Lexim011/Compliance huggingface dataset:
CCI-000172 (technical): Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
References: NIST: NIST SP 800-53 (v3): AU-12 c NIST: NIST SP 800-53 Revision 4 (v4): AU-12 c NIST: NIST SP 800-53 Revision 5 (v5): AU-12 c NIST: NIST SP 800-53A (v1): AU-12.1 (iv)
CCI-000173 (policy): Defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.
References: NIST: NIST SP 800-53 (v3): AU-12 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (1) NIST: NIST SP 800-53A (v1): AU-12 (1).1 (iv)
CCI-000174 (technical): Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.
References: NIST: NIST SP 800-53 (v3): AU-12 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (1) NIST: NIST SP 800-53A (v1): AU-12 (1).1 (iii and v)
CCI-001577 (policy): Defines the information system components from which audit records are to be compiled into the system-wide audit trail.
References: NIST: NIST SP 800-53 (v3): AU-12 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (1) NIST: NIST SP 800-53A (v1): AU-12 (1).1 (ii)
CCI-001353 (technical): Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
References: NIST: NIST SP 800-53 (v3): AU-12 (2) NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (2) NIST: NIST SP 800-53A (v1): AU-12 (2).1
CCI-001911 (policy): Defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined system components, by organization-defined individuals or roles, within organization-defined time thresholds.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3)
CCI-001912 (policy): Defines the time thresholds for organization-defined individuals or roles to change the auditing to be performed based on organization-defined selectable event criteria.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3)
CCI-001913 (policy): Defines the individuals or roles that are to be provided the capability to change the auditing to be performed based on organization-defined selectable event criteria, within organization-defined time thresholds.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3)
CCI-001914 (technical): Provide the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3)
CCI-002047 (policy): Defines the system components on which the auditing that is to be performed can be changed by organization-defined individuals or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3)
CCI-003834 (technical): Implement the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3)
CCI-003835 (technical): Provide the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (4)
CCI-003836 (technical): Implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (4)
CCI-001460 (policy): Monitor organization-defined open source information and/or information sites per organization-defined frequency for evidence of unauthorized disclosure of organizational information.
References: NIST: NIST SP 800-53 (v3): AU-13 NIST: NIST SP 800-53 Revision 4 (v4): AU-13 NIST: NIST SP 800-53 Revision 5 (v5): AU-13 a NIST: NIST SP 800-53A (v1): AU-13.1 (ii)
CCI-001461 (policy): Defines a frequency for monitoring open source information and/or information sites for evidence of unauthorized exfiltration or disclosure of organizational information.
References: NIST: NIST SP 800-53 (v3): AU-13 NIST: NIST SP 800-53 Revision 4 (v4): AU-13 NIST: NIST SP 800-53 Revision 5 (v5): AU-13 a NIST: NIST SP 800-53A (v1): AU-13.1 (i)
CCI-001915 (policy): Defines the open source information and/or information sites to be monitored for evidence of unauthorized exfiltration or disclosure of organizational information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-13 NIST: NIST SP 800-53 Revision 5 (v5): AU-13 a
CCI-003837 (policy): If an information disclosure is discovered, notify organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-13 b 1
CCI-003838 (policy): Defines the personnel or roles to be notified if an information disclosure is discovered.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-13 b 1
CCI-003839 (policy): If an information disclosure is discovered, take organization-defined additional actions.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-13 b 2
CCI-003840 (policy): Defines the additional actions to be taken if an information disclosure is discovered.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-13 b 2
CCI-003841 (policy, technical): Monitor open-source information and information sites using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (1)
CCI-003842 (policy, technical): Defines the automated mechanisms for monitoring open-source information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (1)
CCI-001917 (policy): Defines the frequency for reviewing the open source information sites being monitored.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-13 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (2)
CCI-001918 (policy): Review the open source information sites being monitored per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-13 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (2)
CCI-003843 (policy, technical): Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (3)
CCI-001919 (technical): Provide the capability for organization-defined users or roles to select a user session to record; view; hear; or log the content of a user session under organization-defined circumstances.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-14 NIST: NIST SP 800-53 Revision 5 (v5): AU-14 a
CCI-003844 (technical): Implement the capability for organization-defined users or roles to select a user session to record; view; hear; and/or log the content of a user session under organization-defined circumstances.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-14 a
CCI-003845 (technical): Defines users or roles who will provide and implement the capability to record; view; hear; and/or log the content of a user session under organization-defined circumstances.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-14 a
CCI-003846 (technical): Defines the circumstances to record; view; hear; and/or log the content of a user session.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-14 a
CCI-003847 (technical): Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-14 b
CCI-001464 (technical): Initiates session audits automatically at system start-up.
