Lexim011/Compliance huggingface dataset:
CCI-000928 (policy): Enforce physical access authorizations to the system in addition to the physical access controls for the facility where the system resides at organization-defined physical spaces containing one or more components of the system.
References: NIST: NIST SP 800-53 (v3): PE-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (1) NIST: NIST SP 800-53A (v1): PE-3 (1).1
CCI-002926 (policy): Defines the physical spaces containing one or more components of the system that require physical access authorizations and controls at the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (1)
CCI-000929 (policy): Perform security checks in accordance with organization-defined frequency at the physical boundary of the facility or system for unauthorized exfiltration of information or removal of information system components.
References: NIST: NIST SP 800-53 (v3): PE-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (2) NIST: NIST SP 800-53A (v1): PE-3 (2).1
CCI-002927 (policy): Defines the frequency with which to perform security checks at the physical boundary of the facility or system for exfiltration of information or removal of system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (2)
CCI-000930 (policy): Employ guards to control every physical access point to the facility where the system resides 24 hours per day, 7 days per week.
References: NIST: NIST SP 800-53 (v3): PE-3 (3) NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (3) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (3) NIST: NIST SP 800-53A (v1): PE-3 (3).1
CCI-000931 (policy): Use lockable physical casings to protect organization-defined system components from unauthorized physical access.
References: NIST: NIST SP 800-53 (v3): PE-3 (4) NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (4) NIST: NIST SP 800-53A (v1): PE-3 (4).1 (ii)
CCI-000932 (policy): Defines system components to be protected from unauthorized physical access using lockable physical casings.
References: NIST: NIST SP 800-53 (v3): PE-3 (4) NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (4) NIST: NIST SP 800-53A (v1): PE-3 (4).1 (i)
CCI-000933 (policy): Employ organization-defined anti-tamper technologies to deter and/or prevent physical tampering or alteration of organization-defined hardware components within the system.
References: NIST: NIST SP 800-53 (v3): PE-3 (5) NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (5) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (5) NIST: NIST SP 800-53A (v1): PE-3 (5).1
CCI-002928 (policy): Defines anti-tamper technologies to detect and prevent physical tampering or alteration of organization-defined hardware components within the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (5) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (5)
CCI-002929 (policy): Defines hardware components within the system for which to employ organization-defined security safeguards to detect and prevent physical tampering or alteration.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (5) NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (5)
CCI-004244 (policy): Limit access using physical barriers.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (7)
CCI-004245 (policy): Employ access control vestibules at organization-defined locations within the facility.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (8)
CCI-004246 (policy): Defines the locations within the facility where the access control vestibules are employed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (8)
CCI-000936 (policy): Controls physical access to organization-defined system distribution and transmission lines within organizational facilities using organization-defined security controls.
References: NIST: NIST SP 800-53 (v3): PE-4 NIST: NIST SP 800-53 Revision 4 (v4): PE-4 NIST: NIST SP 800-53 Revision 5 (v5): PE-4 NIST: NIST SP 800-53A (v1): PE-4.1
CCI-002930 (policy): Defines system distribution and transmission lines within organizational facilities to control physical access to using organization-defined security controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-4 NIST: NIST SP 800-53 Revision 5 (v5): PE-4
CCI-002931 (policy): Defines security controls to control physical access to organization-defined system distribution and transmission lines within organizational facilities.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-4 NIST: NIST SP 800-53 Revision 5 (v5): PE-4
CCI-000937 (policy): Control physical access to output from organization-defined output devices to prevent unauthorized individuals from obtaining the output.
References: NIST: NIST SP 800-53 (v3): PE-5 NIST: NIST SP 800-53 Revision 4 (v4): PE-5 NIST: NIST SP 800-53 Revision 5 (v5): PE-5 NIST: NIST SP 800-53A (v1): PE-5.1
CCI-004247 (technical): Link individual identity to receipt of output from output devices.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-5 (2)
CCI-002939 (policy): Monitor physical access to the facility where the system resides to detect and respond to physical security incidents.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 a NIST: NIST SP 800-53 Revision 5 (v5): PE-6 a
CCI-000939 (policy): Review physical access logs in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PE-6 b NIST: NIST SP 800-53 Revision 4 (v4): PE-6 b NIST: NIST SP 800-53 Revision 5 (v5): PE-6 b NIST: NIST SP 800-53A (v1): PE-6.1 (iii)
CCI-000940 (policy): Defines a frequency for reviewing physical access logs.
