Requirements Traceability Matrix Control Ref. Security Req./ Control Security Category Control Type Planned Imp. Actual Imp. Test #(s) Methods Tailored Result Notes I E T IN OUT NIST w/ DHS AC-1 Access Control Policy and Procedures Access Control Policy and Procedures (T) Not Specified Not Entered Not Assigned AC-1.1, AC-1.2 X X - - - Not Met None NIST w/ DHS 4300A Sharing of Personal Passwords Access Control Policy and Procedures (T) Not Specified Not Entered Not Assigned - X X - - Not Met None NIST w/ DHS 4300A Account Management Account Management (T) Not Specified Not Entered Not Assigned AC-2.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Account Management Account Management (T) Not Specified Not Entered Not Assigned AC-2(1).1 X X - - - Not Met None NIST w/ DHS 4300A (2) Account Management Account Management (T) Not Specified Not Entered Not Assigned AC-2(2).1 X X - - - Not Met None NIST w/ DHS 4300A (3) Account Management Account Management (T) Not Specified Not Entered Not Assigned AC-2(3).1 X X - - - Not Met None NIST w/ DHS 4300A (4) Account Management Account Management (T) Not Specified Not Entered Not Assigned AC-2(4).1 X X - - - Not Met None
4300A NIST w/ DHS AC-11 (1) Session Lock Session Lock (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Session Termination Session Termination (T) Not Specified Not Entered Not Assigned AC-12.1 X X - - - Not Met None NIST w/ DHS AC-14 Permitted Actions without Identification or Permitted Actions without Identification or (T) Not Specified Not Entered Not Assigned AC-14.1 X X - - - Not Met None NIST w/ DHS 4300A Remote Access Remote Access (T) Not Specified Not Entered Not Assigned AC-17.1 X X - - - Not Met None NIST w/ DHS AC-17 (1) Remote Access Remote Access (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A (2) Remote Access Remote Access (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A (3) Remote Access Remote Access (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS Remote Access Remote Access (T) Not Specified Not Entered Not Assigned X X - - - Not Met None
4300A (4) NIST w/ DHS 4300A Remote Access Remote Access (T) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A Remote Access Remote Access (T) Not Specified Not Entered Not Assigned - X X - - Not Met None NIST w/ DHS 4300A Wireless Access Wireless Access (T) Not Specified Not Entered Not Assigned AC-18.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Wireless Access Wireless Access (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A (4) Wireless Access Wireless Access (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A (5) Wireless Access Wireless Access (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Access Control for Mobile Devices Access Control for Mobile Devices (T) Not Specified Not Entered Not Assigned AC-19.1 X X - - - Not Met None NIST w/ DHS 4300A (5) Access Control for Mobile Devices Access Control for Mobile Devices (T) Not Specified Not Entered Not Assigned X X - - - Not Met None
NIST w/ DHS AC-20 Use of External Information Systems Use of External Information Systems (T) Not Specified Not Entered Not Assigned AC-20.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Use of External Information Systems Use of External Information Systems (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A (2) Use of External Information Systems Use of External Information Systems (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Collaboration and Information Sharing Information Sharing (T) Not Specified Not Entered Not Assigned AC-21.1 X X - - - Not Met None NIST w/ DHS 4300A Publicly Accessible Content Publicly Accessible Content (T) Not Specified Not Entered Not Assigned AC-22.1 X X - - - Not Met None NIST w/ DHS AT-1 Security Awareness and Training Policy and Procedures Security Awareness and Training Policy and Procedures (O) Not Specified Not Entered Not Assigned AT-1.1, AT-1.2 X X - - - Not Met None NIST w/ DHS 4300A Security Awareness Security Awareness Training (O) Not Specified Not Entered Not Assigned AT-2.1 X X - - - Not Met None NIST w/ DHS AT-2 (2) Security Awareness Security Awareness Training (O) Not Specified Not Entered Not Assigned AT-2(2).1 X X - - - Not Met None
