Lexim011/Compliance huggingface dataset:
CCI-000305 (policy): The organization develops a list of software programs not authorized to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-2 (4) (a) NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-2 (4).1 (i) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-000306 (policy): The organization maintains the list of software programs not authorized to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-2 (4) (a) NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-2 (4).1 (i) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-000307 (policy): The organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-2 (4) (b) NIST: NIST SP 800-53A (v1): CM-2 (4).1 (ii)
CCI-000308 (policy): The organization develops the list of software programs authorized to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-2 (5) (a) NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-2 (5).1 (i) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-000309 (policy): The organization maintains the list of software programs authorized to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-2 (5) (a) NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-2 (5).1 (i) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-000310 (policy): The organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-2 (5) (b) NIST: NIST SP 800-53A (v1): CM-2 (5).1 (ii)
CCI-000315 (policy): The organization documents approved configuration-controlled changes to the system.
References: NIST: NIST SP 800-53 (v3): CM-3 c NIST: NIST SP 800-53A (v1): CM-3.1 (iii)
CCI-000317 (policy): The organization reviews records of configuration-controlled changes to the system.
References: NIST: NIST SP 800-53 (v3): CM-3 d NIST: NIST SP 800-53A (v1): CM-3.1 (iv)
CCI-000334 (policy): The organization analyzes new software in a separate test environment before installation in an operational environment.
References: NIST: NIST SP 800-53 (v3): CM-4 (1) NIST: NIST SP 800-53A (v1): CM-4 (1).1 (i)
CCI-000338 (policy): The organization defines physical access restrictions associated with changes to the information system.
References: NIST: NIST SP 800-53 (v3): CM-5 NIST: NIST SP 800-53 Revision 4 (v4): CM-5 NIST: NIST SP 800-53A (v1): CM-5.1
CCI-000339 (policy): The organization documents physical access restrictions associated with changes to the information system.
References: NIST: NIST SP 800-53 (v3): CM-5 NIST: NIST SP 800-53 Revision 4 (v4): CM-5 NIST: NIST SP 800-53A (v1): CM-5.1
CCI-000342 (policy): The organization defines logical access restrictions associated with changes to the information system.
References: NIST: NIST SP 800-53 (v3): CM-5 NIST: NIST SP 800-53 Revision 4 (v4): CM-5 NIST: NIST SP 800-53A (v1): CM-5.1
CCI-000343 (policy): The organization documents logical access restrictions associated with changes to the information system.
References: NIST: NIST SP 800-53 (v3): CM-5 NIST: NIST SP 800-53 Revision 4 (v4): CM-5 NIST: NIST SP 800-53A (v1): CM-5.1
CCI-000346 (technical): The organization employs automated mechanisms to enforce access restrictions.
References: NIST: NIST SP 800-53 (v3): CM-5 (1) NIST: NIST SP 800-53A (v1): CM-5 (1).1
CCI-000347 (technical): The organization employs automated mechanisms to support auditing of the enforcement actions.
References: NIST: NIST SP 800-53 (v3): CM-5 (1) NIST: NIST SP 800-53A (v1): CM-5 (1).1
CCI-000348 (policy): The organization defines a frequency with which to conduct reviews of information system changes.
References: NIST: NIST SP 800-53 (v3): CM-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (2) NIST: NIST SP 800-53A (v1): CM-5 (2).1 (i)
CCI-000349 (policy): The organization reviews information system changes per organization-defined frequency to determine whether unauthorized changes have occurred.
References: NIST: NIST SP 800-53 (v3): CM-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (2) NIST: NIST SP 800-53A (v1): CM-5 (2).1 (ii)
CCI-000350 (policy): The organization reviews information system changes upon organization-defined circumstances to determine whether unauthorized changes have occurred.
References: NIST: NIST SP 800-53 (v3): CM-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (2) NIST: NIST SP 800-53A (v1): CM-5 (2).1 (ii)
CCI-000351 (policy): The organization defines critical software programs that the information system will prevent from being installed if such software programs are not signed with a recognized and approved certificate.
References: NIST: NIST SP 800-53 (v3): CM-5 (3) NIST: NIST SP 800-53A (v1): CM-5 (3).1 (i)
CCI-000352 (technical): The information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization.