References: NIST: NIST SP 800-53 (v3): PE-6 b NIST: NIST SP 800-53 Revision 4 (v4): PE-6 b NIST: NIST SP 800-53 Revision 5 (v5): PE-6 b NIST: NIST SP 800-53A (v1): PE-6.1 (ii)
CCI-002940 (policy): Review physical access logs upon occurrence of organization-defined events or potential indications of events.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 b NIST: NIST SP 800-53 Revision 5 (v5): PE-6 b
CCI-002941 (policy): Defines events or potential indications of events requiring review of physical access logs.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 b NIST: NIST SP 800-53 Revision 5 (v5): PE-6 b
CCI-000941 (policy): Coordinate results of reviews and investigations with the organization's incident response capability.
References: NIST: NIST SP 800-53 (v3): PE-6 c NIST: NIST SP 800-53 Revision 4 (v4): PE-6 c NIST: NIST SP 800-53 Revision 5 (v5): PE-6 c NIST: NIST SP 800-53A (v1): PE-6.1 (iv)
CCI-000942 (policy): Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.
References: NIST: NIST SP 800-53 (v3): PE-6 (1) NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (1) NIST: NIST SP 800-53A (v1): PE-6 (1).1
CCI-002942 (policy): Recognize organization-defined classes or types of intrusions, using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2)
CCI-002943 (policy): Defines the classes or types of intrusions to recognize using automated mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2)
CCI-002944 (policy): Initiate organization-defined response actions to organization-defined classes or types of intrusions, using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2)
CCI-002945 (policy): Defines the response actions to initiate when organization-defined classes or types of intrusions are recognized.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2)
CCI-004248 (policy): Defines the automated mechanisms for recognizing organization-defined classes or types of intrusions and initiating organization-defined response actions.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2)
CCI-002946 (policy): Employ video surveillance of organization-defined operational areas.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (a)
CCI-002947 (policy): Defines the operational areas in which to employ video surveillance.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (a)
CCI-004249 (policy): Review video recordings on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (b)
CCI-004250 (policy): Defines the frequency with which to review video recordings.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (b)
CCI-002948 (policy): Retain video surveillance recordings for an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (c)
CCI-002949 (policy): Defines the time period to retain video surveillance recordings.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (c)
CCI-002950 (policy): Monitor physical access to the system in addition to the physical access monitoring of the facility as organization-defined physical spaces containing one or more components of the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (4) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (4)
CCI-002951 (policy): Defines physical spaces containing one or more components of the information system in which physical access is monitored.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (4) NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (4)
CCI-000947 (policy): Maintain visitor access records to the facility where the system resides for an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): PE-8 a NIST: NIST SP 800-53 Revision 4 (v4): PE-8 a NIST: NIST SP 800-53 Revision 5 (v5): PE-8 a NIST: NIST SP 800-53A (v1): PE-8.1 (i)
CCI-002952 (policy): Defines the time period to maintain visitor access records to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-8 a NIST: NIST SP 800-53 Revision 5 (v5): PE-8 a
CCI-000948 (policy): Review visitor access records in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PE-8 b NIST: NIST SP 800-53 Revision 4 (v4): PE-8 b NIST: NIST SP 800-53 Revision 5 (v5): PE-8 b NIST: NIST SP 800-53A (v1): PE-8.1 (ii)
CCI-000949 (policy): Defines the frequency with which to review the visitor access records for the facility where the system resides.
References: NIST: NIST SP 800-53 (v3): PE-8 b NIST: NIST SP 800-53 Revision 4 (v4): PE-8 b NIST: NIST SP 800-53 Revision 5 (v5): PE-8 b NIST: NIST SP 800-53A (v1): PE-8.1 (ii)
CCI-004251 (policy): Report anomalies in visitor access records to organization-defined personnel.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-8 c
CCI-004252 (policy): Defines the personnel who are to report anomalies in visitor access records.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-8 c
CCI-000950 (policy): Maintain and review visitor access records using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): PE-8 (1) NIST: NIST SP 800-53 Revision 4 (v4): PE-8 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-8 (1) NIST: NIST SP 800-53A (v1): PE-8 (1).1
CCI-004253 (policy): Defines the automated mechanisms for maintaining and reviewing visitor access records.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-8 (1)
CCI-004254 (policy): Limit personally identifiable information contained in visitor access records to the organization-defined elements identified in the privacy risk assessment.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-8 (3)
CCI-004255 (policy): Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in visitor access records.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-8 (3)
CCI-000952 (policy): Protect power equipment and power cabling for the system from damage and destruction.