NIST w/ DHS 4300A Review, Analysis, and Reporting Audit Review, Analysis, and Reporting (T) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A Audit Reduction and Report Generation Audit Reduction and Report Generation (T) Not Specified Not Entered Not Assigned AU-7.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Audit Reduction and Report Generation Audit Reduction and Report Generation (T) Not Specified Not Entered Not Assigned AU-7(1).1 X X - - - Not Met None NIST w/ DHS 4300A Time Stamps Time Stamps (T) Not Specified Not Entered Not Assigned AU-8.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Time Stamps Time Stamps (T) Not Specified Not Entered Not Assigned AU-8(1).1 X X - - - Not Met None NIST w/ DHS 4300A Protection of Audit Information Protection of Audit Information (T) Not Specified Not Entered Not Assigned AU-9.1 X X - - - Not Met None NIST w/ DHS 4300A (2) Protection of Audit Information Protection of Information (T) Not Specified Not Entered Not Assigned AU-9(2).1 X X - - - Not Met None NIST w/ DHS Protection of Audit Information Protection of Audit Not Specified Not Entered Not Assigned AU-9(3).1 X X - - - Not Met None
4300A (3) Information (T) NIST w/ DHS 4300A (4) Protection of Audit Information Protection of Information (T) Not Specified Not Entered Not Assigned AU-9(4).1 X X - - - Not Met None NIST w/ DHS 4300A (T) Not Specified Not Entered Not Assigned AU-10.1 X X - - - Not Met None NIST w/ DHS 4300A Audit Record Retention Record Retention (T) Not Specified Not Entered Not Assigned AU-11.1 X X - - - Not Met None NIST w/ DHS 4300A Record Retention Record Retention (T) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A Generation Audit Generation (T) Not Specified Not Entered Not Assigned AU-12.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Audit Generation Audit Generation (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A (3) Audit Generation Audit Generation (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Security Assessment and Authorization Security Assessment and Authorization Policies and Not Specified Not Entered Not Assigned CA-1.1, CA-1.2 X X - - - Not Met None
NIST w/ DHS 4300A (1) Security Assessments Security Assessments (M) Not Specified Not Entered Not Assigned CA-2(1).1 X X - - - Not Met None NIST w/ DHS 4300A (2) Security Assessments Security Assessments (M) Not Specified Not Entered Not Assigned CA-2.2 X X - - - Not Met None NIST w/ DHS 4300A Security Assessments Security Assessments (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Information System Connections System (M) Not Specified Not Entered Not Assigned CA-3.1 X X - - - Not Met None NIST w/ DHS 4300A (5) Information System Connections System (M) Not Specified Not Entered Not Assigned CA-3(5).1 X X - - - Not Met None NIST w/ DHS 4300A Information System Connections System (M) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A Information System Connections System (M) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A Information System Connections System (M) Not Specified Not Entered Not Assigned X X X - - Not Met None
4300A CM-6 (1) NIST w/ DHS CM-6 (2) Configuration Settings Configuration Settings (O) Not Specified Not Entered Not Assigned CM-6(2).1 X X - - - Not Met None NIST w/ DHS 4300A CM-6 Configuration Settings Configuration Settings (O) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A CM-6 Configuration Settings Configuration Settings (O) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS CM-6 Configuration Settings Configuration Settings (O) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A CM-6 Configuration Settings Configuration Settings (O) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A CM-6 Configuration Settings Configuration Settings (O) Not Specified Not Entered Not Assigned X X X - - Not Met None
NIST w/ DHS 4300A CM-7 (5) Functionality Functionality (O) Not Specified Not Entered Not Assigned CM-7(5).1 X X - - - Not Met None NIST w/ DHS 4300A CM-7 Functionality Least Functionality (O) Not Specified Not Entered Not Assigned - X X - - Not Met None NIST w/ DHS 4300A CM-7 Least Functionality Least Functionality (O) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A CM-8 Information System Component Inventory Information System Component Inventory (O) Not Specified Not Entered Not Assigned CM-8.1 X X - - - Not Met None NIST w/ DHS 4300A CM-8 (1) Information System Component Inventory Information System Component Inventory (O) Not Specified Not Entered Not Assigned CM-8(1).1 X X - - - Not Met None NIST w/ DHS 4300A CM-8 (2) Information System Component Inventory Information System Component Inventory (O) Not Specified Not Entered Not Assigned CM-8(2).1 X X - - - Not Met None NIST w/ DHS 4300A CM-8 (3) Information System Component Inventory Information System Component Inventory (O) Not Specified Not Entered Not Assigned CM-8(3).1 X X - - - Not Met None NIST w/ DHS 4300A CM-8 (4) Information System Component Inventory Information System Component Inventory (O) Not Specified Not Entered Not Assigned CM-8(4).1 X X - - - Not Met None
