Lexim011/Compliance huggingface dataset:
CCI-005078 (policy): Defines the supply chain risk management activities that will be led by a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-2 (1)
CCI-005079 (policy): Defines the personnel, roles, and responsibilities who lead and support organization-defined supply chain risk management activities.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-2 (1)
CCI-005080 (policy, technical): Establish a process of processes to identify and address weaknesses or deficiencies in the supply chain elements of organization-defined system or system components in coordination with organization-defined supply chain personnel.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a
CCI-005081 (policy): Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a
CCI-005082 (policy): Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a
CCI-005083 (policy, technical): Establish a process of processes to identify and address weaknesses or deficiencies in the processes of organization-defined system or system components in coordination with organization-defined supply chain personnel.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a
CCI-005084 (policy): Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a
CCI-005085 (policy): Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a
CCI-005086 (policy, technical): Employ the following controls to protect against supply chain risks to the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 b
CCI-005087 (policy, technical): Limit the harm or consequences from supply chain-related events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 b
CCI-005088 (policy): Defines the supply chain controls employed for protecting against supply chain risks to the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 b
CCI-005089 (policy, technical): Document the selected and implemented supply chain processes and controls in security and privacy plans, supply chain risk management plan, or organization-defined document.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 c
CCI-005090 (policy): Defines the document which contains supply chain processes and controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 c
CCI-005091 (policy): Employ a diverse set of sources for the following system components and services.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (1)
CCI-005092 (policy): Defines the system or system components and services which employ a diverse set of sources.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (1)
CCI-005093 (policy): Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (2)
CCI-005094 (policy): Defines the controls to be employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (2)
CCI-005095 (policy): Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (3)
CCI-005096 (policy): Document valid provenance of the following systems, system components, and associated data.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4
CCI-005097 (policy): Monitor valid provenance of the following systems, system components, and associated data.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4
CCI-005098 (policy): Maintain valid provenance of the following systems, system components, and associated data.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4
CCI-005099 (policy): Defines the systems, system components, and associated data for documenting, monitoring, and maintaining valid provenance.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4
CCI-005100 (policy): Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (1)
CCI-005101 (policy): Defines the supply chain elements, processes, and personnel associated with organization-defined systems and critical system components for establishing and maintaining unique identification.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (1)
CCI-005102 (policy): Establish and maintain unique identification of the following systems and critical components for tracking through the supply chain.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (2)
CCI-005103 (policy): Defines the systems and critical system components for tracking through the supply chain.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (2)
CCI-005104 (policy): Employ the following controls to validate that the system or system component received is genuine.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (3)
CCI-005105 (policy): Employ the following controls to validate that the system or system component received has not been altered.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (3)
CCI-005106 (policy): Defines the controls for validating that the system or system component received is genuine.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (3)
CCI-005107 (policy): Defines the controls for validating that the system or system component received has not been altered.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (3)
CCI-005108 (policy): Employ organization-defined controls to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (4)
CCI-005109 (policy): Defines the controls for ensuring the integrity of the system and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (4)
CCI-005110 (policy): Conduct organization-defined analysis to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (4)
CCI-005111 (policy): Defines the analysis for ensuring the integrity of the system and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (4)
CCI-005112 (policy): Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-5
CCI-005113 (policy): Defines the acquisition strategies, contract tools, and procurement methods for protecting against, identifying, and mitigating supply chain risks.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-5
CCI-005114 (policy): Employ the following controls to ensure an adequate supply of organization-defined critical system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-5 (1)
CCI-005115 (policy): Defines the controls for ensuring an adequate supply of organization-defined critical system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-5 (1)
CCI-005116 (policy): Defines the critical system components that the organization-defined controls ensure an adequate supply of.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-5 (1)
CCI-005117 (policy): Access the system, system component, or system service prior to selection, acceptance, modification, or update.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-5 (2)
CCI-005118 (policy): Access and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-6
CCI-005119 (policy): Defines the frequency for assessing and reviewing the supply chain risks.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-6