References: NIST: NIST SP 800-53 (v3): CM-5 (3) NIST: NIST SP 800-53A (v1): CM-5 (3).1 (ii)
CCI-000355 (policy): The organization limits information system developer/integrator privileges to change hardware components directly within a production environment.
References: NIST: NIST SP 800-53 (v3): CM-5 (5) (a) NIST: NIST SP 800-53A (v1): CM-5 (5).1 (i)
CCI-000356 (policy): The organization limits information system developer/integrator privileges to change software components directly within a production environment.
References: NIST: NIST SP 800-53 (v3): CM-5 (5) (a) NIST: NIST SP 800-53A (v1): CM-5 (5).1 (i)
CCI-000357 (policy): The organization limits information system developer/integrator privileges to change firmware components directly within a production environment.
References: NIST: NIST SP 800-53 (v3): CM-5 (5) (a) NIST: NIST SP 800-53A (v1): CM-5 (5).1 (i)
CCI-000358 (policy): The organization limits information system developer/integrator privileges to change system information directly within a production environment.
References: NIST: NIST SP 800-53 (v3): CM-5 (5) (a) NIST: NIST SP 800-53A (v1): CM-5 (5).1 (i)
CCI-000359 (policy): The organization defines the frequency to review information system developer/integrator privileges.
References: NIST: NIST SP 800-53 (v3): CM-5 (5) (b) NIST: NIST SP 800-53A (v1): CM-5 (5).1 (ii)
CCI-000360 (policy): The organization defines the frequency to reevaluate information system developer/integrator privileges.
References: NIST: NIST SP 800-53 (v3): CM-5 (5) (b) NIST: NIST SP 800-53A (v1): CM-5 (5).1 (ii)
CCI-000361 (policy): The organization reviews information system developer/integrator privileges per organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CM-5 (5) (b) NIST: NIST SP 800-53A (v1): CM-5 (5).1 (iii)
CCI-000362 (policy): The organization reevaluates information system developer/integrator privileges per organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CM-5 (5) (b) NIST: NIST SP 800-53A (v1): CM-5 (5).1 (iii)
CCI-000363 (policy): The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.
References: NIST: NIST SP 800-53 (v3): CM-6 a NIST: NIST SP 800-53 Revision 4 (v4): CM-6 a NIST: NIST SP 800-53A (v1): CM-6.1 (i)
CCI-000364 (policy): The organization establishes configuration settings for information technology products employed within the information system using organization-defined security configuration checklists.
References: NIST: NIST SP 800-53 (v3): CM-6 a NIST: NIST SP 800-53 Revision 4 (v4): CM-6 a NIST: NIST SP 800-53A (v1): CM-6.1 (iii)
CCI-000365 (policy): The organization documents configuration settings for information technology products employed within the information system using organization-defined security configuration checklists that reflect the most restrictive mode consistent with operational requirements.
References: NIST: NIST SP 800-53 (v3): CM-6 a NIST: NIST SP 800-53 Revision 4 (v4): CM-6 a NIST: NIST SP 800-53A (v1): CM-6.1 (iii)
CCI-000373 (policy): The organization defines configuration settings for which unauthorized changes are responded to by automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-6 (2) NIST: NIST SP 800-53A (v1): CM-6 (2).1 (i)
CCI-000374 (technical): The organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings.
References: NIST: NIST SP 800-53 (v3): CM-6 (2) NIST: NIST SP 800-53A (v1): CM-6 (2).1 (ii)
CCI-000375 (policy): The organization incorporates detection of unauthorized, security-relevant configuration changes into the organizations incident response capability.
References: NIST: NIST SP 800-53 (v3): CM-6 (3) NIST: NIST SP 800-53A (v1): CM-6 (3).1 (i)
CCI-000376 (policy): The organization ensures unauthorized, security-relevant configuration changes detected are monitored.
References: NIST: NIST SP 800-53 (v3): CM-6 (3) NIST: NIST SP 800-53A (v1): CM-6 (3).1 (ii)
CCI-000377 (policy): The organization ensures unauthorized, security-relevant configuration changes detected are corrected.
