Lexim011/Compliance huggingface dataset:
CCI-002886 (policy): Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (1) (b)
CCI-000882 (policy): Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced.
References: NIST: NIST SP 800-53 (v3): MA-4 (3) (a) NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (3) (a) NIST: NIST SP 800-53A (v1): MA-4 (3).1 (i)
CCI-000883 (policy): Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information).
References: NIST: NIST SP 800-53 (v3): MA-4 (3) (b) NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (3) (b) NIST: NIST SP 800-53A (v1): MA-4 (3).1 (i)
CCI-001631 (policy): After the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.
References: NIST: NIST SP 800-53 (v3): MA-4 (3) (b) NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (3) (b) NIST: NIST SP 800-53A (v1): MA-4 (3).1 (iii)
CCI-000884 (technical): Protect nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant.
References: NIST: NIST SP 800-53 (v3): MA-4 (4) NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (4) (a) NIST: NIST SP 800-53A (v1): MA-4 (4).1 (i)
CCI-002887 (policy): Defines the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (4) (a)
CCI-001632 (technical): Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by either physically separated communications paths or logically separated communications paths based upon encryption.
References: NIST: NIST SP 800-53 (v3): MA-4 (4) (a) (b) NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (4) (b) (1) NIST: NIST SP 800-53A (v1): MA-4 (4).1 (ii)
CCI-004192 (technical): Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (4) (b) (2)
CCI-000887 (policy): Require the approval of each nonlocal maintenance session by organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): MA-4 (5) (b) NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (5) (a) NIST: NIST SP 800-53A (v1): MA-4 (5).1 (iii)
CCI-002888 (policy): Defines the personnel or roles authorized to approve each nonlocal maintenance session.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (5) (a)
CCI-000886 (policy): Defines the personnel or roles to be notified of the date and time of planned nonlocal maintenance.
References: NIST: NIST SP 800-53 (v3): MA-4 (5) (a) NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (5) (b) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (5) (b) NIST: NIST SP 800-53A (v1): MA-4 (5).1 (ii)
CCI-002889 (policy): Notify organization-defined personnel or roles of the date and time of planned nonlocal maintenance.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (5) (b) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (5) (b)
CCI-002890 (technical): Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (6) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (6)
CCI-003123 (technical): Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (6) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (6)
CCI-004193 (policy, technical): Defines the cryptographic mechanisms for protecting the integrity and confidentiality of nonlocal maintenance and diagnostic communications.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (6)
CCI-002891 (technical): Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (7) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (7)
CCI-000890 (policy): Establish a process for maintenance personnel authorization.
References: NIST: NIST SP 800-53 (v3): MA-5 a NIST: NIST SP 800-53 Revision 4 (v4): MA-5 a NIST: NIST SP 800-53 Revision 5 (v5): MA-5 a NIST: NIST SP 800-53A (v1): MA-5.1 (i)
CCI-000891 (policy): Maintain a list of authorized maintenance organizations or personnel.
References: NIST: NIST SP 800-53 (v3): MA-5 a NIST: NIST SP 800-53 Revision 4 (v4): MA-5 a NIST: NIST SP 800-53 Revision 5 (v5): MA-5 a NIST: NIST SP 800-53A (v1): MA-5.1 (ii)
CCI-002894 (policy): Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-5 b NIST: NIST SP 800-53 Revision 5 (v5): MA-5 b
CCI-002895 (policy): Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-5 c NIST: NIST SP 800-53 Revision 5 (v5): MA-5 c
CCI-000893 (policy): Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens.
References: NIST: NIST SP 800-53 (v3): MA-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (a) NIST: NIST SP 800-53A (v1): MA-5 (1).1
CCI-000894 (policy): Requires maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals to be escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified.
References: NIST: NIST SP 800-53 (v3): MA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (1) (a) (1) NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (a) (1) NIST: NIST SP 800-53A (v1): MA-5 (1).1
CCI-000895 (policy): Require that, prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system be sanitized and all nonvolatile storage media be removed or physically disconnected from the system and secured.