CCI-005120 (policy): Employ organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing of the following supply chain elements, processes, and actors associated with the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-6 (1)
CCI-005121 (policy): Defines the supply chain elements, processes, and actors for employing organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-6 (1)
CCI-005122 (policy): Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-7
CCI-005123 (policy): Defines the Operations Security (OPSEC) controls that protect supply chain-related information for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-7
CCI-005124 (policy): Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the notification of supply chain compromises, results of assessments or audits, and/or organization-defined information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-8
CCI-005125 (policy): Defines the information for establishing agreements and procedures with entities involved in the supply chain for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-8
CCI-005126 (policy): Implement a tamper protection program for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-9
CCI-005127 (policy): Employ anti-tamper technologies, tool, and techniques throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-9 (1)
CCI-005128 (policy): Inspect the following systems or system components at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-10
CCI-005129 (policy): Defines the frequency for inspecting systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-10
CCI-005130 (policy): Defines the indications of need for inspection for detecting tampering.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-10
CCI-005131 (policy): Defines the system or system components which will be inspected at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-10
CCI-005132 (policy): Develop and document anti-counterfeit policy that include the means to detect and prevent counterfeit components from entering the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 a
CCI-005133 (policy): Develop and document anti-counterfeit procedures that include the means to detect and prevent counterfeit components from entering the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 a
CCI-005134 (policy): Report counterfeit system components to source of counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 b
CCI-005135 (policy): Defines the external reporting organizations who report counterfeit system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 b
CCI-005136 (policy): Defines the personnel or roles who report counterfeit system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 b
CCI-005137 (policy): Train organization-defined personnel or roles to detect counterfeit system components including hardware, software, and firmware.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (1)
CCI-005138 (policy): Defines the personnel or roles who are trained to detect counterfeit system components (including hardware, software, and firmware).
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (1)
CCI-005139 (policy): Maintain configuration control over the following system components awaiting service or repair.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (2)
CCI-005140 (policy): Maintain configuration control over serviced or repaired components awaiting return to service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (2)
CCI-005141 (policy): Defines the system components awaiting service or repair.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (2)
CCI-005142 (policy): Scan for counterfeit system components on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (3)
CCI-005143 (policy): Defines the frequency for which the counterfeit system components are scanned.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (3)
CCI-005144 (policy): Dispose of organization-defined data, documentation, tools, or system components using the following techniques and methods.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-12
CCI-005145 (policy): Defines the data, documentation, tools, or system components which are to be disposed of using organization-defined techniques and methods.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-12
CCI-005146 (policy): Defines the techniques or methods used to dispose of organization-defined data, documentation, tools, or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-12
CCI-000001 (policy): The organization develops an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): AC-1 a NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1 NIST: NIST SP 800-53A (v1): AC-1.1 (i and ii)
CCI-000004 (policy): The organization develops procedures to facilitate the implementation of the access control policy and associated access controls.
References: NIST: NIST SP 800-53 (v3): AC-1 b NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 2 NIST: NIST SP 800-53A (v1): AC-1.1 (iv and v)
CCI-000007 (policy): The organization manages information system accounts by identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary).
References: NIST: NIST SP 800-53 (v3): AC-2 a NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-000008 (policy): The organization establishes conditions for group membership.
References: NIST: NIST SP 800-53 (v3): AC-2 b NIST: NIST SP 800-53 Revision 4 (v4): AC-2 c NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-000009 (policy): The organization manages information system accounts by identifying authorized users of the information system and specifying access privileges.
References: NIST: NIST SP 800-53 (v3): AC-2 c NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-000013 (policy): The organization manages information system accounts by notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes.
References: NIST: NIST SP 800-53 (v3): AC-2 g NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-000014 (policy): The organization manages information system accounts by granting access to the system based on a valid access authorization; intended system usage; and other attributes as required by the organization or associated missions/business functions.
References: NIST: NIST SP 800-53 (v3): AC-2 i NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-000020 (technical): The information system dynamically manages user privileges and associated access authorizations.
References: NIST: NIST SP 800-53 (v3): AC-2 (6) NIST: NIST SP 800-53A (v1): AC-2 (6).1
CCI-000022 (technical): The information system enforces one or more organization-defined nondiscretionary access control policies over an organization-defined set of users and resources.