NIST w/ DHS 4300A CM-8 (5) Information System Component Inventory Information System Component Inventory (O) Not Specified Not Entered Not Assigned CM-8(5).1 X X - - - Not Met None NIST w/ DHS 4300A CM-9 Configuration Management Plan Configuration Management Plan (O) Not Specified Not Entered Not Assigned CM-9.1 X X - - - Not Met None NIST w/ DHS CM-10 Software Usage Restrictions SW Usage Restrictions (O) Not Specified Not Entered Not Assigned CM-10.1 X X - - - Not Met None NIST w/ DHS 4300A CM-11 User-Installed Software User-Installed SW (O) Not Specified Not Entered Not Assigned CM-11.1 X X - - - Not Met None NIST w/ DHS CP-1 Contingency Planning Policy and Procedures Contingency Planning Policy and Procedures (O) Not Specified Not Entered Not Assigned CP-1.1, CP-1.2 X X - - - Not Met None NIST w/ DHS 4300A Contingency Planning Policy and Procedures Contingency Planning Policy and Procedures (O) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS CP-1 Contingency Planning Policy and Procedures Contingency Planning Policy and Procedures (O) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A Contingency Plan Contingency Plan (O) Not Specified Not Entered Not Assigned CP-2.1, CP-2.2 X X - - - Not Met None NIST w/ DHS Contingency Plan Contingency Plan (O) Not Specified Not Entered Not Assigned CP-2(1).1 X X - - - Not Met None
NIST w/ DHS 4300A Information System Backup Information System Backup (O) Not Specified Not Entered Not Assigned CP-9.1, CP-9.2 X X - - - Not Met None NIST w/ DHS 4300A (1) Information System Backup Information System Backup (O) Not Specified Not Entered Not Assigned CP-9(1).1 X X - - - Not Met None NIST w/ DHS 4300A (2) Information System Backup Information System Backup (O) Not Specified Not Entered Not Assigned CP-9(2).1 X X - - - Not Met None NIST w/ DHS 4300A (3) Information System Backup Information System Backup (O) Not Specified Not Entered Not Assigned CP-9(3).1 X X - - - Not Met None NIST w/ DHS CP-9 (5) Information System Backup Information System Backup (O) Not Specified Not Entered Not Assigned CP-9(5).1 X X - - - Not Met None NIST w/ DHS 4300A Information System Recovery and Information System Recovery and (O) Not Specified Not Entered Not Assigned CP-10.1 X X - - - Not Met None NIST w/ DHS 4300A (2) Information System Recovery and Information System Recovery and (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS CP-10 (4) Information System Recovery and Information System Recovery and (O) Not Specified Not Entered Not Assigned X X - - - Not Met None
NIST w/ DHS 4300A Identification and Policy and Procedures Identification and Policy and Procedures (T) Not Specified Not Entered Not Assigned IA-1.1, IA-1.2 X X - - - Not Met None NIST w/ DHS 4300A Identification and Policy and Procedures Identification and Policy and Procedures (T) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS IA-1 Identification and Policy and Procedures Identification and Policy and Procedures (T) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A Identification and Policy and Procedures Identification and Policy and Procedures (T) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS 4300A Identification and Policy and Procedures Identification and Policy and Procedures (T) Not Specified Not Entered Not Assigned X X X - - Not Met None NIST w/ DHS IA-2 Identification and Users) Identification and Users) (T) Not Specified Not Entered Not Assigned IA-2.1 X X - - - Not Met None
NIST w/ DHS 4300A (2) Authenticator Management Authenticator Management (T) Not Specified Not Entered Not Assigned IA-5(2).1 X X - - - Not Met None NIST w/ DHS 4300A (3) Authenticator Management Authenticator Management (T) Not Specified Not Entered Not Assigned IA-5(3).1 X X - - - Not Met None NIST w/ DHS 4300A (11) Authenticator Management Authenticator Management (T) Not Specified Not Entered Not Assigned IA-5(11).1 X X - - - Not Met None NIST w/ DHS 4300A Authenticator Management Authenticator Management (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Authenticator Feedback Authenticator Feedback (T) Not Specified Not Entered Not Assigned IA-6.1 X X - - - Not Met None NIST w/ DHS 4300A Module Module (T) Not Specified Not Entered Not Assigned IA-7.1 X X - - - Not Met None NIST w/ DHS 4300A Identification and Users) Identification and (T) Not Specified Not Entered Not Assigned IA-8.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Identification and Identification and Not Specified Not Entered Not Assigned IA-8(1).1 X X - - - Not Met None
