Lexim011/Compliance huggingface dataset:
CCI-004564 (policy): Defines the mechanisms for allowing individuals to tailor processing permissions to selected elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (1)
CCI-004565 (policy): Present organization-defined consent mechanisms to individuals at an organization-defined frequency and in conjunction with organization-defined personally identifiable information processing.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (2)
CCI-004566 (policy): Defines the frequency for presenting organization-defined consent mechanisms to individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (2)
CCI-004567 (policy): Defines the consent mechanisms needed by individuals on an organization-defined frequency, with organization-defined personally identifiable information processing.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (2)
CCI-004568 (policy): Defines the personally identifiable information processing needed for presenting organization-defined consent mechanisms to individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (2)
CCI-004569 (policy): Implement organization-defined tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (3)
CCI-004570 (policy): Defines the tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (3)
CCI-004571 (policy): Provide notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization, and subsequently at an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 a
CCI-004572 (policy): Defines the frequency for providing notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 a
CCI-004573 (policy): Provide notice to individuals about the processing of personally identifiable information is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 b
CCI-004574 (policy): Provide notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 c
CCI-004575 (policy): Provide notice to individuals about the processing of personally identifiable information that identifies the purposes for which personally identifiable information is to be processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 d
CCI-004576 (policy): Provide notice to individuals about the processing of personally identifiable information that includes organization-defined information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 e
CCI-004577 (policy): Defines the information that includes providing notice to individuals about the processing of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 e
CCI-004578 (policy): Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action or organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 (1)
CCI-004579 (policy): Defines the frequency for presenting notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 (1)
CCI-004580 (policy): Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-5 (2)
CCI-004581 (policy): For systems that process information that will be maintained in a Privacy Act system of records: draft system of records notices in accordance with OMB guidance.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 a
CCI-004582 (policy): For systems that process information that will be maintained in a Privacy Act system of records: submit new and significantly modified system of records notices to the OMB and appropriate committees for advance review.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 a
CCI-004583 (policy): For systems that process information that will be maintained in a Privacy Act system of records: publish system of records notices in the Federal Register.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 b
CCI-004584 (policy): For systems that process information that will be maintained in a Privacy Act system of records: keep system of records notices accurate, up-to-date, and scoped in accordance with policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 c
CCI-004585 (policy): Review all routine uses published in the system of records notice at an organization-defined frequency to ensure continued accuracy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (1)
CCI-004586 (policy): Defines the frequency for reviewing all routine uses in published in the system of records notice.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (1)
CCI-004587 (policy): Review all routine uses published in the system of records notice at an organization-defined frequency to ensure that routine uses continue to be compatible with the purpose for which the information was collected.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (1)
CCI-004588 (policy): Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they remain appropriate and necessary with law.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (2)
CCI-004589 (policy): Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they have been promulgated as regulations.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (2)
CCI-004590 (policy): Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure that they are accurately described in the system of records notice.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (2)
CCI-004591 (policy): Defines the frequency for reviewing all Privacy Act exemptions claimed for the system of records.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (2)
CCI-004592 (policy): Apply organization-defined processing conditions for specific categories of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-7
CCI-004593 (policy): Defines the processing conditions for applying specific categories of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-7
CCI-004594 (policy): When a system processes Social Security numbers: eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-7 (1) (a)
CCI-004595 (policy): When a system processes Social Security numbers: do not deny any individuals any right, benefit, or privilege provided by law because of such individuals' refusal to disclose his or her Social Security number.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-7 (1) (b)
CCI-004596 (policy): When a system processes Social Security numbers: inform any individual who is asked to disclose his or Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-7 (1) (c)
CCI-004597 (policy): Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statue or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-7 (2)
CCI-004598 (policy): When a system or organization processes information for the purpose of conducting a matching program: obtain approval from the Data Integrity Board to conduct the matching program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-8 a
CCI-004599 (policy): When a system or organization processes information for the purpose of conducting a matching program: develop and enter into a computer matching agreement.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-8 b
CCI-004600 (policy): When a system or organization processes information for the purpose of conducting a matching program: publish a matching notice in the Federal Register.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-8 c
CCI-004601 (policy): When a system or organization processes information for the purpose of conducting a matching program: independently verify the information produced by the matching program before taking adverse action against an individual, if required.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-8 d
CCI-004602 (policy): When a system or organization processes information for the purpose of conducting a matching program: provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.
