Lexim011/Compliance huggingface dataset:
CCI-002286 (policy): Defines the subjects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-002287 (policy): Defines the objects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-002288 (policy): Defines the security attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-002289 (technical): Provide the capability to associate organization-defined security attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-002290 (technical): Provide the capability to associate organization-defined security attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-003722 (technical): Defines the subjects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals).
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-003723 (technical): Defines the objects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals).
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-003724 (technical): Defines the privacy attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-003725 (technical): Provide the capability to associate organization-defined privacy attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-003726 (technical): Provide the capability to associate organization-defined privacy attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4)
CCI-001429 (policy): Identifies special dissemination, handling, or distribution instructions for identifying security attributes on output.
References: NIST: NIST SP 800-53 (v3): AC-16 (5) NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5) NIST: NIST SP 800-53A (v1): AC-16 (5).1 (i)
CCI-001430 (policy): Identifies human-readable, standard naming conventions for identifying security attributes on output.
References: NIST: NIST SP 800-53 (v3): AC-16 (5) NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5) NIST: NIST SP 800-53A (v1): AC-16 (5).1 (ii)
CCI-003727 (technical): Displays privacy attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5)
CCI-003728 (technical): Identifies special dissemination, handling, or distribution instructions for identifying privacy attributes on output.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5)
CCI-003729 (technical): Identifies human-readable, standard naming conventions for identifying privacy attributes on output.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5)
CCI-002291 (policy): Defines the security policies to be followed by personnel when associating organization-defined security attributes with organization-defined subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-002292 (policy): Defines the security attributes which are to be associated with organization-defined subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-002293 (policy): Defines the subjects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-002294 (policy): Defines the objects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-002295 (policy): Require personnel to associate organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-002296 (policy): Require personnel to associate organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-002297 (policy): Require personnel to maintain the association of organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-002298 (policy): Require personnel to maintain the association of organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-003730 (policy): Defines the privacy policies to be followed by personnel when associating organization-defined privacy attributes with organization-defined subjects and objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-003731 (policy): Defines the privacy attributes which are to be associated with organization-defined subjects and objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-003732 (policy): Defines the subjects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-003733 (policy): Defines the objects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-003734 (policy): Require personnel to associate organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-003735 (policy): Require personnel to associate organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-003736 (policy): Require personnel to maintain the association of organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-003737 (policy): Require personnel to maintain the association of organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6)
CCI-002299 (policy): Provide a consistent interpretation of security attributes transmitted between distributed system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (7) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (7)
CCI-003738 (policy): Provide a consistent interpretation of privacy attributes transmitted between distributed system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (7)
CCI-002300 (policy): Defines the techniques and technologies to be implemented when associating security attributes with information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8)
CCI-002301 (policy): Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating security attributes to information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8)
CCI-002302 (technical): Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating security attributes to information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8)
CCI-003739 (technical): Defines the techniques and technologies to be implemented when associating security attributes to information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8)
CCI-003740 (technical): Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating privacy attributes to information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8)
CCI-003741 (technical): Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating privacy attributes to information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8)
CCI-002303 (policy): Defines the techniques or procedures to be employed to validate re-grading mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (9)
CCI-002304 (policy): Change security attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (9)
CCI-003742 (policy): Change privacy attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (9)
CCI-002306 (technical): Provide authorized individuals the capability to define or change the type of security attributes available for association with subjects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10)
CCI-002307 (technical): Provide authorized individuals the capability to define or change the value of security attributes available for association with subjects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10)
CCI-002308 (technical): Provide authorized individuals the capability to define or change the type of security attributes available for association with objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10)
CCI-002309 (technical): Provide authorized individuals the capability to define or change the type of security attributes available for association with objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10)
CCI-003743 (policy): Provide authorized individuals the capability to define or change the type of privacy attributes available for association with subjects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10)
CCI-003744 (policy): Provide authorized individuals the capability to define or change the value of privacy attributes available for association with subjects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10)
CCI-003745 (policy): Provide authorized individuals the capability to define or change the type of privacy attributes available for association with objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10)
CCI-003746 (policy): Provide authorized individuals the capability to define or change the type of privacy attributes available for association with objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10)
CCI-002310 (policy): Establish and document usage restrictions for each type of remote access allowed.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 a NIST: NIST SP 800-53 Revision 5 (v5): AC-17 a
CCI-002311 (policy): Establish and document configuration/connection requirements for each type of remote access allowed.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 a NIST: NIST SP 800-53 Revision 5 (v5): AC-17 a
CCI-002312 (policy): Establish and document implementation guidance for each type of remote access allowed.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 a NIST: NIST SP 800-53 Revision 5 (v5): AC-17 a
CCI-000065 (policy): Authorize remote access to the system prior to allowing such connections.
