53 (v3): PS-4 c NIST: NIST SP 800-53 Revision 4 (v4): PS-4 d NIST: NIST SP 800-53 Revision 5 (v5): PS-4 d NIST: NIST SP 800-53A (v1): PS-4.1 (iii)
CCI-001525 (policy): Upon termination of individual employment, retain access to organizational information formerly controlled by the terminated individual.
References: NIST: NIST SP 800-53 (v3): PS-4 d NIST: NIST SP 800-53 Revision 4 (v4): PS-4 e NIST: NIST SP 800-53 Revision 5 (v5): PS-4 e NIST: NIST SP 800-53A (v1): PS-4.1 (iv)
CCI-001526 (policy): Upon termination of individual employment, retain access to organizational systems formerly controlled by the terminated individual.
References: NIST: NIST SP 800-53 (v3): PS-4 d NIST: NIST SP 800-53 Revision 4 (v4): PS-4 e NIST: NIST SP 800-53 Revision 5 (v5): PS-4 e NIST: NIST SP 800-53A (v1): PS-4.1 (iv)
CCI-003027 (policy): Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (1) (a)
CCI-003028 (policy): Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (1) (b)
CCI-003029 (policy): Use organization-defined automated mechanisms to notify organization-defined personnel or roles of individual termination actions; and/or disable access to system resources.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (2)
CCI-003030 (policy): Defines the personnel or roles to be notified by automated mechanism of individual termination actions, and/or disable access to system resources.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (2)
CCI-004512 (policy): Defines the automated mechanisms for notifying organization-defined personnel or roles of individual termination actions; and/or disable access to system resources.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (2)
CCI-001527 (policy): Review and confirm the ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization.
References: NIST: NIST SP 800-53 (v3): PS-5 NIST: NIST SP 800-53 Revision 4 (v4): PS-5 a NIST: NIST SP 800-53 Revision 5 (v5): PS-5 a NIST: NIST SP 800-53A (v1): PS-5.1 (i)
CCI-001528 (policy): Initiate organization-defined transfer or reassignment actions within an organization-defined time period following the formal personnel transfer action.
References: NIST: NIST SP 800-53 (v3): PS-5 NIST: NIST SP 800-53 Revision 4 (v4): PS-5 b NIST: NIST SP 800-53 Revision 5 (v5): PS-5 b NIST: NIST SP 800-53A (v1): PS-5.1 (iii)
CCI-001529 (policy): Defines transfer or reassignment actions to initiate within an organization-defined time period following the formal personnel transfer action.
References: NIST: NIST SP 800-53 (v3): PS-5 NIST: NIST SP 800-53 Revision 4 (v4): PS-5 b NIST: NIST SP 800-53 Revision 5 (v5): PS-5 b NIST: NIST SP 800-53A (v1): PS-5.1 (ii)
CCI-001530 (policy): Defines the time period within which the organization initiates organization-defined transfer or reassignment actions following the formal personnel transfer action.
References: NIST: NIST SP 800-53 (v3): PS-5 NIST: NIST SP 800-53 Revision 4 (v4): PS-5 b NIST: NIST SP 800-53 Revision 5 (v5): PS-5 b NIST: NIST SP 800-53A (v1): PS-5.1 (ii)
CCI-003031 (policy): Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-5 c NIST: NIST SP 800-53 Revision 5 (v5): PS-5 c
CCI-003032 (policy): Notify organization-defined personnel or roles within an organization-defined time period when individuals are transferred or reassigned to other positions within the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-5 d NIST: NIST SP 800-53 Revision 5 (v5): PS-5 d
CCI-003033 (policy): Defines personnel or roles to be notified when individuals are transferred or reassigned to other positions within the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-5 d NIST: NIST SP 800-53 Revision 5 (v5): PS-5 d
CCI-003034 (policy): Defines the time period within which organization-defined personnel or roles are to be notified when individuals are transferred or reassigned to other positions within the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-5 d NIST: NIST SP 800-53 Revision 5 (v5): PS-5 d
CCI-003035 (policy): Develop and document access agreements for organizational systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-6 a NIST: NIST SP 800-53 Revision 5 (v5): PS-6 a
CCI-001532 (policy): Review and update the access agreements for organizational systems in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PS-6 b NIST: NIST SP 800-53 Revision 4 (v4): PS-6 b NIST: NIST SP 800-53 Revision 5 (v5): PS-6 b NIST: NIST SP 800-53A (v1): PS-6.1 (iv)
CCI-001533 (policy): Defines the frequency with which to review and update access agreements for organizational systems.