References: NIST: NIST SP 800-53 (v3): AC-3 (3) (a) NIST: NIST SP 800-53A (v1): AC-3 (3).1 (iii)
CCI-000023 (policy): The organization develops an organization-wide information security program plan that provides sufficient information about the program management controls and common controls (including specification of parameters for any assignment and selection operations either explicitly or by reference) to enable an implementation that is unambiguously compliant with the intent of the plan, and a determination of the risk to be incurred if the plan is implemented as intended.
References: NIST: NIST SP 800-53 (v3): PM-1 a NIST: NIST SP 800-53A (v1): PM-1.1 (i)
CCI-000025 (technical): The information system enforces information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions.
References: NIST: NIST SP 800-53 (v3): AC-4 (1) NIST: NIST SP 800-53A (v1): AC-4 (1).1
CCI-000033 (policy): The information system enforces the use of human review for organization-defined security policy filters when the system is not capable of making an information flow control decision.
References: NIST: NIST SP 800-53 (v3): AC-4 (9) NIST: NIST SP 800-53A (v1): AC-4 (9).1 (ii)
CCI-000036 (policy): The organization separates organization-defined duties of individuals.
References: NIST: NIST SP 800-53 (v3): AC-5 a NIST: NIST SP 800-53 Revision 4 (v4): AC-5 a NIST: NIST SP 800-53A (v1): AC-5.1 (i)
CCI-000037 (technical): The organization implements separation of duties through assigned information system access authorizations.
References: NIST: NIST SP 800-53 (v3): AC-5 c NIST: NIST SP 800-53A (v1): AC-5.1 (iii)
CCI-000038 (policy): The organization explicitly authorizes access to organization-defined security functions and security-relevant information.
References: NIST: NIST SP 800-53 (v3): AC-6 (1) NIST: NIST SP 800-53A (v1): AC-6 (1).1 (ii)
CCI-000040 (technical): The organization audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions.
References: NIST: NIST SP 800-53 (v3): AC-6 (2) NIST: NIST SP 800-53A (v1): AC-6 (2).1 (iii)
CCI-000045 (policy): The organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period.
References: NIST: NIST SP 800-53 (v3): AC-7 b NIST: NIST SP 800-53A (v1): AC-7.1 (iii)
CCI-000046 (policy): The organization selects either a lock out mode for the organization-defined time period or delays the next login prompt for the organization-defined delay period for information system responses to consecutive invalid access attempts.
References: NIST: NIST SP 800-53 (v3): AC-7 b NIST: NIST SP 800-53A (v1): AC-7.1 (iv)
CCI-000047 (technical): The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccessful attempts is exceeded, automatically locks the account/node for an organization-defined time period or locks the account/node until released by an Administrator IAW organizational policy.
References: NIST: NIST SP 800-53 (v3): AC-7 b NIST: NIST SP 800-53A (v1): AC-7.1 (iv)
CCI-000049 (policy): The organization defines a system use notification message or banner displayed before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) use of the system indicates consent to monitoring and recording.
References: NIST: NIST SP 800-53 (v3): AC-8 a NIST: NIST SP 800-53A (v1): AC-8.1 (i)
CCI-000051 (policy): The organization approves the information system use notification message before its use.
References: NIST: NIST SP 800-53 (v3): AC-8 a NIST: NIST SP 800-53A (v1): AC-8.1 (i)
CCI-000058 (technical): The information system provides the capability for users to directly initiate session lock mechanisms.
References: NIST: NIST SP 800-53 (v3): AC-11 a NIST: NIST SP 800-53 Revision 4 (v4): AC-11 a NIST: NIST SP 800-53A (v1): AC-11
CCI-000062 (policy): The organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission/business objectives.
References: NIST: NIST SP 800-53 (v3): AC-14 (1) NIST: NIST SP 800-53A (v1): AC-14 (1).1
CCI-000063 (policy): The organization defines allowed methods of remote access to the information system.
References: NIST: NIST SP 800-53 (v3): AC-17 a NIST: NIST SP 800-53 Revision 4 (v4): AC-17 a NIST: NIST SP 800-53A (v1): AC-17.1 (i)
CCI-000064 (policy): The organization establishes usage restrictions and implementation guidance for each allowed remote access method.
References: NIST: NIST SP 800-53 (v3): AC-17 b NIST: NIST SP 800-53A (v1): AC-17.1 (ii)
CCI-000066 (technical): The organization enforces requirements for remote connections to the information system.