References: NIST: NIST SP 800-53 (v3): AC-17 d NIST: NIST SP 800-53 Revision 4 (v4): AC-17 b NIST: NIST SP 800-53 Revision 5 (v5): AC-17 b NIST: NIST SP 800-53A (v1): AC-17.1 (iv)
CCI-000067 (technical): Employ automated mechanisms to monitor remote access methods.
References: NIST: NIST SP 800-53 (v3): AC-17 (1) NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (1) NIST: NIST SP 800-53A (v1): AC-17 (1).1
CCI-002314 (technical): Employ automated mechanisms to control remote access methods.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (1)
CCI-000068 (technical): Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
References: NIST: NIST SP 800-53 (v3): AC-17 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (2) NIST: NIST SP 800-53A (v1): AC-17 (2).1
CCI-001453 (technical): Implement cryptographic mechanisms to protect the integrity of remote access sessions.
References: NIST: NIST SP 800-53 (v3): AC-17 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (2) NIST: NIST SP 800-53A (v1): AC-17 (2).1
CCI-000069 (policy): Route all remote accesses through authorized and managed network access control points.
References: NIST: NIST SP 800-53 (v3): AC-17 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (3) NIST: NIST SP 800-53A (v1): AC-17 (3).1 (ii)
CCI-000070 (policy): Authorize the execution of privileged commands via remote access only in a format that provides assessable evidence for organization-defined needs.
References: NIST: NIST SP 800-53 (v3): AC-17 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (a) NIST: NIST SP 800-53A (v1): AC-17 (4).1 (i)
CCI-002316 (policy): Authorize access to security-relevant information via remote access only in a format that provides assessable evidence for organization-defined needs.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (a)
CCI-002317 (policy): Defines the needs for when the execution of privileged commands via remote access is to be authorized.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (a)
CCI-002318 (policy): Defines the needs for when access to security-relevant information via remote access is to be authorized.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (a)
CCI-002319 (policy): Document the rationale for authorization of the execution of privilege commands via remote access.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (b)
CCI-002320 (policy): Document the rationale for authorization of access to security-relevant information via remote access.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (b)
CCI-000072 (policy): Protect information about remote access mechanisms from unauthorized use and disclosure.
References: NIST: NIST SP 800-53 (v3): AC-17 (6) NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (6) NIST: NIST SP 800-53A (v1): AC-17 (6).1
CCI-002321 (policy): Defines the time-period within which it disconnects or disables remote access to the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (9)
CCI-002322 (technical): Provide the capability to disconnect or disable remote access to the system within the organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (9)
CCI-003747 (technical): Implement organization-defined mechanisms to authenticate organization-defined remote commands.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (10)
CCI-003748 (technical): Defines the mechanisms used to authenticate organization-defined remote commands.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (10)
CCI-003749 (technical): Defines the remote commands used for implementing organization-defined mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (10)
CCI-001439 (policy): Establish implementation guidance for wireless access.
