Lexim011/Compliance huggingface dataset:
CCI-003094 (policy): Include the security functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 a NIST: NIST SP 800-53 Revision 5 (v5): SA-4 a
CCI-004687 (policy): Include the privacy functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 a
CCI-003095 (policy): Include the strength of mechanism requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 b NIST: NIST SP 800-53 Revision 5 (v5): SA-4 b
CCI-003096 (policy): Include the security assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 c NIST: NIST SP 800-53 Revision 5 (v5): SA-4 c
CCI-004688 (policy): Include the privacy assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 c
CCI-004689 (policy): Include the controls needed to satisfy security requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 d
CCI-004690 (policy): Include the controls needed to satisfy privacy requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 d
CCI-003097 (policy): Include the security documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 d NIST: NIST SP 800-53 Revision 5 (v5): SA-4 e
CCI-004691 (policy): Include the privacy documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 e
CCI-003098 (policy): Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 e NIST: NIST SP 800-53 Revision 5 (v5): SA-4 f
CCI-004692 (policy): Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 f
CCI-004693 (policy): Include the requirements for protecting privacy documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 f
CCI-003099 (policy): Include the description of the system development environment and environment in which the system is intended to operate, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 f NIST: NIST SP 800-53 Revision 5 (v5): SA-4 g
CCI-004694 (policy): Include the allocation of responsibility or identification of parties responsible for information security, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 h
CCI-004695 (policy): Include the allocation of responsibility or identification of parties responsible for information privacy, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 h
CCI-004696 (policy): Include the allocation of responsibility or identification of parties responsible for supply chain risk management, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 h
CCI-003100 (policy): Include the acceptance criteria, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 g NIST: NIST SP 800-53 Revision 5 (v5): SA-4 i
CCI-000623 (policy): Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.
References: NIST: NIST SP 800-53 (v3): SA-4 (1) NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (1) NIST: NIST SP 800-53A (v1): SA-4 (1).1
CCI-003101 (policy): Require the developer of the system, system component, or system service to provide design information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined design information at an organization-defined level of detail.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2)
CCI-003102 (policy): Require the developer of the system, system component, or system service to provide implementation information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined implementation information at an organization-defined level of detail.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2)
CCI-003103 (policy): Defines the design information that the developer of the system, system component, or system service is required to provide for the controls to be designed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2)
CCI-003104 (policy): Defines the implementation information that the developer of the system, system component, or system service is required to provide for the security controls to be implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2)
CCI-003105 (policy): Defines the level of detail for the design information of the controls that is required to be provided by the developer of the information system, system component, or information system services.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2)
CCI-003106 (policy): Defines the level of detail for the implementation information of the security controls that is required to be provided by the developer of the information system, system component, or information system services.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2)
CCI-004697 (policy): Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined systems engineering methods.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (a)
CCI-004698 (policy): Defines the systems engineering methods for demonstrating the use of a system development life cycle process.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (a)
CCI-004699 (policy): Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined system security engineering methods and/or privacy engineering methods.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (b)
CCI-004700 (policy): Defines the system security engineering methods and/or privacy engineering methods for demonstrating the use of a system development life cycle process.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (b)
CCI-004701 (policy): Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (c)
CCI-004702 (policy): Defines the software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes for demonstrating the use of a system development life cycle process.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (c)
CCI-003109 (policy): Require the developer of the system, system component, or system service to deliver the system, component, or service with organization-defined security configurations implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (5) (a)
CCI-003110 (policy): Defines the security configurations required to be implemented when the developer delivers the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (5) (a)
CCI-003111 (policy): Requires the developer of the system, system component, or system service to use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (5) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (5) (b)
CCI-000631 (policy): Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.
References: NIST: NIST SP 800-53 (v3): SA-4 (6) (a) NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (6) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (6) (a) NIST: NIST SP 800-53A (v1): SA-4 (6).1 (i)
CCI-000633 (policy): Ensure that government off-the-shelf or commercial-off-the-shelf information assurance and information assurance-enabled information technology products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.
References: NIST: NIST SP 800-53 (v3): SA-4 (6) (b) NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (6) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (6) (b) NIST: NIST SP 800-53A (v1): SA-4 (6).1 (ii)
CCI-000634 (policy): Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists.
References: NIST: NIST SP 800-53 (v3): SA-4 (7) (a) NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (7) (a) NIST: NIST SP 800-53A (v1): SA-4 (7).1 (i)
CCI-000635 (policy): Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.