References: NIST: NIST SP 800-53 (v3): PE-9 NIST: NIST SP 800-53 Revision 4 (v4): PE-9 NIST: NIST SP 800-53 Revision 5 (v5): PE-9 NIST: NIST SP 800-53A (v1): PE-9.1
CCI-002953 (policy): Employ redundant power cabling paths that are physically separated by an organization-defined distance.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-9 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-9 (1)
CCI-002954 (policy): Defines the distance by which to physically separate redundant power cabling paths.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-9 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-9 (1)
CCI-000954 (policy): Employ automatic voltage controls for organization-defined critical system components.
References: NIST: NIST SP 800-53 (v3): PE-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): PE-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-9 (2) NIST: NIST SP 800-53A (v1): PE-9 (2).1 (ii)
CCI-000955 (policy): Defines critical system components that require automatic voltage controls.
References: NIST: NIST SP 800-53 (v3): PE-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): PE-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-9 (2) NIST: NIST SP 800-53A (v1): PE-9 (2).1 (i)
CCI-000956 (policy): Provides the capability of shutting off power to the organization-defined system or individual system components in emergency situations.
References: NIST: NIST SP 800-53 (v3): PE-10 a NIST: NIST SP 800-53 Revision 4 (v4): PE-10 a NIST: NIST SP 800-53 Revision 5 (v5): PE-10 a NIST: NIST SP 800-53A (v1): PE-10.1 (i)
CCI-004256 (policy): Defines the system or individual system components that provide the capability of shutting off power in emergency situations.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-10 a
CCI-000957 (policy): Place emergency shutoff switches or devices in an organization-defined location by system or system component to facilitate access for authorized personnel.
References: NIST: NIST SP 800-53 (v3): PE-10 b NIST: NIST SP 800-53 Revision 4 (v4): PE-10 b NIST: NIST SP 800-53 Revision 5 (v5): PE-10 b NIST: NIST SP 800-53A (v1): PE-10.1 (iii)
CCI-000958 (policy): Defines a location for emergency shutoff switches or devices by system or system component.
References: NIST: NIST SP 800-53 (v3): PE-10 b NIST: NIST SP 800-53 Revision 4 (v4): PE-10 b NIST: NIST SP 800-53 Revision 5 (v5): PE-10 b NIST: NIST SP 800-53A (v1): PE-10.1 (ii)
CCI-000959 (policy): Protect emergency power shutoff capability from unauthorized activation.
References: NIST: NIST SP 800-53 (v3): PE-10 c NIST: NIST SP 800-53 Revision 4 (v4): PE-10 c NIST: NIST SP 800-53 Revision 5 (v5): PE-10 c NIST: NIST SP 800-53A (v1): PE-10.1 (iv)
CCI-002955 (policy): Provide an uninterruptible power supply to facilitate an orderly shutdown of the system, and/or transition of the system to long-term alternate power in the event of a primary power source loss.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-11 NIST: NIST SP 800-53 Revision 5 (v5): PE-11
CCI-000961 (policy): Provide an alternate power supply for the system that is activated manually or automatically and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.
References: NIST: NIST SP 800-53 (v3): PE-11 (1) NIST: NIST SP 800-53 Revision 4 (v4): PE-11 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-11 (1) NIST: NIST SP 800-53A (v1): PE-11 (1).1
CCI-002956 (policy): Provide an alternate power supply for the system that is activated manually or automatically and that is self-contained.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-11 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): PE-11 (2) (a)
CCI-002957 (policy): Provide an alternate power supply for the system that is activated manually or automatically and that is not reliant on external power generation.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-11 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): PE-11 (2) (b)
CCI-002958 (policy): Provide an alternate power supply for the system that is activated manually or automatically and that is capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-11 (2) (c) NIST: NIST SP 800-53 Revision 5 (v5): PE-11 (2) (c)
CCI-000963 (policy): Employ and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.
References: NIST: NIST SP 800-53 (v3): PE-12 NIST: NIST SP 800-53 Revision 4 (v4): PE-12 NIST: NIST SP 800-53 Revision 5 (v5): PE-12 NIST: NIST SP 800-53A (v1): PE-12.1 (i) (ii)(iii)
CCI-002959 (policy): Provides emergency lighting for all areas within the facility supporting essential mission functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-12 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-12 (1)
CCI-002960 (policy): Provide emergency lighting for all areas within the facility supporting essential business functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-12 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-12 (1)
CCI-000965 (policy): Employ and maintain fire detection and suppression systems that are supported by an independent energy source.