References: NIST: NIST SP 800-53 (v3): AC-18 a NIST: NIST SP 800-53 Revision 4 (v4): AC-18 a NIST: NIST SP 800-53 Revision 5 (v5): AC-18 a NIST: NIST SP 800-53A (v1): AC-18.1 (i)
CCI-002323 (policy): Establish configuration requirements and connection requirements for wireless access.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-18 a NIST: NIST SP 800-53 Revision 5 (v5): AC-18 a
CCI-001441 (policy): Authorize each type of wireless access to the system prior to allowing such connections.
References: NIST: NIST SP 800-53 (v3): AC-18 c NIST: NIST SP 800-53 Revision 4 (v4): AC-18 b NIST: NIST SP 800-53 Revision 5 (v5): AC-18 b NIST: NIST SP 800-53A (v1): AC-18.1 (iii)
CCI-001443 (technical): Protect wireless access to the system using authentication of users and/or devices.
References: NIST: NIST SP 800-53 (v3): AC-18 (1) NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (1) NIST: NIST SP 800-53A (v1): AC-18 (1).1
CCI-001444 (technical): Protect wireless access to the system using encryption.
References: NIST: NIST SP 800-53 (v3): AC-18 (1) NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (1) NIST: NIST SP 800-53A (v1): AC-18 (1).1
CCI-001449 (policy): Disable, when not intended for use, wireless networking capabilities internally embedded within system components prior to issuance and deployment.
References: NIST: NIST SP 800-53 (v3): AC-18 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (3) NIST: NIST SP 800-53A (v1): AC-18 (3).1
CCI-002324 (policy): Identify and explicitly authorizes users allowed to independently configure wireless networking capabilities.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (4)
CCI-001451 (policy): Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
References: NIST: NIST SP 800-53 (v3): AC-18 (5) NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (5) NIST: NIST SP 800-53A (v1): AC-18 (5).1
CCI-000083 (policy): Establish implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas.
References: NIST: NIST SP 800-53 (v3): AC-19 a NIST: NIST SP 800-53 Revision 4 (v4): AC-19 a NIST: NIST SP 800-53 Revision 5 (v5): AC-19 a NIST: NIST SP 800-53A (v1): AC-19.1 (i)
CCI-002325 (policy): Establish configuration requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-19 a NIST: NIST SP 800-53 Revision 5 (v5): AC-19 a
CCI-002326 (policy): Establish connection requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-19 a NIST: NIST SP 800-53 Revision 5 (v5): AC-19 a
CCI-000084 (policy): Authorize connection of mobile devices to organizational systems.
References: NIST: NIST SP 800-53 (v3): AC-19 b NIST: NIST SP 800-53 Revision 4 (v4): AC-19 b NIST: NIST SP 800-53 Revision 5 (v5): AC-19 b NIST: NIST SP 800-53A (v1): AC-19.1 (ii)
CCI-001330 (policy): Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official.
References: NIST: NIST SP 800-53 (v3): AC-19 (4) (a) NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (a) NIST: NIST SP 800-53A (v1): AC-19 (4).1 (i)
CCI-001331 (policy): Prohibit the connection of unclassified mobile devices to classified systems.
References: NIST: NIST SP 800-53 (v3): AC-19 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (1) NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii)
CCI-001332 (policy): Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official.
References: NIST: NIST SP 800-53 (v3): AC-19 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (2) NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii)
CCI-001333 (policy): Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited.
References: NIST: NIST SP 800-53 (v3): AC-19 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (3) NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii)
CCI-001334 (policy): Require unclassified mobile devices used in facilities containing systems processing, storing, or transmitting classified information and the information stored on those devices be subject to random reviews and inspections by organization-defined security officials.
References: NIST: NIST SP 800-53 (v3): AC-19 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (4) NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii)
CCI-001335 (policy): Defines security officials to perform reviews and inspections of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information.