References: NIST: NIST SP 800-53 (v3): CM-6 (3) NIST: NIST SP 800-53A (v1): CM-6 (3).1 (ii)
CCI-000378 (policy): The organization ensures unauthorized, security-relevant configuration changes detected are available for historical purposes.
References: NIST: NIST SP 800-53 (v3): CM-6 (3) NIST: NIST SP 800-53A (v1): CM-6 (3).1 (ii)
CCI-000379 (policy): The information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance (i.e., security checklists) prior to being introduced into a production environment.
References: NIST: NIST SP 800-53 (v3): CM-6 (4) NIST: NIST SP 800-53A (v1): CM-6 (4).1
CCI-000383 (policy): The organization defines the frequency of information system reviews to identify and eliminate unnecessary functions, ports, protocols and/or services.
References: NIST: NIST SP 800-53 (v3): CM-7 (1) NIST: NIST SP 800-53A (v1): CM-7 (1).1 (i)
CCI-000385 (policy): The organization reviews the information system per organization-defined frequency to eliminate unnecessary functions, ports, protocols, and/or services.
References: NIST: NIST SP 800-53 (v3): CM-7 (1) NIST: NIST SP 800-53A (v1): CM-7 (1).1 (ii)
CCI-000386 (technical): The organization employs automated mechanisms to prevent program execution on the information system in accordance with the organization-defined specifications.
References: NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (ii)
CCI-000389 (policy): The organization develops an inventory of information system components that accurately reflects the current information system.
References: NIST: NIST SP 800-53 (v3): CM-8 a NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 1 NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000390 (policy): The organization documents an inventory of information system components that accurately reflects the current information system.
References: NIST: NIST SP 800-53 (v3): CM-8 a NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 1 NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000391 (policy): The organization maintains an inventory of information system components that accurately reflects the current information system.
References: NIST: NIST SP 800-53 (v3): CM-8 a NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000392 (policy): The organization develops an inventory of information system components that includes all components within the authorization boundary of the information system.
References: NIST: NIST SP 800-53 (v3): CM-8 b NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 2 NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000393 (policy): The organization documents an inventory of information system components that includes all components within the authorization boundary of the information system.
References: NIST: NIST SP 800-53 (v3): CM-8 b NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 2 NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000394 (policy): The organization maintains an inventory of information system components that is consistent with the authorization boundary of the information system.
References: NIST: NIST SP 800-53 (v3): CM-8 b NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000395 (policy): The organization develops an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.
References: NIST: NIST SP 800-53 (v3): CM-8 c NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 3 NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000396 (policy): The organization documents an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.
References: NIST: NIST SP 800-53 (v3): CM-8 c NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 3 NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000397 (policy): The organization maintains an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.
References: NIST: NIST SP 800-53 (v3): CM-8 c NIST: NIST SP 800-53A (v1): CM-8.1 (i)
CCI-000399 (policy): The organization develops an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.
References: NIST: NIST SP 800-53 (v3): CM-8 d NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 4 NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000400 (policy): The organization documents an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.
References: NIST: NIST SP 800-53 (v3): CM-8 d NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 4 NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000401 (policy): The organization maintains an inventory of information system components that includes organization-defined information deemed necessary to achieve effective property accountability.
References: NIST: NIST SP 800-53 (v3): CM-8 d NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000402 (policy): The organization develops an inventory of information system components that is available for review by designated organizational officials.
References: NIST: NIST SP 800-53 (v3): CM-8 e NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000403 (policy): The organization documents an inventory of information system components that is available for review by designated organizational officials.
References: NIST: NIST SP 800-53 (v3): CM-8 e NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000404 (policy): The organization maintains an inventory of information system components that is available for review by designated organizational officials.
References: NIST: NIST SP 800-53 (v3): CM-8 e NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000405 (policy): The organization develops an inventory of information system components that is available for audit by designated organizational officials.
References: NIST: NIST SP 800-53 (v3): CM-8 e NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000406 (policy): The organization documents an inventory of information system components that is available for audit by designated organizational officials.
References: NIST: NIST SP 800-53 (v3): CM-8 e NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000407 (policy): The organization maintains an inventory of information system components that is available for audit by designated organizational officials.