References: NIST: NIST SP 800-53 (v3): MA-5 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (1) (a) (2) NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (a) (2) NIST: NIST SP 800-53A (v1): MA-5 (1).1
CCI-004194 (policy): Develop organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (b)
CCI-004195 (policy): Implement organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (b)
CCI-004196 (policy): Defines alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (b)
CCI-000897 (policy): Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.
References: NIST: NIST SP 800-53 (v3): MA-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (2) NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (2) NIST: NIST SP 800-53A (v1): MA-5 (2).1
CCI-000898 (policy): Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.
References: NIST: NIST SP 800-53 (v3): MA-5 (3) NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (3) NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (3) NIST: NIST SP 800-53A (v1): MA-5 (3).1
CCI-000899 (policy): Ensure that cleared foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments.
References: NIST: NIST SP 800-53 (v3): MA-5 (4) (a) NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (4) (a) NIST: NIST SP 800-53A (v1): MA-5 (4).1 (i)
CCI-000900 (policy): Ensure that that approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.
References: NIST: NIST SP 800-53 (v3): MA-5 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (4) (b) NIST: NIST SP 800-53A (v1): MA-5 (4).1 (ii)
CCI-002893 (policy): Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorization.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (5) NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (5)
CCI-000903 (policy): Obtain maintenance support and/or spare parts for organization-defined system components within an organization-defined time period of failure.
References: NIST: NIST SP 800-53 (v3): MA-6 NIST: NIST SP 800-53 Revision 4 (v4): MA-6 NIST: NIST SP 800-53 Revision 5 (v5): MA-6 NIST: NIST SP 800-53A (v1): MA-6.1 (iii)
CCI-002896 (policy): Defines the system components for which it obtains maintenance support and/or spare parts.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-6 NIST: NIST SP 800-53 Revision 5 (v5): MA-6
CCI-002897 (policy): Defines a time period for obtaining maintenance support and/or spare parts for organization-defined system components after a failure.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-6 NIST: NIST SP 800-53 Revision 5 (v5): MA-6
CCI-002898 (policy): Perform preventive maintenance on organization-defined information system components at organization-defined time intervals.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (1)
CCI-002899 (policy): Defines system components on which to perform preventive maintenance.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (1)
CCI-002900 (policy): Defines time intervals at which to perform preventive maintenance on organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (1)
CCI-002901 (policy): Perform predictive maintenance on organization-defined system components at organization-defined intervals.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (2)
CCI-002902 (policy): Defines system components on which to perform predictive maintenance.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (2)
CCI-002903 (policy): Defines time intervals at which to perform predictive maintenance on organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (2)
CCI-002904 (policy): Transfer predictive maintenance data to a maintenance management system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (3)
CCI-004197 (policy): Defines the automated mechanisms for transferring predictive maintenance data to a maintenance system.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (3)
CCI-004198 (policy): Restrict or prohibit field maintenance on organization-defined systems or system components to organization-defined trusted maintenance facilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-7
CCI-004199 (policy): Defines the systems or system components which restrict or prohibit field maintenance.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-7
CCI-004200 (policy): Defines the trusted maintenance facilities which the systems or system components restrict or prohibit field maintenance.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-7
CCI-000995 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): MP-1 a NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 1 (a) NIST: NIST SP 800-53A (v1): MP-1.1 (i and ii)
CCI-000996 (policy): Disseminates a media protection policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): MP-1 a NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 1 NIST: NIST SP 800-53A (v1): MP-1.1 (iii)
CCI-000999 (policy): Develop and document procedures to facilitate the implementation of the media protection policy and associated media protection controls.
References: NIST: NIST SP 800-53 (v3): MP-1 b NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 2 NIST: NIST SP 800-53A (v1): MP-1.1 (iv and v)
CCI-001000 (policy): Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the media protection policy and associated media protection controls.