References: NIST: NIST SP 800-53 Revision 5 (v5): PT-8 e
CCI-001037 (policy): Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): RA-1 a NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (a) NIST: NIST SP 800-53A (v1): RA-1.1 (i) (ii)
CCI-001038 (policy): Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): RA-1 a NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (a) NIST: NIST SP 800-53A (v1): RA-1.1 (iii)
CCI-001041 (policy): Develop and document procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls.
References: NIST: NIST SP 800-53 (v3): RA-1 b NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 2 NIST: NIST SP 800-53A (v1): RA-1.1 (iv) (v)
CCI-001042 (policy): Disseminate risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): RA-1 b NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 2 NIST: NIST SP 800-53A (v1): RA-1.1 (vi)
CCI-002368 (policy): Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level risk assessment policy is disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (a)
CCI-002369 (policy): Defines the personnel or roles to whom the risk assessment procedures are disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 2
CCI-004603 (policy): Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (b)
CCI-004604 (policy): Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines, to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (b)
CCI-004605 (policy): Designate an organization-defined official to manage the development and documentation of the risk assessment policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b
CCI-004606 (policy): Designate an organization-defined official to manage the dissemination of the risk assessment policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b
CCI-004607 (policy): Designate an organization-defined official to manage development and documentation of the risk assessment procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b
CCI-004608 (policy): Designate an organization-defined official to manage dissemination of the risk assessment procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b
CCI-004609 (policy): Defines the official designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b
CCI-001039 (policy): Review and update the current risk assessment policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): RA-1 a NIST: NIST SP 800-53 Revision 4 (v4): RA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 1 NIST: NIST SP 800-53A (v1): RA-1.2 (ii)
CCI-001040 (policy): Defines the frequency with which to review and update the current risk assessment policy.
References: NIST: NIST SP 800-53 (v3): RA-1 a NIST: NIST SP 800-53 Revision 4 (v4): RA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 1 NIST: NIST SP 800-53A (v1): RA-1.2 (i)
CCI-001043 (policy): Review and update the current risk assessment procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): RA-1 b NIST: NIST SP 800-53 Revision 4 (v4): RA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 2 NIST: NIST SP 800-53A (v1): RA-1.2 (iv)
CCI-001044 (policy): Defines the frequency with which to review and update the current risk assessment procedures.
References: NIST: NIST SP 800-53 (v3): RA-1 b NIST: NIST SP 800-53 Revision 4 (v4): RA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 2 NIST: NIST SP 800-53A (v1): RA-1.2 (iii)
CCI-004610 (policy): Review and update the current risk assessment policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 1
CCI-004611 (policy): Defines the events following reviewing and updating the current risk assessment policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 1
CCI-004612 (policy): Review and update the current risk assessment procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 2
CCI-004613 (policy): Defines the events following reviewing and updating the current risk assessment procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 2
CCI-004614 (policy): Categorize the system and information it processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-2 a
CCI-004615 (policy): Categorize the system and information it stores.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-2 a
CCI-004616 (policy): Categorize the system and information it transmits.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-2 a
CCI-001046 (policy): Document the security categorization results including supporting rationale in the security plan for the system.
References: NIST: NIST SP 800-53 (v3): RA-2 b NIST: NIST SP 800-53 Revision 4 (v4): RA-2 b NIST: NIST SP 800-53 Revision 5 (v5): RA-2 b NIST: NIST SP 800-53A (v1): RA-2.1 (ii)
CCI-001047 (policy): Verify the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.
References: NIST: NIST SP 800-53 (v3): RA-2 c NIST: NIST SP 800-53 Revision 4 (v4): RA-2 c NIST: NIST SP 800-53 Revision 5 (v5): RA-2 c NIST: NIST SP 800-53A (v1): RA-2.1 (iii)
CCI-004617 (policy): Conduct a impact-level categorization of organizational systems to obtain additional granularity on system impact levels.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-2 (1)
CCI-001048 (policy): Conduct a risk assessment, including determining the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information.