References: NIST: NIST SP 800-53 (v3): PE-13 NIST: NIST SP 800-53 Revision 4 (v4): PE-13 NIST: NIST SP 800-53 Revision 5 (v5): PE-13 NIST: NIST SP 800-53A (v1): PE-13.1 (i) (ii)
CCI-002961 (policy): Employ fire detection systems for the system that activate automatically.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (1)
CCI-002962 (policy): Employ fire detection systems for the system that automatically activate to notify organization-defined personnel or roles and organization-defined emergency responders in the event of a fire.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (1)
CCI-002963 (policy): Defines the personnel or roles to be notified in the event of a fire.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (1)
CCI-002964 (policy): Defines the emergency responders to be notified in the event of a fire.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (1)
CCI-002965 (policy): Employ fire suppression systems for the system that activate automatically and notify organization-defined personnel or roles and organization-defined emergency responders.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (2) (a)
CCI-002966 (policy): Defines the personnel or roles to be automatically notified of any activation of fire suppression systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (2) (a)
CCI-002967 (policy): Defines the emergency responders to be automatically notified of any activation of fire suppression systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (2) (a)
CCI-000968 (policy): Employ an automatic fire suppression capability for the system when the facility is not staffed on a continuous basis.
References: NIST: NIST SP 800-53 (v3): PE-13 (3) NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (3) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (2) (b) NIST: NIST SP 800-53A (v1): PE-13 (3).1
CCI-002968 (policy): Ensure that the facility undergoes, on an organization-defined frequency, fire protection inspections by authorized and qualified inspectors.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (4) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (4)
CCI-002969 (policy): Defines a frequency with which the facility undergoes fire protection inspections.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (4) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (4)
CCI-002970 (policy): Ensure the identified deficiencies are resolved within an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (4) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (4)
CCI-002971 (policy): Defines the time period within which to resolve deficiencies identified during facility fire protection inspections.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (4) NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (4)
CCI-000971 (policy): Maintain temperature; humidity; pressure; radiation; and/or organization-defined environmental control levels within the facility where the system resides at organization-defined acceptable levels.
References: NIST: NIST SP 800-53 (v3): PE-14 a NIST: NIST SP 800-53 Revision 4 (v4): PE-14 a NIST: NIST SP 800-53 Revision 5 (v5): PE-14 a NIST: NIST SP 800-53A (v1): PE-14.1 (ii)
CCI-000972 (policy): Defines acceptable temperature, humidity, pressure, radiation, and/or organization-defined environmental control levels to be maintained within the facility where the system resides.
References: NIST: NIST SP 800-53 (v3): PE-14 a NIST: NIST SP 800-53 Revision 4 (v4): PE-14 a NIST: NIST SP 800-53 Revision 5 (v5): PE-14 a NIST: NIST SP 800-53A (v1): PE-14.1 (i)
CCI-000973 (policy): Monitor environmental control levels in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PE-14 b NIST: NIST SP 800-53 Revision 4 (v4): PE-14 b NIST: NIST SP 800-53 Revision 5 (v5): PE-14 b NIST: NIST SP 800-53A (v1): PE-14.1 (iv)
CCI-000974 (policy): Defines a frequency for monitoring environmental control levels.
References: NIST: NIST SP 800-53 (v3): PE-14 b NIST: NIST SP 800-53 Revision 4 (v4): PE-14 b NIST: NIST SP 800-53 Revision 5 (v5): PE-14 b NIST: NIST SP 800-53A (v1): PE-14.1 (iii)
CCI-000975 (policy): Employ organization-defined automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system.
References: NIST: NIST SP 800-53 (v3): PE-14 (1) NIST: NIST SP 800-53 Revision 4 (v4): PE-14 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-14 (1) NIST: NIST SP 800-53A (v1): PE-14 (1).1
CCI-004257 (policy): Defines the automatic environmental controls for preventing potentially harmful fluctuations to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-14 (1)
CCI-000976 (policy): Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): PE-14 (2) NIST: NIST SP 800-53 Revision 4 (v4): PE-14 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-14 (2) NIST: NIST SP 800-53A (v1): PE-14 (2).1
CCI-004258 (policy): Defines the personnel or roles who employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-14 (2)
CCI-000977 (policy): Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible.