References: NIST: NIST SP 800-53 (v3): SA-4 (7) (b) NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (7) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (7) (b) NIST: NIST SP 800-53A (v1): SA-4 (7).1 (ii)
CCI-003112 (policy): Require the developer of the system, system component, or system service to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (8) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (8)
CCI-003114 (policy): Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (9) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (9)
CCI-003116 (policy): Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (10) NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (10)
CCI-004703 (policy): Include organization-defined Privacy Act requirements in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (11)
CCI-004704 (policy): Defines the Privacy Act requirements to include in the acquisition contract.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (11)
CCI-004705 (policy): Include organizational data ownership requirements in the acquisition contract.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (12) (a)
CCI-004706 (policy): Require all data to be removed from the contractor's system and returned to the organization within an organization-defined time frame.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (12) (b)
CCI-004707 (policy): Defines the time frame for returning the data removed from the contractor's system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (12) (b)
CCI-003124 (policy): Obtain or develop administrator documentation for the system, system component, or system service that describes secure configuration of the system, component, or service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 1
CCI-003125 (policy): Obtain or develop administrator documentation for the system, system component, or system service that describes secure installation of the system, component, or service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 1
CCI-003126 (policy): Obtain or develop administrator documentation for the system, system component, or system service that describes secure operation of the system, component, or service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 1
CCI-003127 (policy): Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of security functions and mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 2
CCI-003128 (policy): Obtain or develop administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding configuration and use of administrative or privileged functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 3 NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 3
CCI-004708 (policy): Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of privacy functions and mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 2
CCI-003129 (policy): Obtain or develop user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms and how to effectively use those functions and mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 b 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 1
CCI-003130 (policy): Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to use the system, component, or service in a more secure manner.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 b 2 NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 2
CCI-003131 (policy): Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the security of the system, component, or service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 b 3 NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 3
CCI-004709 (policy): Obtain or develop user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms and how to effectively use those functions and mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 1
CCI-004710 (policy): Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to protect individual privacy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 2
CCI-004711 (policy): Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the privacy of individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 3
CCI-000642 (policy): Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent.
References: NIST: NIST SP 800-53 (v3): SA-5 b NIST: NIST SP 800-53 Revision 4 (v4): SA-5 c NIST: NIST SP 800-53 Revision 5 (v5): SA-5 c NIST: NIST SP 800-53A (v1): SA-5.1 (iii)
CCI-003132 (policy): Take organization-defined actions in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 c NIST: NIST SP 800-53 Revision 5 (v5): SA-5 c
CCI-003133 (policy): Defines actions to be taken in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 c NIST: NIST SP 800-53 Revision 5 (v5): SA-5 c
CCI-003135 (policy): Distribute system, system component, or system service documentation to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 e NIST: NIST SP 800-53 Revision 5 (v5): SA-5 d
CCI-003136 (policy): Defines the personnel or roles to whom system, system component, or system service documentation is to be distributed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-5 e NIST: NIST SP 800-53 Revision 5 (v5): SA-5 d
CCI-000664 (policy): Apply organization-defined systems security and privacy engineering principles in the specification of the system and system components.
References: NIST: NIST SP 800-53 (v3): SA-8 NIST: NIST SP 800-53 Revision 4 (v4): SA-8 NIST: NIST SP 800-53 Revision 5 (v5): SA-8 NIST: NIST SP 800-53A (v1): SA-8.1 (i)
CCI-000665 (policy): Apply organization-defined systems security and privacy engineering principles in the design of the system and system components.
References: NIST: NIST SP 800-53 (v3): SA-8 NIST: NIST SP 800-53 Revision 4 (v4): SA-8 NIST: NIST SP 800-53 Revision 5 (v5): SA-8 NIST: NIST SP 800-53A (v1): SA-8.1 (ii)
CCI-000666 (policy): Apply organization-defined systems security and privacy engineering principles in the development of the system and system components.
References: NIST: NIST SP 800-53 (v3): SA-8 NIST: NIST SP 800-53 Revision 4 (v4): SA-8 NIST: NIST SP 800-53 Revision 5 (v5): SA-8 NIST: NIST SP 800-53A (v1): SA-8.1 (iii)
CCI-000667 (policy): Apply organization-defined systems security and privacy engineering principles in the implementation of the system and system components.
References: NIST: NIST SP 800-53 (v3): SA-8 NIST: NIST SP 800-53 Revision 4 (v4): SA-8 NIST: NIST SP 800-53 Revision 5 (v5): SA-8 NIST: NIST SP 800-53A (v1): SA-8.1 (iv)
CCI-000668 (policy): Apply organization-defined systems security and privacy engineering principles in the modification of the system and system components.