References: NIST: NIST SP 800-53 (v3): MP-1 b NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 2 NIST: NIST SP 800-53A (v1): MP-1.1 (vi)
CCI-002566 (policy): Defines personnel or roles to whom a media protection policy and procedures will be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 1
CCI-004201 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 1 (b)
CCI-004202 (policy): Designate an organization-defined official to manage the development and documentation of the media protection policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b
CCI-004203 (policy): Designate an organization-defined official to manage the dissemination of the media protection policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b
CCI-004204 (policy): Designate an organization-defined official to manage development and documentation of the media protection procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b
CCI-004205 (policy): Designate an organization-defined official to manage dissemination of the media protection procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b
CCI-004206 (policy): Defines the official designated to manage the development, documentation, and dissemination of the media protection policy and procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b
CCI-000997 (policy): Review and update the current media protection policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): MP-1 a NIST: NIST SP 800-53 Revision 4 (v4): MP-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 1 NIST: NIST SP 800-53A (v1): MP-1.2 (ii)
CCI-000998 (policy): Defines a frequency for reviewing and updating the current media protection policy.
References: NIST: NIST SP 800-53 (v3): MP-1 a NIST: NIST SP 800-53 Revision 4 (v4): MP-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 1 NIST: NIST SP 800-53A (v1): MP-1.2 (i)
CCI-001001 (policy): Review and update the current media protection procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): MP-1 b NIST: NIST SP 800-53 Revision 4 (v4): MP-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 2 NIST: NIST SP 800-53A (v1): MP-1.2 (iv)
CCI-001002 (policy): Defines a frequency for reviewing and updating the current media protection procedures.
References: NIST: NIST SP 800-53 (v3): MP-1 b NIST: NIST SP 800-53 Revision 4 (v4): MP-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 2 NIST: NIST SP 800-53A (v1): MP-1.2 (iii)
CCI-004207 (policy): Review and update the current media protection policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 1
CCI-004208 (policy): Defines the events following reviewing and updating the current media policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 1
CCI-004209 (policy): Review and update the current media protection procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 2
CCI-004210 (policy): Defines the events following reviewing and updating the current media procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 2
CCI-001003 (policy): Restrict access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): MP-2 NIST: NIST SP 800-53 Revision 4 (v4): MP-2 NIST: NIST SP 800-53 Revision 5 (v5): MP-2 NIST: NIST SP 800-53A (v1): MP-2.1 (ii)
CCI-001004 (policy): Defines types of digital and/or non-digital media for which the organization restricts access.
References: NIST: NIST SP 800-53 (v3): MP-2 NIST: NIST SP 800-53 Revision 4 (v4): MP-2 NIST: NIST SP 800-53 Revision 5 (v5): MP-2 NIST: NIST SP 800-53A (v1): MP-2.1 (i)
CCI-001005 (policy): Defines personnel or roles from which to restrict access to organization-defined types of digital and/or non-digital media.
References: NIST: NIST SP 800-53 (v3): MP-2 NIST: NIST SP 800-53 Revision 4 (v4): MP-2 NIST: NIST SP 800-53 Revision 5 (v5): MP-2 NIST: NIST SP 800-53A (v1): MP-2.1 (i)
CCI-001010 (policy): Marks system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information.
References: NIST: NIST SP 800-53 (v3): MP-3 a NIST: NIST SP 800-53 Revision 4 (v4): MP-3 a NIST: NIST SP 800-53 Revision 5 (v5): MP-3 a NIST: NIST SP 800-53A (v1): MP-3.1 (ii)
CCI-001011 (policy): Exempt organization-defined types of system media from marking as long as the media remain within organization-defined controlled areas.
References: NIST: NIST SP 800-53 (v3): MP-3 b NIST: NIST SP 800-53 Revision 4 (v4): MP-3 b NIST: NIST SP 800-53 Revision 5 (v5): MP-3 b NIST: NIST SP 800-53A (v1): MP-3.1 (iv)
CCI-001012 (policy): Defines types of system media to exempt from marking as long as the media remain within organization-defined controlled areas.