NIST w/ DHS MA-5 (1) Maintenance Personnel Maintenance Personnel (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS MA-6 Timely Maintenance Timely Maintenance (O) Not Specified Not Entered Not Assigned MA-6.1 X X - - - Not Met None NIST w/ DHS 4300A Media Protection Policy and Procedures Media Protection Policy and Procedures (O) Not Specified Not Entered Not Assigned MP-1.1, MP-1.2 X X - - - Not Met None NIST w/ DHS MP-1 Media Protection Policy and Procedures Media Protection Policy and Procedures (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Media Protection Policy and Procedures Media Protection Policy and Procedures (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Protection Policy and Procedures Media Protection Policy and Procedures (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Protection Policy and Procedures Media Protection Policy and Procedures (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Media Access Media Access (O) Not Specified Not Entered Not Assigned MP-2.1 X X - - - Not Met None
NIST w/ DHS 4300A Media Marking Media Marking (O) Not Specified Not Entered Not Assigned MP-3.1 X X - - - Not Met None NIST w/ DHS MP-4 Media Storage Media Storage (O) Not Specified Not Entered Not Assigned MP-4.1 X X - - - Not Met None NIST w/ DHS 4300A Media Storage Media Protection Policy and Procedures (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Media Transport Media Transport (O) Not Specified Not Entered Not Assigned MP-5.1 X X - - - Not Met None NIST w/ DHS MP-5 (4) Media Transport Media Transport (O) Not Specified Not Entered Not Assigned MP-5(4).1 X X - - - Not Met None NIST w/ DHS 4300A Transport Transport (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Media Sanitization Media Sanitization (O) Not Specified Not Entered Not Assigned MP-6.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Media Sanitization Media Sanitization (O) Not Specified Not Entered Not Assigned MP-6(1).1 X X - - - Not Met None NIST w/ DHS Sanitization Media Sanitization (O) Not Specified Not Entered Not Assigned MP-6(2).1 X X - - - Not Met None
4300A (2) NIST w/ DHS 4300A (3) Media Sanitization Media Sanitization (O) Not Specified Not Entered Not Assigned MP-6(3).1 X X - - - Not Met None NIST w/ DHS 4300A Media Use Media Use (O) Not Specified Not Entered Not Assigned MP-7.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Prohibit Use Without Owner Use (O) Not Specified Not Entered Not Assigned MP-7(1).1 X X - - - Not Met None NIST w/ DHS 4300A USB Drive encryption Media Use (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A DHS Removable Media Media Use (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Protection of Sensitive Paper and Electronic Outputs Use (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Physical and Protection Policy and Procedures Physical and Protection Policy and Procedures (O) Not Specified Not Entered Not Assigned PE-1.1, PE-1.2 X X - - - Not Met None
NIST w/ DHS 4300A Physical and Protection Policy and Procedures Physical and Protection Policy and Procedures (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Physical and Protection Policy and Procedures Physical and Protection Policy and Procedures (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Physical Access Physical Access (O) Not Specified Not Entered Not Assigned PE-2.1, PE-2.2 X X - - - Not Met None NIST w/ DHS PE-3 Physical Access Control Physical Access Control (O) Not Specified Not Entered Not Assigned PE-3.1, PE-3.2 X X - - - Not Met None NIST w/ DHS 4300A (1) Physical Access Control Physical Access Control (O) Not Specified Not Entered Not Assigned PE-3(1).1 X X - - - Not Met None NIST w/ DHS 4300A Access Control for Transmission Medium Access Control for Transmission Medium (O) Not Specified Not Entered Not Assigned PE-4.1 X X - - - Not Met None NIST w/ DHS 4300A Access Control for Output Devices Access Control for Output Devices (O) Not Specified Not Entered Not Assigned PE-5.1 X X - - - Not Met None NIST w/ DHS PE-6 Monitoring Physical Access Monitoring Physical Access (O) Not Specified Not Entered Not Assigned PE-6.1 X X - - - Not Met None