References: NIST: NIST SP 800-53 (v3): PE-15 NIST: NIST SP 800-53 Revision 4 (v4): PE-15 NIST: NIST SP 800-53 Revision 5 (v5): PE-15 NIST: NIST SP 800-53A (v1): PE-15.1 (i)
CCI-000978 (policy): Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are working properly.
References: NIST: NIST SP 800-53 (v3): PE-15 NIST: NIST SP 800-53 Revision 4 (v4): PE-15 NIST: NIST SP 800-53 Revision 5 (v5): PE-15 NIST: NIST SP 800-53A (v1): PE-15.1 (i)
CCI-000979 (policy): Key personnel have knowledge of the master water shutoff or isolation valves.
References: NIST: NIST SP 800-53 (v3): PE-15 NIST: NIST SP 800-53 Revision 4 (v4): PE-15 NIST: NIST SP 800-53 Revision 5 (v5): PE-15 NIST: NIST SP 800-53A (v1): PE-15.1 (ii)
CCI-002973 (policy): Defines the personnel or roles to be alerted when automated mechanisms detect the presence of water near the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-15 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-15 (1)
CCI-004259 (policy): Detect the presence of water near the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-15 (1)
CCI-004260 (policy): Alert organization-defined personnel or roles of the presence of water near the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-15 (1)
CCI-004261 (policy): Defines the automated mechanisms for detecting the presence of water and alerting organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-15 (1)
CCI-000981 (policy): Authorize organization-defined types of system components entering and exiting the facility.
References: NIST: NIST SP 800-53 (v3): PE-16 NIST: NIST SP 800-53 Revision 4 (v4): PE-16 NIST: NIST SP 800-53 Revision 5 (v5): PE-16 a NIST: NIST SP 800-53A (v1): PE-16.1 (ii)
CCI-000983 (policy): Control organization-defined types of system components entering and exiting the facility.
References: NIST: NIST SP 800-53 (v3): PE-16 NIST: NIST SP 800-53 Revision 4 (v4): PE-16 NIST: NIST SP 800-53 Revision 5 (v5): PE-16 a NIST: NIST SP 800-53A (v1): PE-16.1 (ii)
CCI-002974 (policy): Defines types of system components to authorize and control entering and exiting the facility and to maintain records.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-16 NIST: NIST SP 800-53 Revision 5 (v5): PE-16 a
CCI-000984 (policy): Maintain records of system components.
References: NIST: NIST SP 800-53 (v3): PE-16 NIST: NIST SP 800-53 Revision 4 (v4): PE-16 NIST: NIST SP 800-53 Revision 5 (v5): PE-16 b NIST: NIST SP 800-53A (v1): PE-16.1 (iii)
CCI-004262 (policy): Determine and document the organization-defined alternate work sites allowed for use by employees.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-17 a
CCI-000985 (policy): Employ organization-defined controls at alternate work sites.
References: NIST: NIST SP 800-53 (v3): PE-17 a NIST: NIST SP 800-53 Revision 4 (v4): PE-17 a NIST: NIST SP 800-53 Revision 5 (v5): PE-17 b NIST: NIST SP 800-53A (v1): PE-17.1 (ii)
CCI-002975 (policy): Defines controls to employ at alternate work sites.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-17 a NIST: NIST SP 800-53 Revision 5 (v5): PE-17 b
CCI-000987 (policy): Assess as feasible, the effectiveness of controls at alternate work sites.
References: NIST: NIST SP 800-53 (v3): PE-17 b NIST: NIST SP 800-53 Revision 4 (v4): PE-17 b NIST: NIST SP 800-53 Revision 5 (v5): PE-17 c NIST: NIST SP 800-53A (v1): PE-17.1 (iii)
CCI-000988 (policy): Provide a means for employees to communicate with information security personnel in case of incidents.
References: NIST: NIST SP 800-53 (v3): PE-17 c NIST: NIST SP 800-53 Revision 4 (v4): PE-17 c NIST: NIST SP 800-53 Revision 5 (v5): PE-17 d NIST: NIST SP 800-53A (v1): PE-17.1 (iv)
CCI-004263 (policy): Provide a means for employees to communicate with information privacy personnel in case of incidents.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-17 d
CCI-000989 (policy): Position system components within the facility to minimize potential damage from organization-defined physical and environmental hazards.