References: NIST: NIST SP 800-53 (v3): SA-8 NIST: NIST SP 800-53 Revision 4 (v4): SA-8 NIST: NIST SP 800-53 Revision 5 (v5): SA-8 NIST: NIST SP 800-53A (v1): SA-8.1 (v)
CCI-004712 (policy): Defines the systems security and privacy engineering principles applied to the specification of the system and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8
CCI-004713 (policy): Defines the systems security engineering principles applied to the design of the system and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8
CCI-004714 (policy): Defines the systems security engineering principles applied to the development of the system and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8
CCI-004715 (policy): Defines the systems security engineering principles applied to the implementation of the system and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8
CCI-004716 (policy): Defines the systems security engineering principles applied to the modification of the system and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8
CCI-004717 (policy, technical): Implement the security design principle of clear abstractions.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (1)
CCI-004718 (policy, technical): Implement the security design principle of least common mechanism in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (2)
CCI-004719 (policy, technical): Defines the systems or system components which will implement the security design principle of least common mechanism.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (2)
CCI-004720 (policy, technical): Implement the security design principles of modularity and layering in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (3)
CCI-004721 (policy, technical): Defines the systems or system components which will implement the security design principles of modularity and layering.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (3)
CCI-004722 (policy, technical): Implement the security design principle of partially ordered dependencies in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (4)
CCI-004723 (policy, technical): Defines the systems or system components which will implement the security design principle of partially ordered dependencies.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (4)
CCI-004724 (policy, technical): Implement the security design principle of efficiently mediated access in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (5)
CCI-004725 (policy, technical): Defines the systems or system components which will implement the security design principle of efficiently mediated access.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (5)
CCI-004726 (policy, technical): Implement the security design principle of minimized sharing in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (6)
CCI-004727 (policy, technical): Defines the systems or system components which will implement the security design principle of minimized sharing.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (6)
CCI-004728 (policy, technical): Implement the security design principle of reduced complexity in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (7)
CCI-004729 (policy, technical): Defines the systems or system components which will implement the security design principle of reduced complexity.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (7)
CCI-004730 (policy, technical): Implement the security design principle of secure evolvability in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (8)
CCI-004731 (policy, technical): Defines the systems or system components which will implement the security design principle of secure evolvability.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (8)
CCI-004732 (policy, technical): Implement the security design principle of trusted components in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (9)
CCI-004733 (policy, technical): Defines the systems or system components which will implement the security design principle of trusted components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (9)
CCI-004734 (policy, technical): Implement the security design principle of hierarchical trust in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (10)
CCI-004735 (policy, technical): Defines the systems or system components which will implement the security design principle of hierarchical trust.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (10)
CCI-004736 (policy, technical): Implement the security design principle of inverse modification threshold in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (11)
CCI-004737 (policy, technical): Defines the systems or system components which will implement the security design principle of inverse modification threshold.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (11)
CCI-004738 (policy, technical): Implement the security design principle of hierarchical protection in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (12)
CCI-004739 (policy, technical): Defines the systems or system components which will implement the security design principle of hierarchical protection.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (12)
CCI-004740 (policy, technical): Implement the security design principle of minimized security elements in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (13)
CCI-004741 (policy, technical): Defines the systems or system components which will implement the security design principle of minimized security elements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (13)
CCI-004742 (policy, technical): Implement the security design principle of least privilege in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (14)
CCI-004743 (policy, technical): Defines the systems or system components which will implement the security design principle of least privilege.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (14)
CCI-004744 (policy, technical): Implement the security design principle of predicate permission in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (15)
CCI-004745 (policy, technical): Defines the systems or system components which will implement the security design principle of predicate permission.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (15)
CCI-004746 (policy, technical): Implement the security design principle of self-reliant trustworthiness in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (16)
CCI-004747 (policy, technical): Defines the systems or system components which will implement the security design principle of self-reliant trustworthiness.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (16)
CCI-004748 (policy, technical): Implement the security design principle of secure distributed composition in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (17)
CCI-004749 (policy, technical): Defines the systems or system components which will implement the security design principle of secure distributed composition.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (17)
CCI-004750 (policy, technical): Implement the security design principle of trusted communication channels in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (18)
CCI-004751 (policy, technical): Defines the systems or system components which will implement the security design principle of trusted communication channels.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (18)