References: NIST: NIST SP 800-53 (v3): AC-17 e NIST: NIST SP 800-53A (v1): AC-17.1 (v)
CCI-000071 (technical): The organization monitors for unauthorized remote connections to the information system on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AC-17 (5) NIST: NIST SP 800-53A (v1): AC-17 (5).1 (ii)
CCI-000077 (policy): The organization updates the plan to address organizational changes and problems identified during plan implementation or security control assessments.
References: NIST: NIST SP 800-53 (v3): PM-1 c NIST: NIST SP 800-53 Revision 4 (v4): PM-1 c NIST: NIST SP 800-53A (v1): PM-1.1 (iv)
CCI-000079 (policy): The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information employ organization-defined additional security measures.
References: NIST: NIST SP 800-53 (v3): AC-17 (7) NIST: NIST SP 800-53A (v1): AC-17 (7).1 (iii)
CCI-000081 (policy): The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required.
References: NIST: NIST SP 800-53 (v3): PM-3 b NIST: NIST SP 800-53 Revision 4 (v4): PM-3 b NIST: NIST SP 800-53A (v1): PM-3.1 (iii)
CCI-000082 (policy): The organization establishes usage restrictions for organization-controlled mobile devices.
References: NIST: NIST SP 800-53 (v3): AC-19 a NIST: NIST SP 800-53 Revision 4 (v4): AC-19 a NIST: NIST SP 800-53A (v1): AC-19.1 (i)
CCI-000085 (technical): The organization monitors for unauthorized connections of mobile devices to organizational information systems.
References: NIST: NIST SP 800-53 (v3): AC-19 c NIST: NIST SP 800-53A (v1): AC-19.1 (iii)
CCI-000086 (technical): The organization enforces requirements for the connection of mobile devices to organizational information systems.
References: NIST: NIST SP 800-53 (v3): AC-19 d NIST: NIST SP 800-53A (v1): AC-19.1 (iv)
CCI-000087 (technical): The organization disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction.
References: NIST: NIST SP 800-53 (v3): AC-19 e NIST: NIST SP 800-53A (v1): AC-19.1 (v)
CCI-000088 (policy): The organization issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
References: NIST: NIST SP 800-53 (v3): AC-19 f NIST: NIST SP 800-53A (v1): AC-19.1 (vi)
CCI-000089 (policy): The organization applies organization-defined inspection and preventative measures to mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
References: NIST: NIST SP 800-53 (v3): AC-19 g NIST: NIST SP 800-53A (v1): AC-19.1 (viii)
CCI-000090 (policy): The organization restricts the use of writable, removable media in organizational information systems.
References: NIST: NIST SP 800-53 (v3): AC-19 (1) NIST: NIST SP 800-53A (v1): AC-19 (1).1
CCI-000091 (policy): The organization prohibits the use of personally-owned, removable media in organizational information systems.
References: NIST: NIST SP 800-53 (v3): AC-19 (2) NIST: NIST SP 800-53A (v1): AC-19 (2).1
CCI-000092 (policy): The organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner.
References: NIST: NIST SP 800-53 (v3): AC-19 (3) NIST: NIST SP 800-53A (v1): AC-19 (3).1
CCI-000094 (policy): The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process organization-controlled information using the external information systems.
References: NIST: NIST SP 800-53 (v3): AC-20 b NIST: NIST SP 800-53A (v1): AC-20.1
CCI-000095 (policy): The organization prohibits authorized individuals from using an external information system to access the information system except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.
References: NIST: NIST SP 800-53 (v3): AC-20 (1) (a) NIST: NIST SP 800-53A (v1): AC-20 (1).1
CCI-000096 (policy): The organization prohibits authorized individuals from using an external information system to access the information system or to process, store, or transmit organization-controlled information except in situations where the organization has approved information system connection or processing agreements with the organizational entity hosting the external information system.
References: NIST: NIST SP 800-53 (v3): AC-20 (1) (b) NIST: NIST SP 800-53A (v1): AC-20 (1).1
CCI-000110 (policy): The organization provides refresher role-based security training to personnel with assigned security roles and responsibilities in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AT-3 NIST: NIST SP 800-53 Revision 4 (v4): AT-3 c NIST: NIST SP 800-53A (v1): AT-3.1 (iii)
CCI-000111 (policy): The organization defines a frequency for providing refresher role-based security training.