References: NIST: NIST SP 800-53 (v3): RA-3 a NIST: NIST SP 800-53 Revision 4 (v4): RA-3 a NIST: NIST SP 800-53 Revision 5 (v5): RA-3 a 2 NIST: NIST SP 800-53A (v1): RA-3.1 (i)
CCI-004618 (policy): Conduct a risk assessment, including identifying threats to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 a 1
CCI-004619 (policy): Conduct a risk assessment, including identifying vulnerabilities in the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 a 1
CCI-004620 (policy): Conduct a risk assessment, including determining the likelihood and impact of adverse effects on individuals arising from the processing of personally-identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 a 3
CCI-004621 (policy): Integrate risk assessment results from the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 b
CCI-004622 (policy): Integrate risk management decisions from the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 b
CCI-004623 (policy): Integrate mission or business process perspectives with system-level risk assessments.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 b
CCI-001049 (policy): Document risk assessment results in the organization-defined document.
References: NIST: NIST SP 800-53 (v3): RA-3 b NIST: NIST SP 800-53 Revision 4 (v4): RA-3 b NIST: NIST SP 800-53 Revision 5 (v5): RA-3 c NIST: NIST SP 800-53A (v1): RA-3.1 (iii)
CCI-001642 (policy): Defines the organizational document in which risk assessment results are documented (e.g., security plan, privacy plan; risk assessment report).
References: NIST: NIST SP 800-53 (v3): RA-3 b NIST: NIST SP 800-53 Revision 4 (v4): RA-3 b NIST: NIST SP 800-53 Revision 5 (v5): RA-3 c NIST: NIST SP 800-53A (v1): RA-3.1 (ii)
CCI-001050 (policy): Review risk assessment results on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): RA-3 c NIST: NIST SP 800-53 Revision 4 (v4): RA-3 c NIST: NIST SP 800-53 Revision 5 (v5): RA-3 d NIST: NIST SP 800-53A (v1): RA-3.1 (v)
CCI-001051 (policy): Defines a frequency for reviewing risk assessment results.
References: NIST: NIST SP 800-53 (v3): RA-3 c NIST: NIST SP 800-53 Revision 4 (v4): RA-3 c NIST: NIST SP 800-53 Revision 5 (v5): RA-3 d NIST: NIST SP 800-53A (v1): RA-3.1 (iv)
CCI-002370 (policy): Disseminate risk assessment results to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-3 d NIST: NIST SP 800-53 Revision 5 (v5): RA-3 e
CCI-002371 (policy): Defines the personnel or roles to whom the risk assessment results will be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-3 d NIST: NIST SP 800-53 Revision 5 (v5): RA-3 e
CCI-001052 (policy): Update the risk assessment on an organization-defined frequency or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.
References: NIST: NIST SP 800-53 (v3): RA-3 d NIST: NIST SP 800-53 Revision 4 (v4): RA-3 e NIST: NIST SP 800-53 Revision 5 (v5): RA-3 f NIST: NIST SP 800-53A (v1): RA-3
CCI-001053 (policy): Defines a frequency for updating the risk assessment.
References: NIST: NIST SP 800-53 (v3): RA-3 d NIST: NIST SP 800-53 Revision 4 (v4): RA-3 e NIST: NIST SP 800-53 Revision 5 (v5): RA-3 f NIST: NIST SP 800-53A (v1): RA-3
CCI-004624 (policy): Assess supply chain risks associated with organization-defined systems, system components, and system services.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (1) (a)
CCI-004625 (policy): Defines the systems, system-components, and system services for assessing supply chain risks.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (1) (a)
CCI-004626 (policy): Update the supply chain risk assessment on an organization-defined frequency when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (1) (b)
CCI-004627 (policy): Defines the frequency for updating the supply chain assessment.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (1) (b)
CCI-004628 (policy): Use all-source intelligence to assist in the analysis of risk.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (2)
CCI-004629 (policy): Determine the current cyber threat environment on an ongoing basis using organization-defined means.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (3)
CCI-004630 (policy): Defines the means for determining the current threat environment.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (3)
CCI-004631 (policy): Employ organization-defined advanced automation and analytics capabilities to predict and identify risks to organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (4)
CCI-004632 (policy): Defines the advanced automation and analytics capabilities for predicting and identifying risks to organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (4)
CCI-004633 (policy): Defines the systems or system components for employing advanced automation and analytics capabilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (4)
CCI-001054 (policy): Monitor and scan for vulnerabilities in the system and hosted applications on an organization-defined frequency and/or randomly in accordance with organization-defined process.