References: NIST: NIST SP 800-53 (v3): AU-14 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-14 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-14 (1) NIST: NIST SP 800-53A (v1): AU-14 (1).1
CCI-001920 (technical): Provide the capability for authorized users to remotely view and hear content related to an established user session in real time.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-14 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-14 (3)
CCI-003848 (technical): Implement the capability for authorized users to remotely view and hear content related to an established user session in real time.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-14 (3)
CCI-001923 (policy): Defines the audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-16 NIST: NIST SP 800-53 Revision 5 (v5): AU-16
CCI-001924 (policy): Defines the methods to be employed when coordinating audit information among external organizations when audit information is transmitted across organizational boundaries.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-16 NIST: NIST SP 800-53 Revision 5 (v5): AU-16
CCI-001925 (policy): Employ organization-defined methods for coordinating organization-defined audit information among external organizations when audit information is transmitted across organizational boundaries.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-16 NIST: NIST SP 800-53 Revision 5 (v5): AU-16
CCI-001926 (policy): Preserve the identity of individuals in cross-organizational audit trails.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-16 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (1)
CCI-001927 (policy): Defines the organizations that will be provided cross-organizational audit information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-16 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (2)
CCI-001928 (policy): Defines the cross-organizational sharing agreements to be established with organization-defined organizations authorized to be provided cross-organizational sharing of audit information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-16 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (2)
CCI-001929 (policy): Provide cross-organizational audit information to organization-defined organizations based on organization-defined cross organizational sharing agreements.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-16 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (2)
CCI-005149 (policy): Implement organization-defined measures to disassociate individuals from audit information transmitted across organizational boundaries.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (3)
CCI-000239 (policy): Develop and document an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): CA-1 a NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 1 (a) NIST: NIST SP 800-53A (v1): CA-1.1 (i and ii)
CCI-000240 (policy): Disseminates to organization-defined personnel or roles an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy.
References: NIST: NIST SP 800-53 (v3): CA-1 a NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 1 (a) NIST: NIST SP 800-53A (v1): CA-1.1 (iii)
CCI-000242 (policy): Develop and document procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.
References: NIST: NIST SP 800-53 (v3): CA-1 b NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 2 NIST: NIST SP 800-53A (v1): CA-1.1 (iv and v)
CCI-000243 (policy): Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.
References: NIST: NIST SP 800-53 (v3): CA-1 b NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 2 NIST: NIST SP 800-53A (v1): CA-1.1 (vi)
CCI-002061 (policy): Defines the personnel or roles to whom the organization-level; mission/business process; system-level assessment, authorization, and monitoring policy is to be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 1 (a)
CCI-002062 (policy): Defines the personnel or roles to whom the assessment, authorization, monitoring procedures are to be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 2
CCI-003849 (policy): Disseminate an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 1 (b)
CCI-003850 (policy): Defines the personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 2
CCI-003851 (policy): Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 b
CCI-003852 (policy): Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 b
CCI-003853 (policy): Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 b
CCI-003854 (policy): Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 b
CCI-000238 (policy): Defines the frequency to review and update the current assessment, authorization, and monitoring policy.
References: NIST: NIST SP 800-53 (v3): CA-1 NIST: NIST SP 800-53 Revision 4 (v4): CA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 1 NIST: NIST SP 800-53A (v1): CA-1.2 (i)
CCI-000241 (policy): Review and update the current assessment, authorization, and monitoring policy on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CA-1 a NIST: NIST SP 800-53 Revision 4 (v4): CA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 1 NIST: NIST SP 800-53A (v1): CA-1.2 (ii)
CCI-000244 (policy): Review and update the current assessment, authorization, and monitoring procedures on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CA-1 b NIST: NIST SP 800-53 Revision 4 (v4): CA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 2 NIST: NIST SP 800-53A (v1): CA-1.2 (iv)
CCI-001578 (policy): Defines the frequency to review and update the current assessment, authorization, and monitoring procedures.