References: NIST: NIST SP 800-53 (v3): MP-3 b NIST: NIST SP 800-53 Revision 4 (v4): MP-3 b NIST: NIST SP 800-53 Revision 5 (v5): MP-3 b NIST: NIST SP 800-53A (v1): MP-3.1 (iii)
CCI-001013 (policy): Defines controlled areas where organization-defined types of system media are exempt from being marked.
References: NIST: NIST SP 800-53 (v3): MP-3 b NIST: NIST SP 800-53 Revision 4 (v4): MP-3 b NIST: NIST SP 800-53 Revision 5 (v5): MP-3 b NIST: NIST SP 800-53A (v1): MP-3.1 (iii)
CCI-001015 (policy): Defines types of digital and/or non-digital media to physically control and securely store within organization-defined controlled areas.
References: NIST: NIST SP 800-53 (v3): MP-4 a NIST: NIST SP 800-53 Revision 4 (v4): MP-4 a NIST: NIST SP 800-53 Revision 5 (v5): MP-4 a NIST: NIST SP 800-53A (v1): MP-4.1 (i)
CCI-001016 (policy): Defines controlled areas where organization-defined types of digital and/or non-digital media are physically controlled and securely stored.
References: NIST: NIST SP 800-53 (v3): MP-4 a NIST: NIST SP 800-53 Revision 4 (v4): MP-4 a NIST: NIST SP 800-53 Revision 5 (v5): MP-4 a NIST: NIST SP 800-53A (v1): MP-4.1 (i)
CCI-004211 (policy): Physically control and securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-4 a
CCI-004212 (policy): Securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-4 a
CCI-004213 (policy): Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-4 b
CCI-004214 (policy): Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved techniques.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-4 b
CCI-004215 (policy): Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-4 b
CCI-001007 (policy): Restrict access to media storage areas using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): MP-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): MP-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): MP-4 (2) NIST: NIST SP 800-53A (v1): MP-2 (1).1 (i)
CCI-001008 (policy): Log access attempts and access granted using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): MP-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): MP-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): MP-4 (2) NIST: NIST SP 800-53A (v1): MP-2 (1).1 (ii)
CCI-004216 (policy): Defines the automated mechanisms which restrict access to media storage areas and log access attempts and access granted.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-4 (2)
CCI-001021 (policy): Defines types of system media protected and controlled during transport outside of controlled areas.
References: NIST: NIST SP 800-53 (v3): MP-5 a NIST: NIST SP 800-53 Revision 4 (v4): MP-5 a NIST: NIST SP 800-53 Revision 5 (v5): MP-5 a NIST: NIST SP 800-53A (v1): MP-5
CCI-001022 (policy): Defines controls to be used to protect and control organization-defined types of system media during transport outside of controlled areas.
References: NIST: NIST SP 800-53 (v3): MP-5 a NIST: NIST SP 800-53 Revision 4 (v4): MP-5 a NIST: NIST SP 800-53 Revision 5 (v5): MP-5 a NIST: NIST SP 800-53A (v1): MP-5.1 (i)
CCI-004217 (policy): Protect organization-defined types of system media during transport outside of controlled areas using organization-defined controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-5 a
CCI-004218 (policy): Control organization-defined types of system media during transport outside of controlled areas using organization-defined controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-5 a
CCI-001023 (policy): Maintain accountability for system media during transport outside of controlled areas.
References: NIST: NIST SP 800-53 (v3): MP-5 b NIST: NIST SP 800-53 Revision 4 (v4): MP-5 b NIST: NIST SP 800-53 Revision 5 (v5): MP-5 b NIST: NIST SP 800-53A (v1): MP-5.1 (iii)
CCI-001025 (policy): Document activities associated with the transport of system media.