References: NIST: NIST SP 800-53 (v3): AT-3 NIST: NIST SP 800-53 Revision 4 (v4): AT-3 c NIST: NIST SP 800-53A (v1): AT-3.1 (ii)
CCI-000115 (policy): The organization establishes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.
References: NIST: NIST SP 800-53 (v3): AT-5 NIST: NIST SP 800-53A (v1): AT-5.1
CCI-000116 (policy): The organization institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.
References: NIST: NIST SP 800-53 (v3): AT-5 NIST: NIST SP 800-53A (v1): AT-5.1
CCI-000118 (policy): The organization disseminates a formal, documented, audit and accountability policy to elements within the organization having associated audit and accountability roles and responsibilities.
References: NIST: NIST SP 800-53 (v3): AU-1 a NIST: NIST SP 800-53A (v1): AU-1.1 (iii)
CCI-000121 (policy): The organization disseminates formal, documented, procedures to elements within the organization having associated audit and accountability roles and responsibilities.
References: NIST: NIST SP 800-53 (v3): AU-1 b NIST: NIST SP 800-53A (v1): AU-1.1 (vi)
CCI-000127 (policy): The organization reviews and updates the list of organization-defined audited events on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AU-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): AU-2 (3) NIST: NIST SP 800-53A (v1): AU-2 (3).1 (ii)
CCI-000128 (policy): The organization includes execution of privileged functions in the list of events to be audited by the information system.
References: NIST: NIST SP 800-53 (v3): AU-2 (4) NIST: NIST SP 800-53A (v1): AU-2 (4).1
CCI-000129 (policy): The organization defines in the auditable events that the information system must be capable of auditing based on a risk assessment and mission/business needs.
References: NIST: NIST SP 800-53 (v3): AU-2 a NIST: NIST SP 800-53A (v1): AU-2.1 (ii)
CCI-000136 (technical): The organization centrally manages the content of audit records generated by organization-defined information system components.
References: NIST: NIST SP 800-53 (v3): AU-3 (2) NIST: NIST SP 800-53A (v1): AU-3 (2).1 (ii)
CCI-000137 (policy, technical): The organization allocates audit record storage capacity.
References: NIST: NIST SP 800-53 (v3): AU-4 NIST: NIST SP 800-53A (v1): AU-4.1 (i)
CCI-000138 (technical): The organization configures auditing to reduce the likelihood of storage capacity being exceeded.
References: NIST: NIST SP 800-53 (v3): AU-4 NIST: NIST SP 800-53A (v1): AU-4.1 (ii)
CCI-000143 (technical): The information system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.
References: NIST: NIST SP 800-53 (v3): AU-5 (1) NIST: NIST SP 800-53A (v1): AU-5 (1).1 (ii)
CCI-000144 (technical): The information system provides a real-time alert when organization-defined audit failure events occur.
References: NIST: NIST SP 800-53 (v3): AU-5 (2) NIST: NIST SP 800-53A (v1): AU-5 (2).1 (ii)
CCI-000146 (policy): The organization defines the percentage of maximum audit record storage capacity that when exceeded, a warning is provided.
References: NIST: NIST SP 800-53 (v3): AU-5 (1) NIST: NIST SP 800-53A (v1): AU-5 (1).1 (i)
CCI-000150 (policy): The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to organizational operations, organizational assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.
References: NIST: NIST SP 800-53 (v3): AU-6 b NIST: NIST SP 800-53A (v1): AU-6.2
CCI-000152 (technical): The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
References: NIST: NIST SP 800-53 (v3): AU-6 (1) NIST: NIST SP 800-53A (v1): AU-6 (1).1
CCI-000155 (policy): The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to further enhance the ability to identify inappropriate or unusual activity.
References: NIST: NIST SP 800-53 (v3): AU-6 (5) NIST: NIST SP 800-53A (v1): AU-6 (5).1
CCI-000156 (technical): The information system provides an audit reduction capability.