References: NIST: NIST SP 800-53 (v3): RA-5 a NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a NIST: NIST SP 800-53A (v1): RA-5.1 (ii)
CCI-001055 (policy): Defines a frequency for scanning for vulnerabilities in the system and hosted applications, and/or randomly in accordance with organization-defined process.
References: NIST: NIST SP 800-53 (v3): RA-5 a NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a NIST: NIST SP 800-53A (v1): RA-5.1 (i)
CCI-001056 (policy): Monitor and scan for vulnerabilities in the system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported.
References: NIST: NIST SP 800-53 (v3): RA-5 a NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a NIST: NIST SP 800-53A (v1): RA-5.1 (iii)
CCI-001641 (policy): Defines the process for conducting random vulnerability scans on the system and hosted applications.
References: NIST: NIST SP 800-53 (v3): RA-5 a NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a NIST: NIST SP 800-53A (v1): RA-5.1 (i)
CCI-001643 (policy): Monitor and scan for vulnerabilities in the system and hosted applications in accordance with the organization-defined process for random scans.
References: NIST: NIST SP 800-53 (v3): RA-5 b NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a NIST: NIST SP 800-53A (v1): RA-5.1 (ii)
CCI-001057 (policy): Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating platforms, software flaws, and improper configurations.
References: NIST: NIST SP 800-53 (v3): RA-5 b NIST: NIST SP 800-53 Revision 4 (v4): RA-5 b NIST: NIST SP 800-53 Revision 5 (v5): RA-5 b 1 NIST: NIST SP 800-53A (v1): RA-5.1 (iv)
CCI-004634 (policy): Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: formatting checklists and test procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-5 b 2
CCI-004635 (policy): Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: measuring vulnerability impact.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-5 b 3
CCI-001058 (policy): Analyze vulnerability scan reports and results from vulnerability monitoring.
References: NIST: NIST SP 800-53 (v3): RA-5 c NIST: NIST SP 800-53 Revision 4 (v4): RA-5 c NIST: NIST SP 800-53 Revision 5 (v5): RA-5 c NIST: NIST SP 800-53A (v1): RA-5.1 (v)
CCI-001059 (policy): Remediate legitimate vulnerabilities in organization-defined response times in accordance with an organizational assessment risk.
References: NIST: NIST SP 800-53 (v3): RA-5 d NIST: NIST SP 800-53 Revision 4 (v4): RA-5 d NIST: NIST SP 800-53 Revision 5 (v5): RA-5 d NIST: NIST SP 800-53A (v1): RA-5.2 (ii)
CCI-001060 (policy): Defines response times for remediating legitimate vulnerabilities in accordance with an organization assessment of risk.
References: NIST: NIST SP 800-53 (v3): RA-5 d NIST: NIST SP 800-53 Revision 4 (v4): RA-5 d NIST: NIST SP 800-53 Revision 5 (v5): RA-5 d NIST: NIST SP 800-53A (v1): RA-5.2 (i)
CCI-001061 (policy): Share information obtained from the vulnerability monitoring process and control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other systems.
References: NIST: NIST SP 800-53 (v3): RA-5 e NIST: NIST SP 800-53 Revision 4 (v4): RA-5 e NIST: NIST SP 800-53 Revision 5 (v5): RA-5 e NIST: NIST SP 800-53A (v1): RA-5.2 (iii)
CCI-002376 (policy): Defines the personnel or roles with whom the information obtained from the vulnerability monitoring process and control assessments will be shared.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-5 e NIST: NIST SP 800-53 Revision 5 (v5): RA-5 e
CCI-004636 (policy): Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-5 f
CCI-001063 (policy): Update the system vulnerabilities scanned on an organization-defined frequency, prior to a new scan, and/or when new vulnerabilities are identified and reported.
References: NIST: NIST SP 800-53 (v3): RA-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (2) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (2) NIST: NIST SP 800-53A (v1): RA-5 (2).1 (ii)
CCI-001064 (policy): Defines a frequency for updating the system vulnerabilities scanned.
References: NIST: NIST SP 800-53 (v3): RA-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (2) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (2) NIST: NIST SP 800-53A (v1): RA-5 (2).1 (i)
CCI-002373 (policy): Define the breadth and depth of vulnerability scanning coverage.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (3) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (3)
CCI-001066 (policy): Determine information about the system that is discoverable.