References: NIST: NIST SP 800-53 (v3): MP-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): MP-5 c NIST: NIST SP 800-53 Revision 5 (v5): MP-5 c NIST: NIST SP 800-53A (v1): MP-5 (2).1
CCI-001024 (policy): Restrict the activities associated with the transport of system media to authorized personnel.
References: NIST: NIST SP 800-53 (v3): MP-5 c NIST: NIST SP 800-53 Revision 4 (v4): MP-5 d NIST: NIST SP 800-53 Revision 5 (v5): MP-5 d NIST: NIST SP 800-53A (v1): MP-5.1 (v)
CCI-001026 (policy): Employ an identified custodian during transport of system media outside of controlled areas.
References: NIST: NIST SP 800-53 (v3): MP-5 (3) NIST: NIST SP 800-53 Revision 4 (v4): MP-5 (3) NIST: NIST SP 800-53 Revision 5 (v5): MP-5 (3) NIST: NIST SP 800-53A (v1): MP-5 (3).1
CCI-001028 (policy): Sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures.
References: NIST: NIST SP 800-53 (v3): MP-6 NIST: NIST SP 800-53 Revision 4 (v4): MP-6 a NIST: NIST SP 800-53 Revision 5 (v5): MP-6 a NIST: NIST SP 800-53A (v1): MP-6.1 (ii)
CCI-002578 (policy): Defines system media to sanitize prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 a NIST: NIST SP 800-53 Revision 5 (v5): MP-6 a
CCI-002579 (policy): Defines the sanitization techniques and procedures to be used to sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 a NIST: NIST SP 800-53 Revision 5 (v5): MP-6 a
CCI-002580 (policy): Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 b NIST: NIST SP 800-53 Revision 5 (v5): MP-6 b
CCI-002567 (policy): Review and approve media sanitization.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1)
CCI-002568 (policy): Track and document media sanitization.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1)
CCI-002569 (policy): Verify media sanitization.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1)
CCI-002570 (policy): Review and approve media disposal actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1)
CCI-002571 (policy): Track and document media disposal actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1)
CCI-002572 (policy): Verify media disposal actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1)
CCI-001031 (policy): Defines a frequency for testing sanitization equipment and procedures to ensure that the intended sanitization is being achieved.
References: NIST: NIST SP 800-53 (v3): MP-6 (2) NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (2) NIST: NIST SP 800-53A (v1): MP-6 (2).1 (i)
CCI-004219 (policy): Test sanitization equipment in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (2)
CCI-004220 (policy): Test sanitization procedures in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (2)
CCI-001032 (policy): Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the information system in accordance with organization-defined circumstances requiring sanitization of portable storage devices.
References: NIST: NIST SP 800-53 (v3): MP-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (3) NIST: NIST SP 800-53A (v1): MP-6 (3).1 (ii)
CCI-001033 (policy): Defines circumstances requiring sanitization of portable storage devices prior to connecting such devices to the system.