References: NIST: NIST SP 800-53 (v3): AC-19 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (4) NIST: NIST SP 800-53A (v1): AC-19 (4).1 (ii)
CCI-001458 (policy): Requires that if classified information is found on mobile devices, the incident handling policy be followed.
References: NIST: NIST SP 800-53 (v3): AC-19 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (4) NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii)
CCI-002327 (policy): Defines the security policies which restrict the connection of classified mobile devices to classified systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (c)
CCI-002328 (policy): Restrict the connection of classified mobile devices to classified systems in accordance with organization-defined security policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (c)
CCI-002329 (policy): Defines the mobile devices that are to employ full-device or container encryption to protect the confidentiality and integrity of the information on the device.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (5)
CCI-002330 (policy): Employs full-device encryption or container encryption to protect the confidentiality of information on organization-defined mobile devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (5)
CCI-002331 (policy): Employs full-device encryption or container encryption to protect the integrity of information on organization-defined mobile devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (5)
CCI-000093 (policy): Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from the external systems.
References: NIST: NIST SP 800-53 (v3): AC-20 a NIST: NIST SP 800-53 Revision 4 (v4): AC-20 a NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 1 NIST: NIST SP 800-53A (v1): AC-20.1
CCI-002332 (policy): Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using the external systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-20 b NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 2
CCI-003750 (policy): Defines the terms and conditions for accessing the system from external systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 1
CCI-003751 (policy): Defines the controls asserted to be implemented on external systems allowing individuals to access the system from external systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 1
CCI-003752 (policy): Defines the terms and conditions for processing, storing, or transmitting organization-controlled information using external systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 2
CCI-003753 (policy): Defines the controls asserted to be implemented on external systems allowing individuals to process, store, or transmit organization-controlled information using external systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 2
CCI-003754 (policy): Prohibit the use of organizationally-defined types of external systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 b
CCI-003755 (policy): Defines the types of external systems that are prohibited.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 b
CCI-003756 (policy): Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's security policy and security plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (1) (a)
CCI-003757 (policy): Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's privacy policy and privacy plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (1) (a)
CCI-002337 (policy): Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after the system retains approved system connection or processing agreements with the organizational entity hosting the external system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (1) (b)
CCI-000097 (policy): Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using organization-defined restrictions.
References: NIST: NIST SP 800-53 (v3): AC-20 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (2) NIST: NIST SP 800-53A (v1): AC-20 (2).1
CCI-003758 (policy): Defines the restrictions for the use of organization-controlled portable storage devices.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (2)
CCI-002338 (policy): Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using organization-defined restrictions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (3)
CCI-002339 (policy): Defines the network accessible storage devices that are to be prohibited from being used in external systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (4)
CCI-002340 (policy): Prohibit the use of organization-defined network accessible storage devices in external systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (4)
CCI-003759 (policy): Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (5)
CCI-000098 (policy): Enable authorized users to determine whether access authorizations assigned to the sharing partner match the information's access and use restrictions for organization-defined information sharing circumstances where user discretion is required.
References: NIST: NIST SP 800-53 (v3): AC-21 a NIST: NIST SP 800-53 Revision 4 (v4): AC-21 a NIST: NIST SP 800-53 Revision 5 (v5): AC-21 a NIST: NIST SP 800-53A (v1): AC-21.1 (ii)
CCI-001470 (policy): Defines information sharing circumstances where user discretion is required.
References: NIST: NIST SP 800-53 (v3): AC-21 a NIST: NIST SP 800-53 Revision 4 (v4): AC-21 a NIST: NIST SP 800-53 Revision 5 (v5): AC-21 a NIST: NIST SP 800-53A (v1): AC-21.1 (i)
CCI-001471 (policy): Employ organization-defined automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.
References: NIST: NIST SP 800-53 (v3): AC-21 b NIST: NIST SP 800-53 Revision 4 (v4): AC-21 b NIST: NIST SP 800-53 Revision 5 (v5): AC-21 b NIST: NIST SP 800-53A (v1): AC-21.1 (iv)
CCI-001472 (policy): Defines the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.