References: NIST: NIST SP 800-53 (v3): CA-1 b NIST: NIST SP 800-53 Revision 4 (v4): CA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 2 NIST: NIST SP 800-53A (v1): CA-1.2 (iii)
CCI-003855 (policy): Review and update the current assessment, authorization, and monitoring policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 1
CCI-003856 (policy): Defines the events following reviewing and updating the current assessment, authorization, and monitoring policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 1
CCI-003857 (policy): Review and update the current assessment and authorization procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 2
CCI-003858 (policy): Defines the events following reviewing and updating the current assessment, authorization, and monitoring procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 2
CCI-003859 (policy): Select the appropriate assessor or assessment team for the type of assessment to be conducted.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-2 a
CCI-000246 (policy): Develop a control assessment plan that describes the scope of the assessment including controls and control enhancements under assessment.
References: NIST: NIST SP 800-53 (v3): CA-2 a NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CA-2 b 1 NIST: NIST SP 800-53A (v1): CA-2.1 (ii)
CCI-000247 (policy): Develop a control assessment plan that describes the scope of the assessment including assessment procedures to be used to determine control effectiveness.
References: NIST: NIST SP 800-53 (v3): CA-2 a NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CA-2 b 2 NIST: NIST SP 800-53A (v1): CA-2.1 (ii)
CCI-000248 (policy): Develop a control assessment plan that describes the scope of the assessment including assessment environment.
References: NIST: NIST SP 800-53 (v3): CA-2 a NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a 3 NIST: NIST SP 800-53 Revision 5 (v5): CA-2 b 3 NIST: NIST SP 800-53A (v1): CA-2.1 (ii)
CCI-002070 (policy): Develop a control assessment plan that describes the scope of the assessment including assessment team, and assessment roles and responsibilities.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a 3 NIST: NIST SP 800-53 Revision 5 (v5): CA-2 b 3
CCI-003860 (policy): Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-2 c
CCI-000251 (policy): Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements.
References: NIST: NIST SP 800-53 (v3): CA-2 b NIST: NIST SP 800-53 Revision 4 (v4): CA-2 b NIST: NIST SP 800-53 Revision 5 (v5): CA-2 d NIST: NIST SP 800-53A (v1): CA-2.2 (ii)
CCI-000252 (policy): Defines the frequency on which the security controls in the system and its environment of operation are assessed.
References: NIST: NIST SP 800-53 (v3): CA-2 b NIST: NIST SP 800-53 Revision 4 (v4): CA-2 b NIST: NIST SP 800-53 Revision 5 (v5): CA-2 d NIST: NIST SP 800-53A (v1): CA-2.2 (i)
CCI-003861 (policy): Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-2 d
CCI-000253 (policy): Produce a control assessment report that document the results of the assessment.
References: NIST: NIST SP 800-53 (v3): CA-2 c NIST: NIST SP 800-53 Revision 4 (v4): CA-2 c NIST: NIST SP 800-53 Revision 5 (v5): CA-2 e NIST: NIST SP 800-53A (v1): CA-2.2 (iii)
CCI-000254 (policy): Provide the results of the control assessment to organization-defined individuals or roles.
References: NIST: NIST SP 800-53 (v3): CA-2 d NIST: NIST SP 800-53 Revision 4 (v4): CA-2 d NIST: NIST SP 800-53 Revision 5 (v5): CA-2 f NIST: NIST SP 800-53A (v1): CA-2.2 (iv)
CCI-002071 (policy): Defines the individuals or roles to whom the results of the control assessment are to be provided.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-2 d NIST: NIST SP 800-53 Revision 5 (v5): CA-2 f
CCI-000255 (policy): Employ independent assessors or assessment teams to conduct control assessments.
References: NIST: NIST SP 800-53 (v3): CA-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (1) NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (1) NIST: NIST SP 800-53A (v1): CA-2 (1).1
CCI-000256 (policy): Include as part of the control assessments, announced or unannounced, on an organization-defined frequency, in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; and/or organization-defined other forms of assessment.
References: NIST: NIST SP 800-53 (v3): CA-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (2) NIST: NIST SP 800-53A (v1): CA-2 (2).1 (i)
CCI-001582 (policy): Defines other forms of control assessments other than in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment that should be included as part of the control assessments.