References: NIST: NIST SP 800-53 (v3): MP-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (3) NIST: NIST SP 800-53A (v1): MP-6 (3).1 (i)
CCI-002573 (policy): Enforce dual authorization for the sanitization of organization-defined system media.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (7) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (7)
CCI-002574 (policy): Defines the system media that dual authorization is enforced for sanitization.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (7) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (7)
CCI-002575 (policy): Defines systems or system components from which information is purged or wiped, either remotely or under the organization-defined conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (8) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (8)
CCI-002576 (policy): Defines conditions under which information from organization-defined systems or system components are to be purged or wiped.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (8) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (8)
CCI-002577 (policy): Provide the capability to purge or wipe information from organization-defined systems, system components either remotely or under organization-defined conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (8) NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (8)
CCI-002581 (policy): Defines the types of system media to restrict or prohibit on organization-defined systems or system components using organization-defined controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-7 NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (a)
CCI-002582 (policy): Defines the systems or system components on which to restrict or prohibit the use of organization-defined types of system media using organization-defined controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-7 NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (a)
CCI-002583 (policy): Defines the controls to use for restricting or prohibiting the use of organization-defined types of system media on organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-7 NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (a)
CCI-002584 (policy): Restrict or prohibit the use of organization-defined types of system media on organization-defined systems or system components using organization-defined controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-7 NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (a)
CCI-002585 (policy): Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (b)
CCI-002586 (policy): Prohibit the use of sanitization-resistant media in organizational systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (2)
CCI-004221 (policy): Establish an organization-defined system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-8 a
CCI-004222 (policy): Defines the system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-8 a
CCI-004223 (policy): Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-8 b
CCI-004224 (policy): Verify that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-8 b
CCI-004225 (policy): Identify organization-defined system media requiring downgrading.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-8 c
CCI-004226 (policy): Defines the system media requiring downgrading.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-8 c
CCI-002600 (policy): Downgrade the identified system media using the established process.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 d NIST: NIST SP 800-53 Revision 5 (v5): MP-8 d
CCI-002587 (policy): Document system media downgrading actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (1) NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (1)
CCI-002591 (policy): Defines the frequency with which to test downgrading equipment and procedures to ensure correct performance.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (2)
CCI-004227 (policy): Test downgrading equipment on an organization-defined frequency to ensure that intended downgrading actions are being achieved.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (2)
CCI-004228 (policy): Test downgrading procedures on an organization-defined frequency to ensure that intended downgrading actions are being achieved.
References: NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (2)
CCI-002593 (policy): Downgrade system media containing Controlled Unclassified Information (CUI) prior to public release.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (3) NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (3)
CCI-002594 (policy): Downgrade system media containing classified information prior to release to individuals without required access authorizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (4) NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (4)
CCI-000904 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): PE-1 a NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 1 (a) NIST: NIST SP 800-53A (v1): PE-1.1 (i and ii)
CCI-000905 (policy): Disseminate a physical and environmental protection policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): PE-1 a NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 1 NIST: NIST SP 800-53A (v1): PE-1.1 (iii)
CCI-000908 (policy): Develop and document procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls.
References: NIST: NIST SP 800-53 (v3): PE-1 b NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 2 NIST: NIST SP 800-53A (v1): PE-1.1 (iv and v)
CCI-000909 (policy): Disseminate physical and environmental protection procedures to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): PE-1 b NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 2 NIST: NIST SP 800-53A (v1): PE-1.1 (vi)
CCI-002908 (policy): Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy is disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 1
CCI-002909 (policy): Defines the personnel or roles to whom the physical and environmental protection procedures are disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 2
CCI-004229 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 1 (b)
CCI-004230 (policy): Designate an organization-defined official to manage the development and documentation of the physical and environmental protection policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b
CCI-004231 (policy): Designate an organization-defined official to manage the dissemination of the physical and environmental protection policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b
CCI-004232 (policy): Designate an organization-defined official to manage development and documentation of the physical and environmental protection procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b
CCI-004233 (policy): Designate an organization-defined official to manage dissemination of the physical and environmental protection procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b
CCI-004234 (policy): Defines the official who will manage the physical and environmental policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b
CCI-004235 (policy): Defines the official who will manage the physical and environmental procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b
CCI-000906 (policy): Review and update the current physical and environmental protection policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PE-1 a NIST: NIST SP 800-53 Revision 4 (v4): PE-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 1 NIST: NIST SP 800-53A (v1): PE-1.2 (ii)
CCI-000907 (policy): Defines the frequency with which to review and update the physical and environmental protection policy.
References: NIST: NIST SP 800-53 (v3): PE-1 a NIST: NIST SP 800-53 Revision 4 (v4): PE-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 1 NIST: NIST SP 800-53A (v1): PE-1.2 (i)
CCI-000910 (policy): Review and update the current physical and environmental protection procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PE-1 b NIST: NIST SP 800-53 Revision 4 (v4): PE-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 2 NIST: NIST SP 800-53A (v1): PE-1.2 (iv)
CCI-000911 (policy): Defines the frequency with which to review and update the physical and environmental protection procedures.