References: NIST: NIST SP 800-53 (v3): AU-7 NIST: NIST SP 800-53A (v1): AU-7.1
CCI-000157 (technical): The information system provides a report generation capability.
References: NIST: NIST SP 800-53 (v3): AU-7 NIST: NIST SP 800-53A (v1): AU-7.1
CCI-000160 (technical): The information system synchronizes internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.
References: NIST: NIST SP 800-53 (v3): AU-8 (1) NIST: NIST SP 800-53A (v1): AU-8 (1).1 (iii)
CCI-000161 (policy): The organization defines the frequency for the synchronization of internal information system clocks.
References: NIST: NIST SP 800-53 (v3): AU-8 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (a) NIST: NIST SP 800-53A (v1): AU-8 (1).1 (i)
CCI-000175 (policy): The organization manages information system authenticators for users and devices by verifying, as part of the initial authenticator distribution, the identity of the individual and/or device receiving the authenticator.
References: NIST: NIST SP 800-53 (v3): IA-5 a NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-000177 (policy): The organization manages information system authenticators for users and devices by establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators.
References: NIST: NIST SP 800-53 (v3): IA-5 d NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-000178 (policy): The organization manages information system authenticators for users and devices by changing default content of authenticators upon information system installation.
References: NIST: NIST SP 800-53 (v3): IA-5 e NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-000179 (policy): The organization manages information system authenticators by establishing minimum lifetime restrictions for authenticators.
References: NIST: NIST SP 800-53 (v3): IA-5 f NIST: NIST SP 800-53 Revision 4 (v4): IA-5 f NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-000180 (policy): The organization manages information system authenticators by establishing maximum lifetime restrictions for authenticators.
References: NIST: NIST SP 800-53 (v3): IA-5 f NIST: NIST SP 800-53 Revision 4 (v4): IA-5 f NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-000181 (policy): The organization manages information system authenticators by establishing reuse conditions for authenticators.
References: NIST: NIST SP 800-53 (v3): IA-5 f NIST: NIST SP 800-53 Revision 4 (v4): IA-5 f NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-000188 (policy): The organization requires that the registration process to receive an organizational-defined type of authenticator be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).
References: NIST: NIST SP 800-53 (v3): IA-5 (3) NIST: NIST SP 800-53A (v1): IA-5 (3).1 (ii)
CCI-000189 (policy): The organization employs automated tools to determine if authenticators are sufficiently strong to resist attacks intended to discover or otherwise compromise the authenticators.
References: NIST: NIST SP 800-53 (v3): IA-5 (4) NIST: NIST SP 800-53A (v1): IA-5 (4).1
CCI-000190 (policy): The organization requires vendors/manufacturers of information system components to provide unique authenticators or change default authenticators prior to delivery.
References: NIST: NIST SP 800-53 (v3): IA-5 (5) NIST: NIST SP 800-53A (v1): IA-5 (5).1
CCI-000191 (policy): The organization enforces password complexity by the number of special characters used.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-000192 (technical): The information system enforces password complexity by the minimum number of upper case characters used.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-000193 (technical): The information system enforces password complexity by the minimum number of lower case characters used.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-000194 (technical): The information system enforces password complexity by the minimum number of numeric characters used.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-000195 (technical): The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (b) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-000196 (technical): The information system, for password-based authentication, stores only cryptographically-protected passwords.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (c) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (c) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-000198 (technical): The information system enforces minimum password lifetime restrictions.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (d) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (d) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-000199 (technical): The information system enforces maximum password lifetime restrictions.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (d) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (d) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-000200 (technical): The information system prohibits password reuse for the organization-defined number of generations.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (e) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (e) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-000202 (policy): The organization ensures unencrypted static authenticators are not embedded in access scripts.
References: NIST: NIST SP 800-53 (v3): IA-5 (7) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (7) NIST: NIST SP 800-53A (v1): IA-5 (7).1
CCI-000203 (policy): The organization ensures unencrypted static authenticators are not stored on function keys.
References: NIST: NIST SP 800-53 (v3): IA-5 (7) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (7) NIST: NIST SP 800-53A (v1): IA-5 (7).1
CCI-000205 (technical): The information system enforces minimum password length.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i)
CCI-000207 (policy): The organization develops and maintains an inventory of its information systems.