References: NIST: NIST SP 800-53 (v3): CA-7 (2) NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (2) NIST: NIST SP 800-53A (v1): CA-7 (2).1 (i)
CCI-002065 (policy): Defines the frequency at which to conduct control assessments.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (2)
CCI-002066 (policy): Leverage the results of control assessments of the organization-defined system performed by an organization-defined external organization when the assessment meets organization-defined requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (3)
CCI-002067 (policy): Defines the system for which the results of control assessments will be leveraged.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (3)
CCI-002068 (policy): Defines the external organizations from which control assessment results for organization-defined systems will be accepted.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (3)
CCI-002069 (policy): Defines the requirements the control assessments for organization-defined systems from organization-defined external organizations must meet.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (3)
CCI-003862 (policy): Approve and manage the exchange of information between the system and other systems using interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreement; and/or nondisclosure agreements with an organization-defined type of agreement.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-3 a
CCI-000258 (policy): Document, as part of each exchange agreement, the interface characteristics.
References: NIST: NIST SP 800-53 (v3): CA-3 b NIST: NIST SP 800-53 Revision 4 (v4): CA-3 b NIST: NIST SP 800-53 Revision 5 (v5): CA-3 b NIST: NIST SP 800-53A (v1): CA-3.1 (iii)
CCI-000259 (policy): Document, as part of each exchange agreement,, the security requirements, controls and responsibilities for each system, and the impact level of the information communicated.
References: NIST: NIST SP 800-53 (v3): CA-3 b NIST: NIST SP 800-53 Revision 4 (v4): CA-3 b NIST: NIST SP 800-53 Revision 5 (v5): CA-3 b NIST: NIST SP 800-53A (v1): CA-3.1 (iii)
CCI-003863 (policy): Document, as part of each exchange agreement, the privacy requirements, controls and responsibilities for each system, and the impact level of the information communicated.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-3 b
CCI-002083 (policy): Review and update the agreements on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 c NIST: NIST SP 800-53 Revision 5 (v5): CA-3 c
CCI-002084 (policy): Defines the frequency at which reviews and updates to the agreements must be conducted.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-3 c NIST: NIST SP 800-53 Revision 5 (v5): CA-3 c
CCI-003864 (policy): Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-3 (6)
CCI-003865 (policy): Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-3a.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-3 (7) (a)
CCI-003866 (policy): Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-3 (7) (b)
CCI-000264 (policy): Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.
References: NIST: NIST SP 800-53 (v3): CA-5 a NIST: NIST SP 800-53 Revision 4 (v4): CA-5 a NIST: NIST SP 800-53 Revision 5 (v5): CA-5 a NIST: NIST SP 800-53A (v1): CA-5-1 (i) and (ii)
CCI-000265 (policy): Defines the frequency with which to update the existing plan of action and milestones for the system.
References: NIST: NIST SP 800-53 (v3): CA-5 b NIST: NIST SP 800-53 Revision 4 (v4): CA-5 b NIST: NIST SP 800-53 Revision 5 (v5): CA-5 b NIST: NIST SP 800-53A (v1): CA-5-1 (iii)
CCI-000266 (policy): Update, on an organization-defined frequency, the existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
References: NIST: NIST SP 800-53 (v3): CA-5 b NIST: NIST SP 800-53 Revision 4 (v4): CA-5 b NIST: NIST SP 800-53 Revision 5 (v5): CA-5 b NIST: NIST SP 800-53A (v1): CA-5-1 (iv)
CCI-000267 (policy): Ensure the accuracy of the plan of action and milestones for the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CA-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): CA-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): CA-5 (1) NIST: NIST SP 800-53A (v1): CA-5 (1).1
CCI-000268 (policy): Ensure the currency of the plan of action and milestones for the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CA-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): CA-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): CA-5 (1) NIST: NIST SP 800-53A (v1): CA-5 (1).1
CCI-000269 (policy): Ensure the availability of the plan of action and milestones for the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CA-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): CA-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): CA-5 (1) NIST: NIST SP 800-53A (v1): CA-5 (1).1
CCI-003867 (policy): Defines the automated mechanisms to ensure the accuracy, currency, and availability of the plan of actions and milestones.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-5 (1)
CCI-000270 (policy): Assign a senior official as the authorizing official for the system.