References: NIST: NIST SP 800-53 (v3): PE-1 b NIST: NIST SP 800-53 Revision 4 (v4): PE-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 2 NIST: NIST SP 800-53A (v1): PE-1.2 (iii)
CCI-004236 (policy): Review and update the current physical and environmental protection policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 1
CCI-004237 (policy): Defines the events following reviewing and updating the current physical and environmental protection policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 1
CCI-004238 (policy): Review and update the current physical and environmental protection procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 2
CCI-004239 (policy): Defines the events following reviewing and updating the current physical and environmental protection procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 2
CCI-000912 (policy): Develop a list of individuals with authorized access to the facility where the system resides.
References: NIST: NIST SP 800-53 (v3): PE-2 a NIST: NIST SP 800-53 Revision 4 (v4): PE-2 a NIST: NIST SP 800-53 Revision 5 (v5): PE-2 a NIST: NIST SP 800-53A (v1): PE-2 (1).1 (i)
CCI-002910 (policy): Approve a list of individuals with authorized access to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-2 a NIST: NIST SP 800-53 Revision 5 (v5): PE-2 a
CCI-002911 (policy): Maintain a list of individuals with authorized access to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-2 a NIST: NIST SP 800-53 Revision 5 (v5): PE-2 a
CCI-000913 (policy): Issue authorization credentials for facility access.
References: NIST: NIST SP 800-53 (v3): PE-2 b NIST: NIST SP 800-53 Revision 4 (v4): PE-2 b NIST: NIST SP 800-53 Revision 5 (v5): PE-2 b NIST: NIST SP 800-53A (v1): PE-2.1 (iii)
CCI-000914 (policy): Review the access list detailing authorized facility access by individuals in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PE-2 c NIST: NIST SP 800-53 Revision 4 (v4): PE-2 c NIST: NIST SP 800-53 Revision 5 (v5): PE-2 c NIST: NIST SP 800-53A (v1): PE-2.2 (ii)
CCI-000915 (policy): Defines the frequency with which to review the access list detailing authorized facility access by individuals.
References: NIST: NIST SP 800-53 (v3): PE-2 c NIST: NIST SP 800-53 Revision 4 (v4): PE-2 c NIST: NIST SP 800-53 Revision 5 (v5): PE-2 c NIST: NIST SP 800-53A (v1): PE-2.2 (i)
CCI-001635 (policy): Remove individuals from the facility access list when access is no longer required.
References: NIST: NIST SP 800-53 (v3): PE-2 c NIST: NIST SP 800-53 Revision 4 (v4): PE-2 d NIST: NIST SP 800-53 Revision 5 (v5): PE-2 d NIST: NIST SP 800-53A (v1): PE-2.2 (iii)
CCI-000916 (policy): Authorize physical access to the facility where the system resides based on position or role.
References: NIST: NIST SP 800-53 (v3): PE-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (1) NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (1) NIST: NIST SP 800-53A (v1): PE-2 (1).1 (ii)
CCI-000917 (policy): Require two forms of identification from an organization-defined list of acceptable forms of identification for visitor access to the facility where the system resides.
References: NIST: NIST SP 800-53 (v3): PE-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (2) NIST: NIST SP 800-53A (v1): PE-2 (2).1
CCI-002912 (policy): Defines a list of acceptable forms of identification for visitor access to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (2)
CCI-002913 (policy): Restrict unescorted access to the facility where the system resides to personnel with one or more of the following: security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; organization-defined physical access authorizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (3)
CCI-002914 (policy): Defines the credentials required for personnel to have unescorted access to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (3)
CCI-000920 (policy): Verify individual access authorizations before granting access to the facility.