References: NIST: NIST SP 800-53 (v3): RA-5 (4) NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (4) NIST: NIST SP 800-53A (v1): RA-5 (4).1
CCI-002374 (policy): Defines the corrective actions if unintended information about the system is discovered.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (4)
CCI-002375 (policy): Take organization-defined corrective actions if information about the system is discovered.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (4)
CCI-001067 (technical): Implement privileged access authorization to organization-identified system components for organization-defined vulnerability scanning activities.
References: NIST: NIST SP 800-53 (v3): RA-5 (5) NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (5) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (5) NIST: NIST SP 800-53A (v1): RA-5 (5).1 (ii)
CCI-001645 (policy): Defines the system components to which privileged access is authorized for organization-defined vulnerability scanning activities.
References: NIST: NIST SP 800-53 (v3): RA-5 (5) NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (5) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (5) NIST: NIST SP 800-53A (v1): RA-5 (5).1 (i)
CCI-002906 (policy): Defines the vulnerability scanning activities in which the system implements privileged access authorization to organization-identified information system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (5) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (5)
CCI-001068 (policy): Compare the results of multiple vulnerability scans using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): RA-5 (6) NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (6) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (6) NIST: NIST SP 800-53A (v1): RA-5 (6).1
CCI-004637 (policy): Defines the automated mechanisms for comparing the results of multiple vulnerability scans.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (6)
CCI-001071 (policy): Review historic audit logs to determine if a vulnerability identified in the organization-defined system has been previously exploited within an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): RA-5 (8) NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (8) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (8) NIST: NIST SP 800-53A (v1): RA-5 (8).1
CCI-004638 (policy): Defines the system in which will be identified for determining if a vulnerability has been exploited.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (8)
CCI-004639 (policy): Defines the time period for reviewing historic audit logs to determine if a vulnerability identified has been exploited.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (8)
CCI-002372 (policy): Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (10) NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (10)
CCI-004640 (policy): Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (11)
CCI-003119 (policy): Employ a technical surveillance countermeasures survey at organization-defined locations on an organization-defined frequency or when organization-defined events or indicators occur.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-6 NIST: NIST SP 800-53 Revision 5 (v5): RA-6
CCI-003120 (policy): Defines the locations where technical surveillance countermeasures surveys are to be employed.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-6 NIST: NIST SP 800-53 Revision 5 (v5): RA-6
CCI-003121 (policy): Defines the frequency on which to employ technical surveillance countermeasures surveys.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-6 NIST: NIST SP 800-53 Revision 5 (v5): RA-6
CCI-003122 (policy): Defines the events or indicators upon which technical surveillance countermeasures surveys are to be employed.
References: NIST: NIST SP 800-53 Revision 4 (v4): RA-6 NIST: NIST SP 800-53 Revision 5 (v5): RA-6
CCI-004641 (policy): Respond to findings from security assessments.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-7
CCI-004642 (policy): Respond to findings from privacy assessments.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-7
CCI-004643 (policy): Respond to findings from monitoring.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-7
CCI-004644 (policy): Respond to findings from audits in accordance with organizational risk tolerance.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-7
CCI-004645 (policy): Conduct privacy impact assessments for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-8 a
CCI-004646 (policy): Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that will be processes using information technology.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-8 b 1
CCI-004647 (policy): Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more persons, other than agencies, instrumentalities, or employees of the Federal Government.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-8 b 2
CCI-004648 (policy): Identify critical system components and functions by performing a criticality analysis for organization-defined systems, system components, or system services at organization-defined decision points in the system development life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-9
CCI-004649 (policy): Defines the system, system components, or system services to perform a criticality analysis for identifying critical system components and functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-9
CCI-004650 (policy): Defines the decision points in the system development life cycle at which organization-defined system, system components, or system services to perform a criticality analysis for identifying critical system components and functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-9
CCI-004651 (policy, technical): Establish and maintain a cyber threat hunting capability to search for indicators of compromise in organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-10 a 1
CCI-004652 (policy, technical): Establish and maintain a cyber threat hunting capability to detect, track, and disrupt threats that evade existing controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-10 a 2
CCI-004653 (policy, technical): Employ the threat hunting capability on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-10 b
CCI-004654 (policy, technical): Defines the frequency for employing the threat hunting capability.