References: NIST: NIST SP 800-53 (v3): CA-6 a NIST: NIST SP 800-53 Revision 4 (v4): CA-6 a NIST: NIST SP 800-53 Revision 5 (v5): CA-6 a NIST: NIST SP 800-53A (v1): CA-6.1 (i)
CCI-003868 (policy): Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-6 b
CCI-000271 (policy): Ensure the authorizing official for the system authorizes the system to operate before commencing operations.
References: NIST: NIST SP 800-53 (v3): CA-6 b NIST: NIST SP 800-53 Revision 4 (v4): CA-6 b NIST: NIST SP 800-53 Revision 5 (v5): CA-6 c 2 NIST: NIST SP 800-53A (v1): CA-6.1 (ii)
CCI-003869 (policy): Ensure the authorizing official accepts the use of common controls inherited by the system, before commencing operations.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-6 c 1
CCI-003870 (policy): Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-6 d
CCI-000272 (policy): Update the authorization on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CA-6 c NIST: NIST SP 800-53 Revision 4 (v4): CA-6 c NIST: NIST SP 800-53 Revision 5 (v5): CA-6 e NIST: NIST SP 800-53A (v1): CA-6.1 (iv)
CCI-000273 (policy): Defines the frequency with which to update the authorizations.
References: NIST: NIST SP 800-53 (v3): CA-6 c NIST: NIST SP 800-53 Revision 4 (v4): CA-6 c NIST: NIST SP 800-53 Revision 5 (v5): CA-6 e NIST: NIST SP 800-53A (v1): CA-6.1 (iii)
CCI-003871 (policy): Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-6 (1)
CCI-003872 (policy): Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-6 (2)
CCI-000274 (policy): Develop a continuous monitoring strategy.
References: NIST: NIST SP 800-53 (v3): CA-7 NIST: NIST SP 800-53 Revision 4 (v4): CA-7 NIST: NIST SP 800-53 Revision 5 (v5): CA-7 NIST: NIST SP 800-53A (v1): CA-7.1 (i)
CCI-003873 (policy): Implement continuous monitoring in accordance with the organization-level continuous monitoring strategy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7
CCI-002087 (policy): Establish organization-defined system-level metrics to be monitored.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-7 a NIST: NIST SP 800-53 Revision 5 (v5): CA-7 a
CCI-003874 (policy): Defines the system-level metrics to be monitored.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 a
CCI-002088 (policy): Establish organization-defined frequencies for monitoring.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-7 b NIST: NIST SP 800-53 Revision 5 (v5): CA-7 b
CCI-003875 (policy): Establish organization-defined frequencies for assessment of control effectiveness.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 b
CCI-003876 (policy): Defines the frequencies for monitoring of control effectiveness.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 b
CCI-003877 (policy): Defines the frequencies for assessment of control effectiveness.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 b
CCI-000279 (policy): Implement ongoing control assessments in accordance with the continuous monitoring strategy.
References: NIST: NIST SP 800-53 (v3): CA-7 c NIST: NIST SP 800-53 Revision 4 (v4): CA-7 c NIST: NIST SP 800-53 Revision 5 (v5): CA-7 c NIST: NIST SP 800-53A (v1): CA-7.1 (iv)
CCI-003878 (policy): Develop ongoing control assessments in accordance with the continuous monitoring strategy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 c
CCI-002090 (policy): Implement ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-7 d NIST: NIST SP 800-53 Revision 5 (v5): CA-7 d
CCI-002091 (policy): Implement a continuous monitoring program that includes correlation and analysis of information generated by assessments and monitoring.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-7 e NIST: NIST SP 800-53 Revision 5 (v5): CA-7 e
CCI-002092 (policy): Implement a continuous monitoring program that includes response actions to address results of the analysis of control assessment and monitoring information.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-7 f NIST: NIST SP 800-53 Revision 5 (v5): CA-7 f
CCI-000280 (policy): Implement a continuous monitoring program that includes reporting the security status to organization-defined personnel or roles on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CA-7 d NIST: NIST SP 800-53 Revision 4 (v4): CA-7 g NIST: NIST SP 800-53 Revision 5 (v5): CA-7 g NIST: NIST SP 800-53A (v1): CA-7.1 (iv)
CCI-000281 (policy): Defines the frequency with which to report the security status to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): CA-7 d NIST: NIST SP 800-53 Revision 4 (v4): CA-7 g NIST: NIST SP 800-53 Revision 5 (v5): CA-7 g NIST: NIST SP 800-53A (v1): CA-7.1 (ii)
CCI-003879 (policy): Implement a continuous monitoring program that includes reporting the privacy status to organization-defined personnel or roles on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 g
CCI-003880 (policy): Defines the frequency with which to report the privacy status to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 g
CCI-000282 (policy): Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
References: NIST: NIST SP 800-53 (v3): CA-7 (1) NIST: NIST SP 800-53 Revision 4 (v4): CA-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (1) NIST: NIST SP 800-53A (v1): CA-7 (1).1
CCI-002086 (policy): Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-7 (3) NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (3)
CCI-003881 (policy, technical): Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes effectiveness monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (4) (a)