References: NIST: NIST SP 800-53 (v3): PE-18 NIST: NIST SP 800-53 Revision 4 (v4): PE-18 NIST: NIST SP 800-53 Revision 5 (v5): PE-18 NIST: NIST SP 800-53A (v1): PE-18.1 (i)
CCI-000991 (policy): Position system components within the facility to minimize the opportunity for unauthorized access.
References: NIST: NIST SP 800-53 (v3): PE-18 NIST: NIST SP 800-53 Revision 4 (v4): PE-18 NIST: NIST SP 800-53 Revision 5 (v5): PE-18 NIST: NIST SP 800-53A (v1): PE-18.1 (ii)
CCI-002976 (policy): Defines physical and environmental hazards that could cause potential damage to system components within the facility.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-18 NIST: NIST SP 800-53 Revision 5 (v5): PE-18
CCI-000993 (policy): Protect the system from information leakage due to electromagnetic signals emanations.
References: NIST: NIST SP 800-53 (v3): PE-19 NIST: NIST SP 800-53 Revision 4 (v4): PE-19 NIST: NIST SP 800-53 Revision 5 (v5): PE-19 NIST: NIST SP 800-53A (v1): PE-19.1
CCI-004264 (policy): Protect system components, associated data communications, and networks in accordance with national Emissions Security policies based on the security category or classification of the information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-19 (1)
CCI-004265 (policy): Protect system components, associated data communications, and networks in accordance with national Emissions Security procedures based on the security category or classification of the information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-19 (1)
CCI-002979 (policy): Employ organization-defined asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-20 a NIST: NIST SP 800-53 Revision 5 (v5): PE-20
CCI-002980 (policy): Defines asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-20 a NIST: NIST SP 800-53 Revision 5 (v5): PE-20
CCI-002981 (policy): Defines the assets within the organization-defined controlled areas which are to be tracked and monitored for their location and movement.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-20 a NIST: NIST SP 800-53 Revision 5 (v5): PE-20
CCI-002982 (policy): Defines controlled areas where the location and movement of organization-defined assets are tracked and monitored.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-20 a NIST: NIST SP 800-53 Revision 5 (v5): PE-20
CCI-004266 (policy): Employ organization-defined protective measures against electromagnetic pulse damage for organization-defined systems and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-21
CCI-004267 (policy): Defines the protective measure employed against electromagnetic pulse damage for organization-defined systems and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-21
CCI-004268 (policy): Defines the systems and system components in which organization-defined protective measures are employed against electromagnetic pulse damage.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-21
CCI-004269 (policy): Mark organization-defined system hardware components indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-22
CCI-004270 (policy): Defines the system hardware components which are marked, indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-22
CCI-004271 (policy): Plan the location or site of the facility where the system resides considering physical and environmental hazards.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-23 a
CCI-004272 (policy): For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-23 b
CCI-000563 (policy): Develop and document an organization-level; mission/business process-level; and or system-level planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): PL-1 a NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 1 (a) NIST: NIST SP 800-53A (v1): PL-1.1 (i) (ii)
CCI-000564 (policy): Disseminate an organization-level; mission/business process-level; and or system-level planning policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): PL-1 a NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 1 (a) NIST: NIST SP 800-53A (v1): PL-1.1 (iii)
CCI-000566 (policy): Develop and document procedures to facilitate the implementation of the planning policy and associated planning controls.
References: NIST: NIST SP 800-53 (v3): PL-1 b NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 2 NIST: NIST SP 800-53A (v1): PL-1.1 (iv) (v)
CCI-000567 (policy): Disseminates planning procedures to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): PL-1 b NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 2 NIST: NIST SP 800-53A (v1): PL-1.1 (vi)
CCI-003047 (policy): Defines the personnel or roles to whom the planning policy is disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 1 (a)
CCI-003048 (policy): Defines the personnel or roles to whom the planning procedures are disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 2
CCI-004273 (policy): Develop and document an organization-level; mission/business process-level; and or system-level planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 1 (b)
CCI-004274 (policy): Designate an organization-defined official to manage the development and documentation of the planning policy and procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-1 b
CCI-004275 (policy): Designate an organization-defined official to manage the dissemination of the planning policy and procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-1 b
CCI-000568 (policy): Review and update the current planning procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PL-1 b NIST: NIST SP 800-53 Revision 4 (v4): PL-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 2 NIST: NIST SP 800-53A (v1): PL-1.2 (iv)
CCI-001636 (policy): Defines the frequency with which to review and update the current planning policy.