References: NIST: NIST SP 800-53 (v3): AC-21 b NIST: NIST SP 800-53 Revision 4 (v4): AC-21 b NIST: NIST SP 800-53 Revision 5 (v5): AC-21 b NIST: NIST SP 800-53A (v1): AC-21.1 (iii)
CCI-000099 (policy, technical): Employ organization-defined automated mechanisms to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
References: NIST: NIST SP 800-53 (v3): AC-21 (1) NIST: NIST SP 800-53 Revision 4 (v4): AC-21 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-21 (1) NIST: NIST SP 800-53A (v1): AC-21 (1).1
CCI-002341 (policy): Defines the information sharing restrictions to be enforced when implementing information search and retrieval services.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-21 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-21 (2)
CCI-002342 (technical): Implement information search and retrieval services that enforce organization-defined information sharing restrictions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-21 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-21 (2)
CCI-001473 (policy): Designate individuals authorized to post information onto a publicly accessible system.
References: NIST: NIST SP 800-53 (v3): AC-22 a NIST: NIST SP 800-53 Revision 4 (v4): AC-22 a NIST: NIST SP 800-53 Revision 5 (v5): AC-22 a NIST: NIST SP 800-53A (v1): AC-22.1 (i)
CCI-001474 (policy): Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information.
References: NIST: NIST SP 800-53 (v3): AC-22 b NIST: NIST SP 800-53 Revision 4 (v4): AC-22 b NIST: NIST SP 800-53 Revision 5 (v5): AC-22 b NIST: NIST SP 800-53A (v1): AC-22.1 (ii)
CCI-001475 (policy): Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included.
References: NIST: NIST SP 800-53 (v3): AC-22 c NIST: NIST SP 800-53 Revision 4 (v4): AC-22 c NIST: NIST SP 800-53 Revision 5 (v5): AC-22 c NIST: NIST SP 800-53A (v1): AC-22.1 (iii)
CCI-001476 (policy): Review the content on the publicly accessible system for nonpublic information on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AC-22 d NIST: NIST SP 800-53 Revision 4 (v4): AC-22 d NIST: NIST SP 800-53 Revision 5 (v5): AC-22 d NIST: NIST SP 800-53A (v1): AC-22.1 (iv)
CCI-001477 (policy): Defines a frequency for reviewing the content on the publicly accessible system for nonpublic information.
References: NIST: NIST SP 800-53 (v3): AC-22 d NIST: NIST SP 800-53 Revision 4 (v4): AC-22 d NIST: NIST SP 800-53 Revision 5 (v5): AC-22 d NIST: NIST SP 800-53A (v1): AC-22.1 (ii)
CCI-001478 (policy): Remove nonpublic information from the publicly accessible system, if discovered.