CCI-004752 (policy, technical): Implement the security design principle of continuous protection in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (19)
CCI-004753 (policy, technical): Defines the systems or system components which will implement the security design principle of continuous protection.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (19)
CCI-004754 (policy, technical): Implement the security design principle of secure metadata management in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (20)
CCI-004755 (policy, technical): Defines the systems or system components which will implement the security design principle of secure metadata management.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (20)
CCI-004756 (policy, technical): Implement the security design principle of self-analysis in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (21)
CCI-004757 (policy, technical): Defines the systems or system components which will implement the security design principle of self-analysis.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (21)
CCI-004758 (policy, technical): Implement the security design principle of accountability and traceability in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (22)
CCI-004759 (policy, technical): Defines the systems or system components which will implement the security design principle of accountability and traceability.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (22)
CCI-004760 (policy, technical): Implement the security design principle of secure defaults in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (23)
CCI-004761 (policy, technical): Defines the systems or system components which will implement the security design principle of secure defaults.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (23)
CCI-004762 (policy, technical): Implement the security design principle of secure failure and recovery in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (24)
CCI-004763 (policy, technical): Defines the systems or system components which will implement the security design principle of secure failure and recovery.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (24)
CCI-004764 (policy, technical): Implement the security design principle of economic security in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (25)
CCI-004765 (policy, technical): Defines the systems or system components which will implement the security design principle of economic security.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (25)
CCI-004766 (policy, technical): Implement the security design principle of performance security in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (26)
CCI-004767 (policy, technical): Defines the systems or system components which will implement the security design principle of performance security.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (26)
CCI-004768 (policy, technical): Implement the security design principle of human factored security in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (27)
CCI-004769 (policy, technical): Defines the systems or system components which will implement the security design principle of human factored security.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (27)
CCI-004770 (policy, technical): Implement the security design principle of acceptable security in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (28)
CCI-004771 (policy, technical): Defines the systems or system components which will implement the security design principle of acceptable security.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (28)
CCI-004772 (policy, technical): Implement the security design principle of repeatable and documented procedures in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (29)
CCI-004773 (policy, technical): Defines the systems or system components which will implement the security design principle of repeatable and documented procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (29)
CCI-004774 (policy, technical): Implement the security design principle of procedural rigor in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (30)
CCI-004775 (policy, technical): Defines the systems or system components which will implement the security design principle of procedural rigor.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (30)
CCI-004776 (policy, technical): Implement the security design principle of secure system modification in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (31)
CCI-004777 (policy, technical): Defines the systems or system components which will implement the security design principle of secure system modification.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (31)
CCI-004778 (policy, technical): Implement the security design principle of sufficient documentation in organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (32)
CCI-004779 (policy, technical): Defines the systems or system components which will implement the security design principle of sufficient documentation.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (32)
CCI-004780 (policy, technical): Implement the privacy principle of minimization using organization-defined processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (33)
CCI-004781 (policy, technical): Defines the processes for implementing the privacy principle of minimization.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (33)
CCI-000669 (policy): Require that providers of external system services comply with organizational security requirements.
References: NIST: NIST SP 800-53 (v3): SA-9 a NIST: NIST SP 800-53 Revision 4 (v4): SA-9 a NIST: NIST SP 800-53 Revision 5 (v5): SA-9 NIST: NIST SP 800-53A (v1): SA-9.1 (i)
CCI-004782 (policy): Require that providers of external system services comply with organizational privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 a
CCI-004783 (policy): Require that providers of external system services employ organization-defined controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 a
CCI-004784 (policy): Defines the controls for complying with organizational security and privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 a
CCI-004785 (policy): Define and document organizational oversight with regard to external system services.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 b
CCI-004786 (policy): Define and document user roles and responsibilities with regard to external system services.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 b
CCI-003138 (policy): Employ organization-defined processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 c NIST: NIST SP 800-53 Revision 5 (v5): SA-9 c
CCI-003139 (policy): Defines processes, methods, and techniques to employ to monitor control compliance by external service providers on an ongoing basis.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 c NIST: NIST SP 800-53 Revision 5 (v5): SA-9 c
CCI-003140 (policy): Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (1) (a)
CCI-003141 (policy): Verify that the acquisition or outsourcing of dedicated information security services is approved by organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (1) (b)