References: NIST: NIST SP 800-53 (v3): CM-8 e NIST: NIST SP 800-53A (v1): CM-8.1 (ii)
CCI-000417 (technical): The organization disables network access by unauthorized components/devices or notifies designated organizational officials.
References: NIST: NIST SP 800-53 (v3): CM-8 (3) (b) NIST: NIST SP 800-53A (v1): CM-8 (3).1 (iii)
CCI-000419 (policy): The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories.
References: NIST: NIST SP 800-53 (v3): CM-8 (5) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (5) NIST: NIST SP 800-53A (v1): CM-8 (5).1
CCI-000421 (policy): The organization develops a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.
References: NIST: NIST SP 800-53 (v3): CM-9 a NIST: NIST SP 800-53 Revision 4 (v4): CM-9 a NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000422 (policy): The organization documents a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.
References: NIST: NIST SP 800-53 (v3): CM-9 a NIST: NIST SP 800-53 Revision 4 (v4): CM-9 a NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000424 (policy): The organization develops a configuration management plan for the information system that defines the configuration items for the information system.
References: NIST: NIST SP 800-53 (v3): CM-9 b NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000425 (policy): The organization documents a configuration management plan for the information system that defines the configuration items for the information system.
References: NIST: NIST SP 800-53 (v3): CM-9 b NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000427 (policy): The organization develops a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.
References: NIST: NIST SP 800-53 (v3): CM-9 b NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000428 (policy): The organization documents a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.
References: NIST: NIST SP 800-53 (v3): CM-9 b NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000429 (policy): The organization implements a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.
References: NIST: NIST SP 800-53 (v3): CM-9 b NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000430 (policy): The organization develops a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.
References: NIST: NIST SP 800-53 (v3): CM-9 c NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000431 (policy): The organization documents a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.
References: NIST: NIST SP 800-53 (v3): CM-9 c NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000432 (policy): The organization implements a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.
References: NIST: NIST SP 800-53 (v3): CM-9 c NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000433 (policy): The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
References: NIST: NIST SP 800-53 (v3): CM-9 c NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000434 (policy): The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
References: NIST: NIST SP 800-53 (v3): CM-9 c NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000435 (policy): The organization implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
References: NIST: NIST SP 800-53 (v3): CM-9 c NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-000450 (policy): The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system disruption.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000451 (policy): The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system disruption.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 NIST: NIST SP 800-53A (v1): CP-2.1 I)
CCI-000452 (policy): The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system compromise.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000453 (policy): The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system compromise.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000454 (policy): The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system failure.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000455 (policy): The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system failure.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000477 (policy): The organization defines the time period for planning the resumption of all missions as a result of contingency plan activation.
References: NIST: NIST SP 800-53 (v3): CP-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (4) NIST: NIST SP 800-53A (v1): CP-2 (4).1 (i)
CCI-000478 (policy): The organization defines the time period for planning the resumption of all business functions as a result of contingency plan activation.
References: NIST: NIST SP 800-53 (v3): CP-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (4) NIST: NIST SP 800-53A (v1): CP-2 (4).1 (i)
CCI-000479 (policy): The organization plans for the resumption of all missions within an organization-defined time period of contingency plan activation.
References: NIST: NIST SP 800-53 (v3): CP-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (4) NIST: NIST SP 800-53A (v1): CP-2 (4).1 (ii)
CCI-000480 (policy): The organization plans for the resumption of all business functions within an organization-defined time period of contingency plan activation.
References: NIST: NIST SP 800-53 (v3): CP-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (4) NIST: NIST SP 800-53A (v1): CP-2 (4).1 (ii)
CCI-000491 (policy): The organization defines the frequency to exercise the contingency plan for the information system.
References: NIST: NIST SP 800-53 (v3): CP-4 NIST: NIST SP 800-53A (v1): CP-4.1 (ii)
CCI-000493 (policy): The organization defines contingency plan exercises to be conducted for the information system.
References: NIST: NIST SP 800-53 (v3): CP-4 NIST: NIST SP 800-53A (v1): CP-4.1 (i)
CCI-000495 (policy): The organization exercises the contingency plan using organization-defined exercises in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CP-4 a NIST: NIST SP 800-53A (v1): CP-4.1 (iii)
CCI-000499 (policy): The organization coordinates contingency plan exercises with organizational elements responsible for related plans.