CCI-003882 (policy, technical): Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes compliance monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (4) (b)
CCI-003883 (policy, technical): Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes change monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (4) (c)
CCI-003884 (policy): Employ organization-defined actions to validate that policies are established.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (5)
CCI-003885 (policy): Employ organization-defined actions to validate that implemented controls are operating in a consistent manner.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (5)
CCI-003886 (policy): Defines the actions used to validate policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (5)
CCI-003887 (policy): Ensure the accuracy, currency, and availability of monitoring results for the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (6)
CCI-003888 (policy): Defines the automated mechanisms for ensuring accuracy, currency, and availability of monitoring results.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (6)
CCI-002093 (policy): Conduct penetration testing in accordance with organization-defined frequency on organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-8 NIST: NIST SP 800-53 Revision 5 (v5): CA-8
CCI-002094 (policy): Defines the frequency for conducting penetration testing on organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-8 NIST: NIST SP 800-53 Revision 5 (v5): CA-8
CCI-002095 (policy): Defines the systems or system components on which penetration testing will be conducted.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-8 NIST: NIST SP 800-53 Revision 5 (v5): CA-8
CCI-002096 (policy): Employ an independent penetration agent or penetration team to perform penetration testing on the system or system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-8 (1) NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (1)
CCI-002097 (policy): Defines red team exercises to simulate attempts by adversaries to compromise organizational systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (2)
CCI-002099 (policy): Employ organization-defined red team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (2)
CCI-003889 (policy): Employ a penetration testing process, on an organization-defined frequency, that includes announced or unannounced attempts to bypass or circumvent controls associated with physical access points to the facility.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (3)
CCI-003890 (policy): Defines the frequency the penetration testing process will be employed.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (3)
CCI-002101 (policy): Authorizes internal connections of organization-defined system components or classes of components to the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (a) NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (a)
CCI-002102 (policy): Defines the system components or classes of components that are authorized internal connections to the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (a) NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (a)
CCI-002103 (policy): Document, for each internal connection, the interface characteristics.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (b) NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (b)
CCI-002104 (policy): Document, for each internal connection, the security requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (b) NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (b)
CCI-002105 (policy): Document, for each internal connection, the nature of the information communicated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (b) NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (b)
CCI-003891 (policy): Document, for each internal connection, the privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (b)
CCI-003892 (policy): Terminate internal system connections after organization-defined conditions.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (c)
CCI-003893 (policy): Defines the conditions for terminating internal system connections.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (c)
CCI-003894 (policy): Review on an organization-defined frequency the continued need for each internal connection.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (d)
CCI-003895 (policy): Defines the frequency for reviewing each internal connection.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (d)
CCI-002100 (policy): Perform security compliance checks on constituent components prior to the establishment of the internal connection.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (1) NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (1)
CCI-003896 (policy, technical): Perform privacy compliance checks on constituent components prior to the establishment of the internal connection.
References: NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (1)
CCI-000287 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): CM-1 a NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 1 (a) NIST: NIST SP 800-53A (v1): CM-1.1 (i) (ii)
CCI-000290 (policy): Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and the associated configuration management controls.
References: NIST: NIST SP 800-53 (v3): CM-1 b NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 2 NIST: NIST SP 800-53A (v1): CM-1.1 (iv) (v)
CCI-000292 (policy): Review and update, on an organization-defined frequency, the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls.