References: NIST: NIST SP 800-53 (v3): PL-1 NIST: NIST SP 800-53 Revision 4 (v4): PL-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 1 NIST: NIST SP 800-53A (v1): PL-1.2 (i)
CCI-001637 (policy): Review and update the current planning policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PL-1 b NIST: NIST SP 800-53 Revision 4 (v4): PL-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 1 NIST: NIST SP 800-53A (v1): PL-1.2 (ii)
CCI-001638 (policy): Defines the frequency with which to review and update the current planning procedures.
References: NIST: NIST SP 800-53 (v3): PL-1 b NIST: NIST SP 800-53 Revision 4 (v4): PL-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 2 NIST: NIST SP 800-53A (v1): PL-1.2 (iii)
CCI-004276 (policy): Review and update the current planning policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 1
CCI-004277 (policy): Review and update the current planning procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 2
CCI-000571 (policy): Develop security and privacy plans for the system that are reviewed and approved by the authorizing official or designated representative prior to plan implementation.
References: NIST: NIST SP 800-53 (v3): PL-2 a NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 9 NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 15 NIST: NIST SP 800-53A (v1): PL-2.1 (i)
CCI-003049 (policy): Develop security and privacy plans for the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a
CCI-003050 (policy): Develop security and privacy plans for the system that are consistent with the organization's enterprise architecture.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 1
CCI-003051 (policy): Develop security and privacy plans for the system that explicitly defines the authorization boundary for the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 2
CCI-003052 (policy): Develop security and privacy plans for the system that describes the operational context of the system in terms of missions and business processes.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 3 NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 3
CCI-003053 (policy): Develop security and privacy plans for the system that provide the security categorization of the system, including supporting rationale.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 4 NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 6
CCI-003054 (policy): Develop security and privacy plans for the system that describe the operational environment for the system and any dependencies on or connections to, other systems or system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 5 NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 9
CCI-003055 (policy): Develop security and privacy plans for the system that provide an overview of the security and privacy requirements for the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 6 NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 10
CCI-003056 (policy): Develop security and privacy plans for the system that identify any relevant control baselines or overlays, if applicable.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 7 NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 11
CCI-003057 (policy): Develop security and privacy plans for the system that describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 8 NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 12
CCI-004278 (policy): Develop security and privacy plans for the system that identify the individuals that fulfill system roles and responsibilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 4
CCI-004279 (policy): Develop security and privacy plans for the system that identify the information types processed, stored, and transmitted by the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 5
CCI-004280 (policy): Develop security and privacy plans for the system that describe any specific threats to the system that are of concern to the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 7
CCI-004281 (policy): Develop security and privacy plans for the system that provide the results of a privacy risk assessment for the systems processing personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 8
CCI-004282 (policy): Develop security and privacy plans for the system that include risk determinations for security and privacy architecture and design decisions.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 13
CCI-004283 (policy): Develop security and privacy plans for the system that include security- and privacy-related activities affecting the system that require planning and coordination with organization-defined individuals or groups.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 14
CCI-003059 (policy): Distribute copies of the plans to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b NIST: NIST SP 800-53 Revision 5 (v5): PL-2 b
CCI-003060 (policy): Defines the personnel or roles to whom copies of the plans are distributed.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b NIST: NIST SP 800-53 Revision 5 (v5): PL-2 b
CCI-003061 (policy): Communicate subsequent changes to the plans to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b NIST: NIST SP 800-53 Revision 5 (v5): PL-2 b
CCI-003062 (policy): Defines the personnel or roles to whom changes to the plans are communicated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b NIST: NIST SP 800-53 Revision 5 (v5): PL-2 b
CCI-000572 (policy): Defines the frequency for reviewing the plans for the system.
References: NIST: NIST SP 800-53 (v3): PL-2 b NIST: NIST SP 800-53 Revision 4 (v4): PL-2 c NIST: NIST SP 800-53 Revision 5 (v5): PL-2 c NIST: NIST SP 800-53A (v1): PL-2.1 (ii)
CCI-000573 (policy): Review the plans in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PL-2 b NIST: NIST SP 800-53 Revision 4 (v4): PL-2 c NIST: NIST SP 800-53 Revision 5 (v5): PL-2 c NIST: NIST SP 800-53A (v1): PL-2.1 (iii)
CCI-000574 (policy): Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments.