References: NIST: NIST SP 800-53 (v3): CP-4 (1) NIST: NIST SP 800-53A (v1): CP-4 (1).1
CCI-000501 (policy): The organization exercises the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources and to evaluate the site's capabilities to support contingency operations.
References: NIST: NIST SP 800-53 (v3): CP-4 (2) NIST: NIST SP 800-53A (v1): CP-4 (2).1
CCI-000503 (policy): The organization employs automated mechanisms to more thoroughly and effectively exercise the contingency plan by providing more complete coverage of contingency issues, selecting more realistic exercise scenarios and environments, and more effectively stressing the information and supported missions.
References: NIST: NIST SP 800-53 (v3): CP-4 (3) NIST: NIST SP 800-53A (v1): CP-4 (3).1
CCI-000506 (policy): The organization initiates necessary alternate storage site agreements to permit the storage and recovery of information system backup information.
References: NIST: NIST SP 800-53 (v3): CP-6 NIST: NIST SP 800-53A (v1): CP-6.1 (ii)
CCI-000511 (policy): The organization defines the time period for achieving the recovery time objectives for business functions within which processing must be resumed at the alternate processing site.
References: NIST: NIST SP 800-53 (v3): CP-7 NIST: NIST SP 800-53A (v1): CP-7.1 (ii)
CCI-000512 (policy): The organization establishes an alternate processing site.
References: NIST: NIST SP 800-53 (v3): CP-7 a NIST: NIST SP 800-53A (v1): CP-7.1 (i)
CCI-000528 (policy): The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary telecommunications services are provided by a common carrier.
References: NIST: NIST SP 800-53 (v3): CP-8 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (1) (b) NIST: NIST SP 800-53A (v1): CP-8 (1).1 (ii)
CCI-000529 (policy): The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the alternate telecommunications services are provided by a common carrier.
References: NIST: NIST SP 800-53 (v3): CP-8 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (1) (b) NIST: NIST SP 800-53A (v1): CP-8 (1).1 (ii)
CCI-000540 (policy): The organization protects the confidentiality, integrity, and availability of backup information at storage locations.
References: NIST: NIST SP 800-53 (v3): CP-9 (d) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (d) NIST: NIST SP 800-53A (v1): CP-9.2
CCI-000544 (policy): The organization stores backup copies of the operating system in a separate facility or in a fire-rated container that is not colocated with the operational system.
References: NIST: NIST SP 800-53 (v3): CP-9 (3) NIST: NIST SP 800-53A (v1): CP-9 (3).1
CCI-000545 (policy): The organization stores backup copies of critical information system software in a separate facility or in a fire-rated container that is not colocated with the operational system.
References: NIST: NIST SP 800-53 (v3): CP-9 (3) NIST: NIST SP 800-53A (v1): CP-9 (3).1
CCI-000546 (policy): The organization stores backup copies of the information system inventory (including hardware, software, and firmware components) in a separate facility or in a fire-rated container that is not colocated with the operational system.
References: NIST: NIST SP 800-53 (v3): CP-9 (3) NIST: NIST SP 800-53A (v1): CP-9 (3).1
CCI-000550 (policy): The organization provides for the recovery and reconstitution of the information system to a known state after a disruption.
References: NIST: NIST SP 800-53 (v3): CP-10 NIST: NIST SP 800-53 Revision 4 (v4): CP-10 NIST: NIST SP 800-53A (v1): CP-10.1
CCI-000551 (policy): The organization provides for the recovery and reconstitution of the information system to a known state after a compromise.
References: NIST: NIST SP 800-53 (v3): CP-10 NIST: NIST SP 800-53 Revision 4 (v4): CP-10 NIST: NIST SP 800-53A (v1): CP-10.1
CCI-000552 (policy): The organization provides for the recovery and reconstitution of the information system to a known state after a failure.
References: NIST: NIST SP 800-53 (v3): CP-10 NIST: NIST SP 800-53 Revision 4 (v4): CP-10 NIST: NIST SP 800-53A (v1): CP-10.1
CCI-000554 (policy): The organization defines in the security plan, explicitly or by reference, the circumstances that can inhibit recovery and reconstitution of the information system to a known state.