References: NIST: NIST SP 800-53 Revision 5 (v5): RA-10 b
CCI-000602 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): SA-1 a NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 1 (a) NIST: NIST SP 800-53A (v1): SA-1.1 (i) (ii)
CCI-000603 (policy): Disseminate to organization-defined personnel or roles an organization-level; mission/business process-level; and/or system-level system and services acquisition policy.
References: NIST: NIST SP 800-53 (v3): SA-1 a NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 1 NIST: NIST SP 800-53A (v1): SA-1.1 (iii)
CCI-000605 (policy): Develop and document procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.
References: NIST: NIST SP 800-53 (v3): SA-1 b NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 2 NIST: NIST SP 800-53A (v1): SA-1.1 (iv) (v)
CCI-000606 (policy): Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.
References: NIST: NIST SP 800-53 (v3): SA-1 b NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 2 NIST: NIST SP 800-53A (v1): SA-1.1 (vi)
CCI-003089 (policy): Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level system and services acquisition policy is disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 1 (a)
CCI-003090 (policy): Defines the personnel or roles to whom procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 2
CCI-004655 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that is consistent with applicable laws, Executive Orders, directives, regulations, polices, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 1 (b)
CCI-004656 (policy): Designate an organization-defined official to manage development and documentation of the system and services acquisition policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b
CCI-004657 (policy): Designate an organization-defined official to manage dissemination of the system and services acquisition policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b
CCI-004658 (policy): Defines the official designated to manage development and documentation of the system and services acquisition policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b
CCI-004659 (policy): Designate an organization-defined official to manage the development and documentation of the system and services acquisition procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b
CCI-004660 (policy): Designate an organization-defined official to manage the dissemination of the system and services acquisition procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b
CCI-004661 (policy): Defines the official designated to manage the system and services acquisition procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b
CCI-000601 (policy): Defines the frequency with which to review and update the current system and services acquisition policy.
References: NIST: NIST SP 800-53 (v3): SA-1 NIST: NIST SP 800-53 Revision 4 (v4): SA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 1 NIST: NIST SP 800-53A (v1): SA-1.2 (i)
CCI-000604 (policy): Review and update the current system and services acquisition policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SA-1 a NIST: NIST SP 800-53 Revision 4 (v4): SA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 1 NIST: NIST SP 800-53A (v1): SA-1.2 (ii)
CCI-000607 (policy): Review and update the current system and services acquisition procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SA-1 b NIST: NIST SP 800-53 Revision 4 (v4): SA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 2 NIST: NIST SP 800-53A (v1): SA-1.2 (iv)
CCI-001646 (policy): Defines the frequency with which to review and update the current system and services acquisition procedures.
References: NIST: NIST SP 800-53 (v3): SA-1 NIST: NIST SP 800-53 Revision 4 (v4): SA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 2 NIST: NIST SP 800-53A (v1): SA-1.2 (iii)
CCI-004662 (policy): Review and update the current system and services acquisition policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 1
CCI-004663 (policy): Defines the events following reviewing and updating the current system and services acquisition policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 1
CCI-004664 (policy): Review and update the current system and services acquisition procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 2
CCI-004665 (policy): Defines the events following reviewing and updating the current system and services acquisition procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 2
CCI-003091 (policy): Determine the high-level information security requirements for the system or system service in mission and business process planning.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-2 a NIST: NIST SP 800-53 Revision 5 (v5): SA-2 a
CCI-004666 (policy): Determine the high-level information privacy requirements for the system or system service in mission and business process planning.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-2 a
CCI-000610 (policy): Determine the resources required to protect the system or system service as part of the organizational capital planning and investment control process.
References: NIST: NIST SP 800-53 (v3): SA-2 b NIST: NIST SP 800-53 Revision 4 (v4): SA-2 b NIST: NIST SP 800-53 Revision 5 (v5): SA-2 b NIST: NIST SP 800-53A (v1): SA-2.1 (ii)
CCI-000611 (policy): Document the resources required to protect the system or system service as part of the organizational capital planning and investment control process.
References: NIST: NIST SP 800-53 (v3): SA-2 b NIST: NIST SP 800-53 Revision 4 (v4): SA-2 b NIST: NIST SP 800-53 Revision 5 (v5): SA-2 b NIST: NIST SP 800-53A (v1): SA-2.1 (ii)
CCI-000612 (policy): Allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process.