References: NIST: NIST SP 800-53 (v3): PE-3 b NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a 1 NIST: NIST SP 800-53A (v1): PE-3.1 (ii)
CCI-002915 (policy): Defines the entry and exit points to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a
CCI-002916 (policy): Defines the physical access control systems or devices or guards that control ingress and egress to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a 2
CCI-004240 (policy): Enforce physical access authorizations at organization-defined entry points to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a
CCI-004241 (policy): Enforce physical access authorizations at organization-defined exit points to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a
CCI-004242 (policy): Control ingress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a 2
CCI-004243 (policy): Control egress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards.
References: NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a 2
CCI-002917 (policy): Maintain physical access audit logs for organization-defined entry/exit points to the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 b NIST: NIST SP 800-53 Revision 5 (v5): PE-3 b
CCI-002918 (policy): Defines entry and exit points to the facility where the system resides that require physical access audit logs be maintained.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 b NIST: NIST SP 800-53 Revision 5 (v5): PE-3 b
CCI-002919 (policy): Control access to areas within the facility designated as publicly accessible by implementing organization-defined access controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 c NIST: NIST SP 800-53 Revision 5 (v5): PE-3 c
CCI-002920 (policy): Defines physical access controls to control access to areas within the facility designated as publicly accessible.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 c NIST: NIST SP 800-53 Revision 5 (v5): PE-3 c
CCI-002921 (policy): Escort visitors in the facility where the information system resides during organization-defined circumstances requiring visitor escorts.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 d NIST: NIST SP 800-53 Revision 5 (v5): PE-3 d
CCI-002922 (policy): Defines circumstances requiring visitor escorts in the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 d NIST: NIST SP 800-53 Revision 5 (v5): PE-3 d
CCI-002923 (policy): Monitor visitor activity in the facility where the system resides during organization-defined circumstances requiring visitor monitoring.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 d NIST: NIST SP 800-53 Revision 5 (v5): PE-3 d
CCI-002924 (policy): Defines circumstances requiring visitor monitoring in the facility where the system resides.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 d NIST: NIST SP 800-53 Revision 5 (v5): PE-3 d
CCI-000923 (policy): Secure keys, combinations, and other physical access devices.
References: NIST: NIST SP 800-53 (v3): PE-3 e NIST: NIST SP 800-53 Revision 4 (v4): PE-3 e NIST: NIST SP 800-53 Revision 5 (v5): PE-3 e NIST: NIST SP 800-53A (v1): PE-3.1 (v)
CCI-000924 (policy): Inventory organization-defined physical access devices on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PE-3 f NIST: NIST SP 800-53 Revision 4 (v4): PE-3 f NIST: NIST SP 800-53 Revision 5 (v5): PE-3 f NIST: NIST SP 800-53A (v1): PE-3.2 (ii)
CCI-000925 (policy): Defines the frequency for conducting inventories of organization-defined physical access devices.
References: NIST: NIST SP 800-53 (v3): PE-3 f NIST: NIST SP 800-53 Revision 4 (v4): PE-3 f NIST: NIST SP 800-53 Revision 5 (v5): PE-3 f NIST: NIST SP 800-53A (v1): PE-3.2 (i)
CCI-002925 (policy): Defines the physical access devices to inventory.
References: NIST: NIST SP 800-53 Revision 4 (v4): PE-3 f NIST: NIST SP 800-53 Revision 5 (v5): PE-3 f
CCI-000926 (policy): Change combinations and keys in accordance with organization-defined frequency and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
References: NIST: NIST SP 800-53 (v3): PE-3 g NIST: NIST SP 800-53 Revision 4 (v4): PE-3 g NIST: NIST SP 800-53 Revision 5 (v5): PE-3 g NIST: NIST SP 800-53A (v1): PE-3.2 (iv)
CCI-000927 (policy): Defines a frequency for changing combinations and keys.
References: NIST: NIST SP 800-53 (v3): PE-3 g NIST: NIST SP 800-53 Revision 4 (v4): PE-3 g NIST: NIST SP 800-53 Revision 5 (v5): PE-3 g NIST: NIST SP 800-53A (v1): PE-3.2 (iii)