References: NIST: NIST SP 800-53 (v3): CP-10 (3) NIST: NIST SP 800-53A (v1): CP-10 (3).1 (i)
CCI-000555 (policy): The organization provides compensating security controls for organization-defined circumstances that can inhibit recovery and reconstitution of the information system to a known state.
References: NIST: NIST SP 800-53 (v3): CP-10 (3) NIST: NIST SP 800-53A (v1): CP-10 (3).1 (ii)
CCI-000560 (policy): The organization protects backup and restoration hardware.
References: NIST: NIST SP 800-53 (v3): CP-10 (6) NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (6) NIST: NIST SP 800-53A (v1): CP-10 (6).1
CCI-000561 (policy): The organization protects backup and restoration firmware.
References: NIST: NIST SP 800-53 (v3): CP-10 (6) NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (6) NIST: NIST SP 800-53A (v1): CP-10 (6).1
CCI-000562 (policy): The organization protects backup and restoration software.
References: NIST: NIST SP 800-53 (v3): CP-10 (6) NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (6) NIST: NIST SP 800-53A (v1): CP-10 (6).1
CCI-000565 (policy): The organization reviews/updates, per organization-defined frequency, a formal, documented security planning policy.
References: NIST: NIST SP 800-53 (v3): PL-1 a NIST: NIST SP 800-53A (v1): PL-1.2 (ii)
CCI-000570 (policy): The organization develops a security plan for the information system that is consistent with the organization's enterprise architecture; explicitly defines the authorization boundary for the system; describes the operational context of the information system in terms of mission and business processes; provides the security category and impact level of the information system, including supporting rationale; describes the operational environment for the information system; describes relationships with, or connections to, other information systems; provides an overview of the security requirements for the system; and describes the security controls in place or planned for meeting those requirements, including a rationale for the tailoring and supplemental decisions.
References: NIST: NIST SP 800-53 (v3): PL-2 a NIST: NIST SP 800-53A (v1): PL-2.1 (i)
CCI-000576 (policy): The organization develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum: the purpose of the system; a description of the system architecture; the security authorization schedule; and the security categorization and associated factors considered in determining the categorization.
References: NIST: NIST SP 800-53 (v3): PL-2 (1) (a) NIST: NIST SP 800-53A (v1): PL-2 (1).1 (i) (ii) (iii) (iv) (v)
CCI-000580 (policy): The organization develops a functional architecture for the information system that identifies and maintains external interfaces.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (a) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000581 (policy): The organization develops a functional architecture for the information system that identifies and maintains the information being exchanged across the interfaces.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (a) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000582 (policy): The organization develops a functional architecture for the information system that identifies and maintains the protection mechanisms associated with each interface.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (a) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000583 (policy): The organization develops a functional architecture for the information system that identifies and maintains user roles.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (b) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000584 (policy): The organization develops a functional architecture for the information system that identifies and maintains the access privileges assigned to each role.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (b) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000585 (policy): The organization develops a functional architecture for the information system that identifies and maintains unique security requirements.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (c) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000586 (policy): The organization develops a functional architecture for the information system that identifies and maintains types of information processed by the information system.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (d) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000587 (policy): The organization develops a functional architecture for the information system that identifies and maintains types of information stored by the information system.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (d) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000588 (policy): The organization develops a functional architecture for the information system that identifies and maintains types of information transmitted by the information system.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (d) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000589 (policy): The organization develops a functional architecture for the information system that identifies and maintains any specific protection needs in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (d) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000590 (policy): The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (e) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000591 (policy): The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information system services.
References: NIST: NIST SP 800-53 (v3): PL-2 (2) (e) NIST: NIST SP 800-53A (v1): PL-2 (2).1
CCI-000596 (policy): The organization includes in the rules of behavior, explicit restrictions on sharing information system account information.
References: NIST: NIST SP 800-53 (v3): PL-4 (1) NIST: NIST SP 800-53A (v1): PL-4 (1).1
CCI-000597 (policy): The organization conducts a privacy impact assessment on the information system in accordance with OMB policy.