References: NIST: NIST SP 800-53 (v3): PM-5 NIST: NIST SP 800-53 Revision 4 (v4): PM-5 NIST: NIST SP 800-53A (v1): PM-5.1 (i and ii)
CCI-000208 (policy): The organization determines normal time-of-day and duration usage for information system accounts.
References: NIST: NIST SP 800-53 (v3): AC-2 (5) (b) NIST: NIST SP 800-53A (v1): AC-2 (5).1 (iii)
CCI-000214 (policy): The organization establishes a Discretionary Access Control (DAC) policy that limits propagation of access rights.
References: NIST: NIST SP 800-53 (v3): AC-3 (4) (b) NIST: NIST SP 800-53A (v1): AC-3 (4).1
CCI-000215 (policy): The organization establishes a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.
References: NIST: NIST SP 800-53 (v3): AC-3 (4) (c) NIST: NIST SP 800-53A (v1): AC-3 (4).1
CCI-000218 (technical): The information system, when transferring information between different security domains, identifies information flows by data type specification and usage.
References: NIST: NIST SP 800-53 (v3): AC-4 (12) NIST: NIST SP 800-53A (v1): AC-4 (12).1
CCI-000221 (technical): The information system enforces security policies regarding information on interconnected systems.
References: NIST: NIST SP 800-53 (v3): AC-4 (16) NIST: NIST SP 800-53A (v1): AC-4 (16).1
CCI-000223 (technical): The information system binds security attributes to information to facilitate information flow policy enforcement.
References: NIST: NIST SP 800-53 (v3): AC-4 (17) (b) NIST: NIST SP 800-53A (v1): AC-4 (17).1 (v)
CCI-000224 (technical): The information system tracks problems associated with the security attribute binding.
References: NIST: NIST SP 800-53 (v3): AC-4 (17) (c) NIST: NIST SP 800-53A (v1): AC-4 (17).1 (vi)
CCI-000226 (technical): The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to support different security policies.
References: NIST: NIST SP 800-53 (v3): AC-6 (4) NIST: NIST SP 800-53A (v1): AC-6 (4).1
CCI-000229 (policy): The organization documents the security state of organizational information systems and the environments in which those systems operate through security authorization processes.
References: NIST: NIST SP 800-53 (v3): PM-10 a NIST: NIST SP 800-53 Revision 4 (v4): PM-10 a NIST: NIST SP 800-53A (v1): PM-10.1 (i)
CCI-000230 (policy): The organization tracks the security state of organizational information systems and the environments in which those systems operate through security authorization processes.
References: NIST: NIST SP 800-53 (v3): PM-10 a NIST: NIST SP 800-53 Revision 4 (v4): PM-10 a NIST: NIST SP 800-53A (v1): PM-10.1 (i)
CCI-000231 (policy): The organization reports the security state of organizational information systems and the environments in which those systems operate through security authorization processes.
References: NIST: NIST SP 800-53 (v3): PM-10 a NIST: NIST SP 800-53 Revision 4 (v4): PM-10 a NIST: NIST SP 800-53A (v1): PM-10.1 (i)
CCI-000237 (policy): The organization manages information system accounts by specifically authorizing and monitoring the use of guest/anonymous accounts and temporary accounts.
References: NIST: NIST SP 800-53 (v3): AC-2 f NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-000245 (policy): The organization develops a security assessment plan for the information system and its environment of operation.
References: NIST: NIST SP 800-53 (v3): CA-2 a NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a NIST: NIST SP 800-53A (v1): CA-2.1 (i)
CCI-000249 (policy): The organizations security assessment plan describes the assessment team.
References: NIST: NIST SP 800-53 (v3): CA-2 a NIST: NIST SP 800-53A (v1): CA-2.1 (ii)
CCI-000250 (policy): The organization's security assessment plan describes assessment roles and responsibilities.
References: NIST: NIST SP 800-53 (v3): CA-2 a NIST: NIST SP 800-53A (v1): CA-2.1 (ii)
CCI-000257 (policy): The organization authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements.
References: NIST: NIST SP 800-53 (v3): CA-3 a NIST: NIST SP 800-53 Revision 4 (v4): CA-3 a NIST: NIST SP 800-53A (v1): CA-3.1 (ii)
CCI-000260 (policy): The organization documents, for each interconnection, the nature of the information communicated.