References: NIST: NIST SP 800-53 (v3): CM-1 b NIST: NIST SP 800-53 Revision 4 (v4): CM-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 2 NIST: NIST SP 800-53A (v1): CM-1.2 (iv)
CCI-001821 (policy): Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management policy is to be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 1 (a)
CCI-001822 (policy): Disseminate the organization-level; mission/business process-level; and/or system-level configuration management policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 1 (a)
CCI-001824 (policy): Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management procedures are to be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 2
CCI-001825 (policy): Disseminate to organization-defined personnel or roles the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 2
CCI-003897 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 1 (b)
CCI-003898 (policy): Defines the official to manage the development, documentation, and dissemination of the configuration management policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b
CCI-003899 (policy): Designate an organization-defined official to manage the development and documentation of the configuration management policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b
CCI-003900 (policy): Designate an organization-defined official to manage the dissemination of the configuration management policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b
CCI-003901 (policy): Defines the official to manage the development, documentation, and dissemination of the configuration management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b
CCI-003902 (policy): Designate an organization-defined official to manage the development and documentation of the configuration management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b
CCI-003903 (policy): Designate an organization-defined official to manage the dissemination of the configuration management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b
CCI-000286 (policy): Defines the frequency with which to review and update the configuration management policies.
References: NIST: NIST SP 800-53 (v3): CM-1 NIST: NIST SP 800-53 Revision 4 (v4): CM-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 1 NIST: NIST SP 800-53A (v1): CM-1.2 (i)
CCI-000289 (policy): Review and update, on an organization-defined frequency, the configuration management policy.
References: NIST: NIST SP 800-53 (v3): CM-1 a NIST: NIST SP 800-53 Revision 4 (v4): CM-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 1 NIST: NIST SP 800-53A (v1): CM-1.2 (ii)
CCI-001584 (policy): Defines the frequency with which to review and update configuration management procedures.
References: NIST: NIST SP 800-53 (v3): CM-1 NIST: NIST SP 800-53 Revision 4 (v4): CM-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 2 NIST: NIST SP 800-53A (v1): CM-1.2 (iii)
CCI-003904 (policy): Review and update the configuration management policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 1
CCI-003905 (policy): Defines the events for when the policy will be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 1
CCI-003906 (policy): Review and update, on an organization-defined frequency, the current configuration management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 2
CCI-003907 (policy): Review and update the configuration management procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 2
CCI-003908 (policy): Defines the events for when the procedures will be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 2
CCI-000295 (policy): Maintain, under configuration control, a current baseline configuration of the system.
References: NIST: NIST SP 800-53 (v3): CM-2 NIST: NIST SP 800-53 Revision 4 (v4): CM-2 NIST: NIST SP 800-53 Revision 5 (v5): CM-2 a NIST: NIST SP 800-53A (v1): CM-2.1 (ii)
CCI-003909 (policy): Develop and document, under configuration control, a current baseline configuration of the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-2 a
CCI-000296 (policy): Review and update the baseline configuration of the system on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CM-2 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 1 NIST: NIST SP 800-53A (v1): CM-2 (1).1 (ii)
CCI-000297 (policy): Review and update the baseline configuration of the system when required due to organization-defined circumstances.
References: NIST: NIST SP 800-53 (v3): CM-2 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 2 NIST: NIST SP 800-53A (v1): CM-2 (1).1 (ii)
CCI-001497 (policy): Defines a frequency for the review and update to the baseline configuration of the system.
References: NIST: NIST SP 800-53 (v3): CM-2 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 1 NIST: NIST SP 800-53A (v1): CM-2 (1).1 (i)
CCI-001585 (policy): Defines the circumstances that require reviews and updates to the baseline configuration of the system.
References: NIST: NIST SP 800-53 (v3): CM-2 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 2 NIST: NIST SP 800-53A (v1): CM-2 (1).1 (i)
CCI-003910 (policy): Review and update the baseline configuration of the system when system components are installed or upgraded.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 3
CCI-000300 (policy): Maintain complete configuration of the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2) NIST: NIST SP 800-53A (v1): CM-2 (2).1
CCI-000301 (policy): Maintain current configuration of the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2) NIST: NIST SP 800-53A (v1): CM-2 (2).1
CCI-000302 (policy): Maintain accurate configuration of the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2) NIST: NIST SP 800-53A (v1): CM-2 (2).1