References: NIST: NIST SP 800-53 (v3): PL-5 NIST: NIST SP 800-53A (v1): PL-5.1 (i) (ii)
CCI-000598 (policy): The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational operations (i.e., mission, functions, image, and reputation).
References: NIST: NIST SP 800-53 (v3): PL-6 NIST: NIST SP 800-53A (v1): PL-6.1
CCI-000599 (policy): The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational assets.
References: NIST: NIST SP 800-53 (v3): PL-6 NIST: NIST SP 800-53A (v1): PL-6.1
CCI-000600 (policy): The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational individuals.
References: NIST: NIST SP 800-53 (v3): PL-6 NIST: NIST SP 800-53A (v1): PL-6.1
CCI-000608 (policy): The organization includes a determination of information security requirements for the information system in mission process planning.
References: NIST: NIST SP 800-53 (v3): SA-2 a NIST: NIST SP 800-53A (v1): SA-2.1 (i)
CCI-000609 (policy): The organization includes a determination of information security requirements for the information system in business process planning.
References: NIST: NIST SP 800-53 (v3): SA-2 a NIST: NIST SP 800-53A (v1): SA-2.1 (i)
CCI-000617 (policy): The organization documents information system security roles and responsibilities throughout the system development life cycle.
References: NIST: NIST SP 800-53 (v3): SA-3 b NIST: NIST SP 800-53A (v1): SA-3.1 (ii)
CCI-000619 (policy): The organization includes security functional requirements/specifications, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
References: NIST: NIST SP 800-53 (v3): SA-4 a NIST: NIST SP 800-53A (v1): SA-4.1
CCI-000620 (policy): The organization includes security-related documentation requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
References: NIST: NIST SP 800-53 (v3): SA-4 b NIST: NIST SP 800-53A (v1): SA-4.1
CCI-000621 (policy): The organization includes developmental and evaluation-related assurance requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
References: NIST: NIST SP 800-53 (v3): SA-4 c NIST: NIST SP 800-53A (v1): SA-4.1
CCI-000624 (policy): The organization requires in acquisition documents that vendors/contractors provide information describing the design details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.
References: NIST: NIST SP 800-53 (v3): SA-4 (2) NIST: NIST SP 800-53A (v1): SA-4 (2).1
CCI-000625 (policy): The organization requires in acquisition documents that vendors/contractors provide information describing the implementation details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.
References: NIST: NIST SP 800-53 (v3): SA-4 (2) NIST: NIST SP 800-53A (v1): SA-4 (2).1
CCI-000626 (policy): The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs state-of-the-practice software and security engineering methods.
References: NIST: NIST SP 800-53 (v3): SA-4 (3) NIST: NIST SP 800-53A (v1): SA-4 (3).1
CCI-000627 (policy): The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs quality control processes.
References: NIST: NIST SP 800-53 (v3): SA-4 (3) NIST: NIST SP 800-53A (v1): SA-4 (3).1
CCI-000628 (policy): The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development processes employ validation techniques.
References: NIST: NIST SP 800-53 (v3): SA-4 (3) NIST: NIST SP 800-53A (v1): SA-4 (3).1
CCI-000629 (policy): The organization ensures each information system component acquired is explicitly assigned to an information system, and that the owner of the system acknowledges this assignment.
References: NIST: NIST SP 800-53 (v3): SA-4 (4) NIST: NIST SP 800-53A (v1): SA-4 (4).1 (i) (ii)
CCI-000630 (policy): The organization requires in acquisition documents, that information system components are delivered in a secure, documented configuration, and that the secure configuration is the default configuration for any software reinstalls or upgrades.
References: NIST: NIST SP 800-53 (v3): SA-4 (5) NIST: NIST SP 800-53A (v1): SA-4 (5).1 (i) (ii)
CCI-000632 (policy): The organization employs only commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.
References: NIST: NIST SP 800-53 (v3): SA-4 (6) (a) NIST: NIST SP 800-53A (v1): SA-4 (6).1 (i)
CCI-000636 (policy): The organization obtains administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.
References: NIST: NIST SP 800-53 (v3): SA-5 a NIST: NIST SP 800-53A (v1): SA-5.1 (i)
CCI-000637 (policy): The organization protects, as required, administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.