References: NIST: NIST SP 800-53 (v3): CA-3 b NIST: NIST SP 800-53 Revision 4 (v4): CA-3 b NIST: NIST SP 800-53A (v1): CA-3.1 (iii)
CCI-000261 (policy): The organization monitors the information system connections on an ongoing basis to verify enforcement of security requirements.
References: NIST: NIST SP 800-53 (v3): CA-3 c NIST: NIST SP 800-53A (v1): CA-3.1 (iv)
CCI-000262 (policy): The organization prohibits the direct connection of an organization-defined unclassified, national security system to an external network without the use of an organization-defined boundary protection device.
References: NIST: NIST SP 800-53 (v3): CA-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (1) NIST: NIST SP 800-53A (v1): CA-3 (1).1
CCI-000263 (policy): The organization prohibits the direct connection of a classified, national security system to an external network without the use of organization-defined boundary protection device.
References: NIST: NIST SP 800-53 (v3): CA-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (2) NIST: NIST SP 800-53A (v1): CA-3 (2).1
CCI-000275 (policy): The organization implements a continuous monitoring program that includes a configuration management process for the information system.
References: NIST: NIST SP 800-53 (v3): CA-7 a NIST: NIST SP 800-53A (v1): CA-7.1 (iv)
CCI-000276 (policy): The organization implements a continuous monitoring program that includes a configuration management process for the information system constituent components.
References: NIST: NIST SP 800-53 (v3): CA-7 a NIST: NIST SP 800-53A (v1): CA-7.1 (iv)
CCI-000277 (policy): The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the information system.
References: NIST: NIST SP 800-53 (v3): CA-7 b NIST: NIST SP 800-53A (v1): CA-7.1 (iv)
CCI-000278 (policy): The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the environment of operation.
References: NIST: NIST SP 800-53 (v3): CA-7 b NIST: NIST SP 800-53A (v1): CA-7.1 (iv)
CCI-000283 (policy): The organization plans announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.
References: NIST: NIST SP 800-53 (v3): CA-7 (2) NIST: NIST SP 800-53A (v1): CA-7 (2).1 (ii)
CCI-000284 (policy): The organization schedules announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.
References: NIST: NIST SP 800-53 (v3): CA-7 (2) NIST: NIST SP 800-53A (v1): CA-7 (2).1 (ii)
CCI-000285 (policy): The organization conducts announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.
References: NIST: NIST SP 800-53 (v3): CA-7 (2) NIST: NIST SP 800-53A (v1): CA-7 (2).1 (ii)
CCI-000288 (policy): The organization disseminates formal, documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities.
References: NIST: NIST SP 800-53 (v3): CM-1 a NIST: NIST SP 800-53A (v1): CM-1.1 (iii)
CCI-000291 (policy): The organization disseminates formal, documented procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.
References: NIST: NIST SP 800-53 (v3): CM-1 b NIST: NIST SP 800-53A (v1): CM-1.1 (vi)
CCI-000293 (policy): The organization develops a current baseline configuration of the information system.
References: NIST: NIST SP 800-53 (v3): CM-2 NIST: NIST SP 800-53 Revision 4 (v4): CM-2 NIST: NIST SP 800-53A (v1): CM-2.1 (i)
CCI-000294 (policy): The organization documents a baseline configuration of the information system.
References: NIST: NIST SP 800-53 (v3): CM-2 NIST: NIST SP 800-53 Revision 4 (v4): CM-2 NIST: NIST SP 800-53A (v1): CM-2.1 (i)
CCI-000298 (policy): The organization reviews and updates the baseline configuration of the information system as an integral part of information system component installations.
References: NIST: NIST SP 800-53 (v3): CM-2 (1) (c) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (c) NIST: NIST SP 800-53A (v1): CM-2 (1).1 (ii)
CCI-000299 (policy): The organization reviews and updates the baseline configuration of the information system as an integral part of information system component upgrades.
References: NIST: NIST SP 800-53 (v3): CM-2 (1) (c) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (c) NIST: NIST SP 800-53A (v1): CM-2 (1).1 (ii)