References: NIST: NIST SP 800-53 (v3): PS-6 b NIST: NIST SP 800-53 Revision 4 (v4): PS-6 b NIST: NIST SP 800-53 Revision 5 (v5): PS-6 b NIST: NIST SP 800-53A (v1): PS-6.1 (iii)
CCI-004513 (policy): Verify that individuals requiring access to organizational information sign appropriate access agreements prior to being granted access.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 1
CCI-004514 (policy): Verify that individuals requiring access to organizational systems sign appropriate access agreements prior to being granted access.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 1
CCI-004515 (policy): Verify that individuals requiring access to organizational information re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 2
CCI-004516 (policy): Verify that individuals requiring access to organizational systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 2
CCI-004517 (policy): Defines the frequency for individuals requiring access to organizational information to re-sign access agreements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 2
CCI-004518 (policy): Defines the frequency for individuals requiring access to organizational systems to re-sign access agreements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 2
CCI-001536 (policy): Verify that access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.
References: NIST: NIST SP 800-53 (v3): PS-6 (2) (a) NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (2) (a) NIST: NIST SP 800-53A (v1): PS-6 (2).1
CCI-001537 (policy): Verify that access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria.
References: NIST: NIST SP 800-53 (v3): PS-6 (2) (b) NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (2) (b) NIST: NIST SP 800-53A (v1): PS-6 (2).1
CCI-001538 (policy): Verify that access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a nondisclosure agreement.
References: NIST: NIST SP 800-53 (v3): PS-6 (2) (c) NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (2) (c) NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (2) (c) NIST: NIST SP 800-53A (v1): PS-6 (2).1
CCI-003038 (policy): Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (3) (a)
CCI-003039 (policy): Require individuals to sign an acknowledgement of legally binding post-employment requirements for protection of organizational information, if applicable, as part of granting initial access to covered information.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (3) (b)
CCI-001539 (policy): Establish personnel security requirements including security roles and responsibilities for external providers.
References: NIST: NIST SP 800-53 (v3): PS-7 a NIST: NIST SP 800-53 Revision 4 (v4): PS-7 a NIST: NIST SP 800-53 Revision 5 (v5): PS-7 a NIST: NIST SP 800-53A (v1): PS-7.1 (i)
CCI-004519 (policy): Require external providers to comply with personnel security policies established by the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-7 b
CCI-004520 (policy): Require external providers to comply with personnel security procedures established by the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-7 b
CCI-001540 (policy): Document personnel security requirements.
References: NIST: NIST SP 800-53 (v3): PS-7 b NIST: NIST SP 800-53 Revision 4 (v4): PS-7 c NIST: NIST SP 800-53 Revision 5 (v5): PS-7 c NIST: NIST SP 800-53A (v1): PS-7.1 (ii)
CCI-003041 (policy): Require external providers to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-7 d NIST: NIST SP 800-53 Revision 5 (v5): PS-7 d
CCI-003042 (policy): Defines personnel or roles whom external providers are to notify when external personnel who possess organizational credentials and /or badges or who have system privileges are transferred or terminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-7 d NIST: NIST SP 800-53 Revision 5 (v5): PS-7 d
CCI-003043 (policy): Defines the time period for external providers to notify organization-defined personnel or roles when external personnel who possess organizational credentials and/or badges, or who have system privileges are transferred or terminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-7 d NIST: NIST SP 800-53 Revision 5 (v5): PS-7 d
CCI-001541 (policy): Monitor provider compliance with personnel security requirements.