References: NIST: NIST SP 800-53 (v3): SA-2 b NIST: NIST SP 800-53 Revision 4 (v4): SA-2 b NIST: NIST SP 800-53 Revision 5 (v5): SA-2 b NIST: NIST SP 800-53A (v1): SA-2.1 (ii)
CCI-000613 (policy): Establish a discrete line item for information security in organizational programming documentation.
References: NIST: NIST SP 800-53 (v3): SA-2 c NIST: NIST SP 800-53 Revision 4 (v4): SA-2 c NIST: NIST SP 800-53 Revision 5 (v5): SA-2 c NIST: NIST SP 800-53A (v1): SA-2.1 (iii)
CCI-000614 (policy): Establish a discrete line item for information security in organizational budgeting documentation.
References: NIST: NIST SP 800-53 (v3): SA-2 c NIST: NIST SP 800-53 Revision 4 (v4): SA-2 c NIST: NIST SP 800-53 Revision 5 (v5): SA-2 c NIST: NIST SP 800-53A (v1): SA-2.1 (iii)
CCI-004667 (policy): Establish a discrete line item for information privacy in organizational programming documentation.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-2 c
CCI-004668 (policy): Establish a discrete line item for information privacy in organizational budgeting documentation.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-2 c
CCI-000615 (policy): Manage the system using an organization-defined system development life cycle that incorporates information security considerations.
References: NIST: NIST SP 800-53 (v3): SA-3 a NIST: NIST SP 800-53 Revision 4 (v4): SA-3 a NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a NIST: NIST SP 800-53A (v1): SA-3.1 (i)
CCI-003092 (policy): Defines a system development life cycle that is used to manage the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-3 a NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a
CCI-004669 (policy): Acquire the system using an organization-defined system development life cycle that incorporates information security considerations.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a
CCI-004670 (policy): Acquire the system using an organization-defined system development life cycle that incorporates information privacy considerations.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a
CCI-004671 (policy): Develop the system using an organization-defined system development life cycle that incorporates information security considerations.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a
CCI-004672 (policy): Develop the system using an organization-defined system development life cycle that incorporates information privacy considerations.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a
CCI-004673 (policy): Manage the system using an organization-defined system development life cycle that incorporates information privacy considerations.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a
CCI-004674 (policy): Defines a system development life cycle that is used to develop the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a
CCI-004675 (policy): Defines a system development life cycle that is used to acquire the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a
CCI-000616 (policy): Define and document information system security roles and responsibilities throughout the system development life cycle.
References: NIST: NIST SP 800-53 (v3): SA-3 b NIST: NIST SP 800-53 Revision 4 (v4): SA-3 b NIST: NIST SP 800-53 Revision 5 (v5): SA-3 b NIST: NIST SP 800-53A (v1): SA-3.1 (ii)
CCI-004676 (policy): Define and document information system privacy roles and responsibilities throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 b
CCI-000618 (policy): Identify individuals having information system security roles and responsibilities.
References: NIST: NIST SP 800-53 (v3): SA-3 c NIST: NIST SP 800-53 Revision 4 (v4): SA-3 c NIST: NIST SP 800-53 Revision 5 (v5): SA-3 c NIST: NIST SP 800-53A (v1): SA-3.1 (iii)
CCI-004677 (policy): Identify individuals having information system privacy roles and responsibilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 c
CCI-003093 (policy): Integrate the organizational information security risk management process into system development life cycle activities.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-3 d NIST: NIST SP 800-53 Revision 5 (v5): SA-3 d
CCI-004678 (policy): Integrate the organizational information privacy risk management process into system development life cycle activities.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 d
CCI-004679 (policy): Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (1)
CCI-004680 (policy): Approve the use of live data in preproduction environments for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (2) (a)
CCI-004681 (policy): Document the use of live data in preproduction environments for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (2) (a)
CCI-004682 (policy): Control the use of live data in preproduction environments for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (2) (a)
CCI-004683 (policy): Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (2) (b)
CCI-004684 (policy): Plan for a technology refresh schedule to support the system throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (3)
CCI-004685 (policy): Implement technology refresh schedule to support the system throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (3)
CCI-004686 (policy): Defines the organization-defined contract language for including the requirements, descriptions, and criteria in the acquisition contract for the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-4