References: NIST: NIST SP 800-53 (v3): SA-5 a NIST: NIST SP 800-53A (v1): SA-5.1 (i)
CCI-000638 (policy): The organization makes available to authorized personnel administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.
References: NIST: NIST SP 800-53 (v3): SA-5 a NIST: NIST SP 800-53A (v1): SA-5.1 (i)
CCI-000639 (policy): The organization obtains user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.
References: NIST: NIST SP 800-53 (v3): SA-5 b NIST: NIST SP 800-53A (v1): SA-5.1 (ii)
CCI-000640 (policy): The organization protects, as required, user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.
References: NIST: NIST SP 800-53 (v3): SA-5 b NIST: NIST SP 800-53A (v1): SA-5.1 (ii)
CCI-000641 (policy): The organization makes available to authorized personnel user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.
References: NIST: NIST SP 800-53 (v3): SA-5 b NIST: NIST SP 800-53A (v1): SA-5.1 (ii)
CCI-000643 (policy): The organization obtains vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (1) NIST: NIST SP 800-53A (v1): SA-5 (1).1 (i) SA-5(2).1 (i)
CCI-000644 (policy): The organization protects, as required, vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system.
References: NIST: NIST SP 800-53 (v3): SA-5 (1) NIST: NIST SP 800-53A (v1): SA-5 (1).1 (i) SA-5(2).1 (i)
CCI-000645 (policy): The organization makes available to authorized personnel vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (2) NIST: NIST SP 800-53A (v1): SA-5 (1).1 SA-5(2).1 SA-5(3).1 SA-5(4).1 (i)s
CCI-000646 (policy): The organization obtains vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (2) NIST: NIST SP 800-53A (v1): SA-5 (1).1 SA-5(2).1 SA-5(3).1 SA-5(4) (ii)s
CCI-000647 (policy): The organization obtains vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (3) NIST: NIST SP 800-53A (v1): SA-5 (3).1 (ii)
CCI-000648 (policy): The organization protects, as required, vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system.
References: NIST: NIST SP 800-53 (v3): SA-5 (3) NIST: NIST SP 800-53A (v1): SA-5 (3).1 (ii)
CCI-000650 (policy): The organization obtains vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (4) NIST: NIST SP 800-53A (v1): SA-5 (4).1 (ii)
CCI-000651 (policy): The organization protects, as required, vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system.
References: NIST: NIST SP 800-53 (v3): SA-5 (4) NIST: NIST SP 800-53A (v1): SA-5 (4).1 (ii)
CCI-000653 (policy): The organization obtains the source code for the information system to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (5) NIST: NIST SP 800-53A (v1): SA-5 (5).1
CCI-000654 (policy): The organization protects, as required, the source code for the information system to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (5) NIST: NIST SP 800-53A (v1): SA-5 (5).1
CCI-000655 (policy): The organization uses software and associated documentation in accordance with contract agreements and copyright laws.
References: NIST: NIST SP 800-53 (v3): SA-6 a NIST: NIST SP 800-53A (v1): SA-6.1 (i)
CCI-000656 (policy): The organization employs tracking systems for software and associated documentation protected by quantity licenses to control copying and distribution.
References: NIST: NIST SP 800-53 (v3): SA-6 b NIST: NIST SP 800-53A (v1): SA-6.1 (ii)
CCI-000657 (policy): The organization controls the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
References: NIST: NIST SP 800-53 (v3): SA-6 c NIST: NIST SP 800-53A (v1): SA-6.1 (iii)
CCI-000658 (policy): The organization documents the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
References: NIST: NIST SP 800-53 (v3): SA-6 c NIST: NIST SP 800-53A (v1): SA-6.1 (iii)
CCI-000659 (policy): The organization prohibits the use of binary executable code from sources with limited or no warranty without accompanying source code.
References: NIST: NIST SP 800-53 (v3): SA-6 (1) (a) NIST: NIST SP 800-53A (v1): SA-6 (1).1 (i)
CCI-000660 (policy): The organization prohibits the use of machine executable code from sources with limited or no warranty without accompanying source code.
References: NIST: NIST SP 800-53 (v3): SA-6 (1) (a) NIST: NIST SP 800-53A (v1): SA-6 (1).1 (i)