References: NIST: NIST SP 800-53 (v3): PS-7 c NIST: NIST SP 800-53 Revision 4 (v4): PS-7 e NIST: NIST SP 800-53 Revision 5 (v5): PS-7 e NIST: NIST SP 800-53A (v1): PS-7.1 (iii)
CCI-004521 (policy): Employ a formal sanctions process for individuals failing to comply with established information security policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-8 a
CCI-004522 (policy): Employ a formal sanctions process for individuals failing to comply with established information security procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-8 a
CCI-003044 (policy): Notify organization-defined personnel or roles within an organization-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-8 b NIST: NIST SP 800-53 Revision 5 (v5): PS-8 b
CCI-003045 (policy): Defines personnel or roles who are to be notified when a formal employee sanctions process is initiated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-8 b NIST: NIST SP 800-53 Revision 5 (v5): PS-8 b
CCI-003046 (policy): Defines the time period within which to notify organization-defined personnel or roles when a formal employee sanctions process is initiated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PS-8 b NIST: NIST SP 800-53 Revision 5 (v5): PS-8 b
CCI-004523 (policy): Incorporate security roles and responsibilities into organizational position descriptions.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-9
CCI-004524 (policy): Incorporate privacy roles and responsibilities into organizational position descriptions.
References: NIST: NIST SP 800-53 Revision 5 (v5): PS-9
CCI-004525 (policy): Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a 1 (a)
CCI-004526 (policy): Disseminate organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a
CCI-004527 (policy): Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy is to be disseminated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a
CCI-004528 (policy): Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a 1 (b)
CCI-004529 (policy): Develop and document procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a 2
CCI-004530 (policy): Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 b
CCI-004531 (policy): Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 b
CCI-004532 (policy): Defines the official designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 b
CCI-004533 (policy): Review and update the current personally identifiable information processing and transparency policy on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 1
CCI-004534 (policy): Review and update the current personally identifiable information processing and transparency policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 1
CCI-004535 (policy): Defines the events following reviewing and updating the current personally identifiable processing and transparency policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 1
CCI-004536 (policy): Review and update the current personally identifiable information processing and transparency procedures on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 2
CCI-004537 (policy): Review and update the current personally identifiable information processing and transparency procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 2
CCI-004538 (policy): Defines the events following reviewing and updating the current personally identifiable processing and transparency procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 2
CCI-004539 (policy): Determine and document the organization-defined authority that permits the organization-defined processing of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 a
CCI-004540 (policy): Defines the authority who will permit the organization-defined processing of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 a
CCI-004541 (policy): Defines the processing of the personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 a
CCI-004542 (policy): Restrict the organization-defined processing of personally identifiable information to only that which is authorized.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 b
CCI-004543 (policy): Defines the processing of the personally identifiable information to only that which is authorized.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 b
CCI-004544 (technical): Attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (1)
CCI-004545 (technical): Defines the authorized processing which will attach data tags to organization-defined elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (1)
CCI-004546 (technical): Defines the elements of personally identifiable information containing organization-defined authorized processing.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (1)
CCI-004547 (policy): Manage enforcement of the authorized processing of personally identifiable information using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (2)
CCI-004548 (policy): Defines the automated mechanisms for managing enforcement of the authorized processing of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (2)
CCI-004549 (policy): Identify and document the organization-defined purpose(s) for processing personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 a
CCI-004550 (policy): Defines the purpose(s) of identifying and documenting personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 a
CCI-004551 (policy): Describe the purpose(s) in the public privacy notices and policies of the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 b
CCI-004552 (policy): Restrict the organization-defined processing of personally identifiable information to only that which is compatible with the identified purpose(s).
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 c
CCI-004553 (policy): Defines the processing of personally identifiable information to only that which is compatible with the identified purpose(s).
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 c
CCI-004554 (policy): Monitor changes in processing personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 d
CCI-004555 (policy): Implement organization-defined mechanisms to ensure that any changes are made in accordance with organization-defined requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 d
CCI-004556 (policy): Defines the mechanisms for ensuring any changes are made in accordance with organization-defined requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 d
CCI-004557 (policy): Defines the requirements for implementing organization-defined mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 d
CCI-004558 (technical): Attach data tags containing organization-defined processing purposes to organization-defined elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 (1)
CCI-004559 (technical): Defines the elements of personally identifiable information containing organization-defined processing purposes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 (1)
CCI-004560 (policy): Track processing purposes of personally identifiable information using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-3 (2)
CCI-004561 (policy): Implement organization-defined tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4
CCI-004562 (policy): Defines the tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4
CCI-004563 (policy): Provide organization-defined mechanisms to allow individuals to tailor processing permissions to selected elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (1)