References: NIST: NIST SP 800-53 (v3): AC-22 e NIST: NIST SP 800-53 Revision 4 (v4): AC-22 d NIST: NIST SP 800-53 Revision 5 (v5): AC-22 d NIST: NIST SP 800-53A (v1): AC-22.1 (v)
CCI-002343 (policy): Defines the data mining prevention techniques to be employed to protect organization-defined data storage objects against data mining.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-23 NIST: NIST SP 800-53 Revision 5 (v5): AC-23
CCI-002344 (policy): Defines the data mining detection techniques to be employed to detect data mining attempts against organization-defined data storage objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-23 NIST: NIST SP 800-53 Revision 5 (v5): AC-23
CCI-002345 (policy): Defines the data storage objects that are to be protected against data mining attempts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-23 NIST: NIST SP 800-53 Revision 5 (v5): AC-23
CCI-002346 (technical): Employs organization-defined data mining prevention techniques for organization-defined data storage objects to protect against unauthorized data mining.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-23 NIST: NIST SP 800-53 Revision 5 (v5): AC-23
CCI-002347 (technical): Employ organization-defined data mining detection techniques for organization-defined data storage objects to detect data mining attempts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-23 NIST: NIST SP 800-53 Revision 5 (v5): AC-23
CCI-002348 (policy): Defines the access control decisions that are to be applied to each access request prior to access enforcement.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-24 NIST: NIST SP 800-53 Revision 5 (v5): AC-24
CCI-002349 (policy): Establish procedures or implement mechanisms to ensure organization-defined access control decisions are applied to each access request prior to access enforcement.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-24 NIST: NIST SP 800-53 Revision 5 (v5): AC-24
CCI-002350 (policy): Defines the access authorization information that is to be transmitted using organization-defined security safeguards to organization-defined systems that enforce access control decisions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (1)
CCI-002351 (policy): Defines the controls to be employed when transmitting organization-defined access authorization information to organization-defined systems that enforce access control decisions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (1)
CCI-002352 (policy): Defines the systems that are to be recipients of organization-defined access authorization information using organization-defined security safeguards.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (1)
CCI-002353 (technical): Transmit organization-defined access authorization information using organization-defined controls to organization-defined systems that enforce access control decisions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (1)
CCI-002354 (policy): Defines the security attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (2)
CCI-002355 (technical): Enforce access control decisions based on organization-defined security or privacy attributes that do not include the identity of the user or process acting on behalf of the user.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (2)
CCI-003760 (technical): Defines the privacy attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (2)
CCI-002356 (policy): Defines the access control policies to be implemented by the reference monitor.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-25 NIST: NIST SP 800-53 Revision 5 (v5): AC-25
CCI-002357 (technical): Implement a reference monitor for organization-defined access control policies that is tamperproof.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-25 NIST: NIST SP 800-53 Revision 5 (v5): AC-25
CCI-002358 (technical): Implement a reference monitor for organization-defined access control policies that is always invoked.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-25 NIST: NIST SP 800-53 Revision 5 (v5): AC-25
CCI-002359 (technical): Implement a reference monitor for organization-defined access control policies that is small enough to be subject to analysis and testing, the completeness of which can be assured.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-25 NIST: NIST SP 800-53 Revision 5 (v5): AC-25
CCI-000100 (policy): Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): AT-1 a NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 1 (a) NIST: NIST SP 800-53A (v1): AT-1.1 (i and ii)
CCI-000101 (policy): Disseminate an organization level, mission/business process-level, or system-level awareness and training policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): AT-1 a NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 1 (a) NIST: NIST SP 800-53A (v1): AT-1.1 (iii)
CCI-000103 (policy): Develop and document procedures to facilitate the implementation of the awareness and training policy and associated awareness and training controls.
References: NIST: NIST SP 800-53 (v3): AT-1 b NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 2 NIST: NIST SP 800-53A (v1): AT-1.1 (iv and v)
CCI-000104 (policy): Disseminate organization-level; mission/business process-level; or system-level awareness and training procedures to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): AT-1 b NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 2 NIST: NIST SP 800-53A (v1): AT-1.1 (vi)
CCI-002048 (policy): Defines the personnel or roles to whom the awareness and training policy is disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 1 (a)
CCI-002049 (policy): Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level awareness and training procedures are disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 2
CCI-003761 (policy): Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 1 (b)
CCI-003762 (policy): Designate an organization-defined official to manage the development and documentation of the awareness and training policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-1 b
CCI-003763 (policy): Designate an organization-defined official to manage the dissemination of the awareness and training policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-1 b
CCI-003764 (policy): Designate an organization-defined official to manage the development and documentation of the awareness and training procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-1 b
CCI-003765 (policy): Designate an organization-defined official to manage the dissemination of the awareness and training procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-1 b
CCI-000102 (policy): Review and update the current security awareness and training policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AT-1 a NIST: NIST SP 800-53 Revision 4 (v4): AT-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 c 1 NIST: NIST SP 800-53A (v1): AT-1.2 (ii)
CCI-000105 (policy): Review and update the current security awareness and training procedures in accordance with an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AT-1 b NIST: NIST SP 800-53 Revision 4 (v4): AT-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 c 2 NIST: NIST SP 800-53A (v1): AT-1.2 (iii)
CCI-001564 (policy): Defines the frequency of security awareness and training policy reviews and updates.