CCI-003142 (policy): Defines the personnel or roles authorized to approve the acquisition or outsourcing of dedicated information security services.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (1) (b)
CCI-003143 (policy): Require providers of organization-defined external system services to identify the functions, ports, protocols, and other services required for the use of such services.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (2)
CCI-003144 (policy): Defines the external system services for which the providers are required to identify the functions, ports, protocols, and other services required for the use of such services.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (2)
CCI-003145 (policy): Establish trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3)
CCI-003146 (policy): Document trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3)
CCI-003147 (policy): Maintain trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3)
CCI-003148 (policy): Defines security requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3)
CCI-004787 (policy): Establish trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3)
CCI-004788 (policy): Document trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3)
CCI-004789 (policy): Maintain trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3)
CCI-004790 (policy): Defines privacy requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3)
CCI-003149 (policy): Take organization-defined actions to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (4) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (4)
CCI-003150 (policy): Defines the actions taken to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (4) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (4)
CCI-003151 (policy): Defines external service providers whose interests are consistent with and reflect organizational interests.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (4) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (4)
CCI-003152 (policy): Restrict the location of information processing, information or data, and/or system services to organization-defined locations based on organization-defined requirements or conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (5) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (5)
CCI-003153 (policy): Defines the locations for which to restrict information processing, information or data, and/or system services based on organization-defined requirements or conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (5) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (5)
CCI-003154 (policy): Defines the requirements or conditions on which to base restricting the location of information processing, information or data, and/or system services to organization-defined locations.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (5) NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (5)
CCI-004791 (policy): Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (6)
CCI-004792 (policy): Provide the capability to check the integrity of organizational information while it resides in the external system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (7)
CCI-004793 (policy): Restrict the geographic location of information processing and data storage to facilities located within the legal jurisdictional boundary of the United States.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (8)
CCI-003155 (policy): Require the developer of the system, system component, or system service to perform configuration management during system, component, or service design, development, implementation, operation and/or disposal.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 a NIST: NIST SP 800-53 Revision 5 (v5): SA-10 a
CCI-003156 (policy): Require the developer of the system, system component, or system service to document the integrity of changes to organization-defined configuration items under configuration management.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 b NIST: NIST SP 800-53 Revision 5 (v5): SA-10 b
CCI-003157 (policy): Require the developer of the system, system component, or system service to manage the integrity of changes to organization-defined configuration items under configuration management.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 b NIST: NIST SP 800-53 Revision 5 (v5): SA-10 b
CCI-003158 (policy): Require the developer of the system, system component, or system service to control the integrity of changes to organization-defined configuration items under configuration management.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 b NIST: NIST SP 800-53 Revision 5 (v5): SA-10 b
CCI-003159 (policy): Defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 b NIST: NIST SP 800-53 Revision 5 (v5): SA-10 b
CCI-000692 (policy): Require the developer of the system, system component, or system service to implement only organization-approved changes to the system, component, or service.
References: NIST: NIST SP 800-53 (v3): SA-10 (c) NIST: NIST SP 800-53 Revision 4 (v4): SA-10 c NIST: NIST SP 800-53 Revision 5 (v5): SA-10 c NIST: NIST SP 800-53A (v1): SA-10.1 (iii)
CCI-000694 (policy): Require the developer of the system, system component, or system service to document approved changes to the system, component, or service.
References: NIST: NIST SP 800-53 (v3): SA-10 (d) NIST: NIST SP 800-53 Revision 4 (v4): SA-10 d NIST: NIST SP 800-53 Revision 5 (v5): SA-10 d NIST: NIST SP 800-53A (v1): SA-10.1 (iv)
CCI-003160 (policy): Require the developer of the system, system component, or system service to document the potential security impacts of approved changes to the system, component, or service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 d NIST: NIST SP 800-53 Revision 5 (v5): SA-10 d
CCI-004794 (policy): Require the developer of the system, system component, or system service to document the potential privacy impacts of approved changes to the system, component, or service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-10 d
CCI-003161 (policy): Require the developer of the system, system component, or system service to track security flaws within the system, component, or service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 e NIST: NIST SP 800-53 Revision 5 (v5): SA-10 e
CCI-003162 (policy): Require the developer of the system, system component, or system service to track flaw resolution within the system, component, or service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 e NIST: NIST SP 800-53 Revision 5 (v5): SA-10 e
CCI-003163 (policy): Require the developer of the system, system component, or system service to report findings of security flaws and flaw resolution within the system, component, or service to organization-defined personnel.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 e NIST: NIST SP 800-53 Revision 5 (v5): SA-10 e
CCI-003164 (policy): Defines the personnel to whom security flaw findings and flaw resolution within the system, component, or service are reported.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 e NIST: NIST SP 800-53 Revision 5 (v5): SA-10 e
CCI-000698 (policy): Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.
References: NIST: NIST SP 800-53 (v3): SA-10 (1) NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (1) NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (1) NIST: NIST SP 800-53A (v1): SA-10 (1).1