References: NIST: NIST SP 800-53 (v3): PL-2 c NIST: NIST SP 800-53 Revision 4 (v4): PL-2 d NIST: NIST SP 800-53 Revision 5 (v5): PL-2 d NIST: NIST SP 800-53A (v1): PL-2.1 (iv)
CCI-003063 (policy): Protect the plans from unauthorized disclosure.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 e NIST: NIST SP 800-53 Revision 5 (v5): PL-2 e
CCI-003064 (policy): Protect the plans from unauthorized modification.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-2 e NIST: NIST SP 800-53 Revision 5 (v5): PL-2 e
CCI-000592 (policy): Establish the rules that describe their responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system.
References: NIST: NIST SP 800-53 (v3): PL-4 a NIST: NIST SP 800-53 Revision 4 (v4): PL-4 a NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a NIST: NIST SP 800-53A (v1): PL-4.1 (i)
CCI-004284 (policy): Establish the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a
CCI-004285 (policy): Establish the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a
CCI-004286 (policy): Provide the rules describing the responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a
CCI-004287 (policy): Provide the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a
CCI-004288 (policy): Provide the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a
CCI-000593 (policy): Receive a documented acknowledgement from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system.
References: NIST: NIST SP 800-53 (v3): PL-4 b NIST: NIST SP 800-53 Revision 4 (v4): PL-4 b NIST: NIST SP 800-53 Revision 5 (v5): PL-4 b NIST: NIST SP 800-53A (v1): PL-4.1 (iii)
CCI-003068 (policy): Review and update the rules of behavior in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-4 c NIST: NIST SP 800-53 Revision 5 (v5): PL-4 c
CCI-003069 (policy): Defines the frequency with which to review and update the rules of behavior.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-4 c NIST: NIST SP 800-53 Revision 5 (v5): PL-4 c
CCI-003070 (policy): Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge, on an organization-defined frequency, and/or when the rules of behavior are revised or updated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-4 d NIST: NIST SP 800-53 Revision 5 (v5): PL-4 d
CCI-004289 (policy): Defines the frequency individuals are required to read and re-acknowledge the rules of behavior whenever the rules are revised or updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-4 d
CCI-000594 (policy): Include in the rules of behavior, restrictions on the use of social media, social networking sites, and external sites/applications.
References: NIST: NIST SP 800-53 (v3): PL-4 (1) NIST: NIST SP 800-53 Revision 4 (v4): PL-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): PL-4 (1) (a) NIST: NIST SP 800-53A (v1): PL-4 (1).1
CCI-000595 (policy): Include in the rules of behavior, restrictions on posting organizational information on public websites.
References: NIST: NIST SP 800-53 (v3): PL-4 (1) NIST: NIST SP 800-53 Revision 4 (v4): PL-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): PL-4 (1) (b) NIST: NIST SP 800-53A (v1): PL-4 (1).1
CCI-004290 (policy): Include in the rules of behavior, restrictions on use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-4 (1) (c)
CCI-003071 (policy): Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-7 a NIST: NIST SP 800-53 Revision 5 (v5): PL-7 a
CCI-004291 (policy): Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information privacy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-7 a
CCI-000577 (policy): Defines the frequency with which to review and update the CONOPS.
References: NIST: NIST SP 800-53 (v3): PL-2 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): PL-7 b NIST: NIST SP 800-53 Revision 5 (v5): PL-7 b NIST: NIST SP 800-53A (v1): PL-2 (1).1 (iii)
CCI-000578 (policy): Review and update the CONOPS in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PL-2 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): PL-7 b NIST: NIST SP 800-53 Revision 5 (v5): PL-7 b NIST: NIST SP 800-53A (v1): PL-2 (1).1 (iv)
CCI-003072 (policy): Develop security architectures for the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 a NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a
CCI-003073 (policy): Develop security architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 1
CCI-003074 (policy): Develop security architectures for the system that describe how the architectures are integrated into and support the enterprise architecture.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 3
CCI-003075 (policy): Develop security architectures for the system that describe any assumptions about, and dependencies on, external systems and services.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 a 3 NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 4
CCI-004292 (policy): Develop privacy architectures for the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a
CCI-004293 (policy): Develop privacy architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 1
CCI-004294 (policy): Develop security architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 2
CCI-004295 (policy): Develop privacy architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 2