References: NIST: NIST SP 800-53 (v3): AT-1 a NIST: NIST SP 800-53 Revision 4 (v4): AT-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 c 1 NIST: NIST SP 800-53A (v1): AT-1.2 (i)
CCI-001565 (policy): Defines the frequency of security awareness and training procedure reviews and updates.
References: NIST: NIST SP 800-53 (v3): AT-1 b NIST: NIST SP 800-53 Revision 4 (v4): AT-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): AT-1 c 2 NIST: NIST SP 800-53A (v1): AT-1.2 (iii)
CCI-000106 (policy): Provide basic security literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users.
References: NIST: NIST SP 800-53 (v3): AT-2 NIST: NIST SP 800-53 Revision 4 (v4): AT-2 a NIST: NIST SP 800-53 Revision 5 (v5): AT-2 a 1 NIST: NIST SP 800-53A (v1): AT-2.1 (i)
CCI-000112 (policy): Provide basic security awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events.
References: NIST: NIST SP 800-53 (v3): AT-2 NIST: NIST SP 800-53 Revision 4 (v4): AT-2 b NIST: NIST SP 800-53 Revision 5 (v5): AT-2 a 2 NIST: NIST SP 800-53A (v1): AT-2.1 (i)
CCI-003766 (policy): Provide basic privacy awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 a 2
CCI-005147 (policy): Provide basic privacy literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 a 1
CCI-003767 (policy): Employ organization-defined awareness techniques to increase the security awareness of system users.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 b
CCI-003768 (policy): Employ organization-defined awareness techniques to increase the privacy awareness of system users.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 b
CCI-003769 (policy): Defines the awareness techniques for to increase security and privacy awareness of system uses.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 b
CCI-003770 (policy): Update literacy training and awareness content on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 c
CCI-003771 (policy): Update literacy training and awareness content following organization-defined event.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 c
CCI-003772 (policy): Defines the frequency for updating literacy training and awareness content.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 c
CCI-003773 (policy): Defines the events following updating literacy training and awareness content.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 c
CCI-003774 (policy): Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 d
CCI-000107 (policy): Provide practical exercises in literacy training that simulate events and incidents.
References: NIST: NIST SP 800-53 (v3): AT-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): AT-2 (1) NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (1) NIST: NIST SP 800-53A (v1): AT-2 (1).1
CCI-002055 (policy): Provide literacy training on recognizing and reporting potential indicators of insider threat.
References: NIST: NIST SP 800-53 Revision 4 (v4): AT-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (2)
CCI-003775 (policy): Provide literacy training on recognizing and reporting potential and actual instances of social engineering.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (3)
CCI-003776 (policy): Provide literacy training on recognizing and reporting potential and actual instances of social mining.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (3)
CCI-003777 (policy): Provide literacy training on recognize suspicious communications and anomalous behavior in organizational systems using organization-defined indicators of malicious code.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (4)
CCI-003778 (policy): Defines the indicators of malicious code used to recognize suspicious communications and anomalous behavior in organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (4)
CCI-003779 (policy): Provide literacy training on the advanced persistent threat.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (5)
CCI-003780 (policy): Provide literacy training on the cyber threat environment.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (6) (a)
CCI-003781 (policy): Reflect current cyber threat information in system operations.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (6) (b)
CCI-000108 (policy): Provide role-based security training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.
References: NIST: NIST SP 800-53 (v3): AT-3 NIST: NIST SP 800-53 Revision 4 (v4): AT-3 a NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a 1 NIST: NIST SP 800-53A (v1): AT-3.1 (i)