NIST w/ DHS 4300A (1) Monitoring Physical Access Monitoring Physical Access (O) Not Specified Not Entered Not Assigned PE-6(1).1 X X - - - Not Met None NIST w/ DHS 4300A (4) Monitoring Physical Access Monitoring Physical Access (O) Not Specified Not Entered Not Assigned PE-6(4).1 X X - - - Not Met None NIST w/ DHS 4300A Access Records Visitor Access Records (O) Not Specified Not Entered Not Assigned PE-8.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Access Records Visitor Access Records (O) Not Specified Not Entered Not Assigned PE-8(1).1 X X - - - Not Met None NIST w/ DHS PE-9 Equipment and Power Cabling Equipment and Cabling (O) Not Specified Not Entered Not Assigned PE-9.1 X X - - - Not Met None NIST w/ DHS 4300A Emergency Shutoff Emergency Shutoff (O) Not Specified Not Entered Not Assigned PE-10.1 X X - - - Not Met None NIST w/ DHS 4300A Emergency Emergency Power (O) Not Specified Not Entered Not Assigned PE-11.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Emergency Emergency Power (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS PE-12 Emergency Lighting Emergency Lighting (O) Not Specified Not Entered Not Assigned PE-12.1 X X - - - Not Met None
4300A System Components System Components (O) NIST w/ DHS 4300A Security Planning Policy and Procedures Security Planning Policy and Procedures (M) Not Specified Not Entered Not Assigned PL-1.1, PL-1.2 X X - - - Not Met None NIST w/ DHS 4300A Security Planning Policy and Procedures Security Planning Policy and Procedures (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Security Planning Policy and Procedures Security Planning Policy and Procedures (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A System Security Plan System Security Plan (M) Not Specified Not Entered Not Assigned PL-2.1 X X - - - Not Met None NIST w/ DHS 4300A (3) System Security Plan System Security Plan (M) Not Specified Not Entered Not Assigned PL-2(3).1 X X - - - Not Met None NIST w/ DHS 4300A Rules of Behavior Rules of Behavior (M) Not Specified Not Entered Not Assigned PL-4.1 X X - - - Not Met None NIST w/ DHS 4300A (1) of Behavior of Behavior (M) Not Specified Not Entered Not Assigned PL-4(1).1 X X - - - Not Met None
4300A Security Officer Security Officer (M) NIST w/ DHS 4300A Information Security Resources Information Security Resources (M) Not Specified Not Entered Not Assigned PM-3.1 X X - - - Not Met None NIST w/ DHS 4300A Plan of Action and Milestones Process Plan of Action and Milestones Process (M) Not Specified Not Entered Not Assigned PM-4.1 X X - - - Not Met None NIST w/ DHS 4300A Information System Inventory Information System Inventory (M) Not Specified Not Entered Not Assigned PM-5.1 X X - - - Not Met None NIST w/ DHS 4300A Information Security Measures of Performance Information Security Measures of Performance (M) Not Specified Not Entered Not Assigned PM-6.1 X X - - - Not Met None NIST w/ DHS PM-7 Enterprise Architecture Enterprise Architecture (M) Not Specified Not Entered Not Assigned PM-7.1 X X - - - Not Met None NIST w/ DHS 4300A Critical Infrastructure Plan Critical Infrastructure Plan (M) Not Specified Not Entered Not Assigned PM-8.1 X X - - - Not Met None NIST w/ DHS 4300A Risk Management Strategy Risk Management Strategy (M) Not Specified Not Entered Not Assigned PM-9.1 X X - - - Not Met None NIST w/ DHS 4300A Security Authorization Process Security Authorization Process (M) Not Specified Not Entered Not Assigned PM-10.1 X X - - - Not Met None
NIST w/ DHS 4300A Process Definition Process Definition (M) Not Specified Not Entered Not Assigned PM-11.1 X X - - - Not Met None NIST w/ DHS 4300A Insider Threat Program Insider Threat Program (M) Not Specified Not Entered Not Assigned PM-12.1 X - - - - Not Met None NIST w/ DHS PM-13 Information Security Workforce Information Security Workforce (M) Not Specified Not Entered Not Assigned PM-13.1 X X - - - Not Met None NIST w/ DHS 4300A Testing, Training, and Monitoring Testing, Training, and Monitoring (M) Not Specified Not Entered Not Assigned PM-14.1 X X - - - Not Met None NIST w/ DHS PM-15 Contacts with Security Groups and Associations Contacts with Security and Associations (M) Not Specified Not Entered Not Assigned PM-15.1 X X - - - Not Met None NIST w/ DHS 4300A Threat Awareness Program Threat Awareness Program (M) Not Specified Not Entered Not Assigned PM-16.1 X X - - - Not Met None NIST w/ DHS Authority to Collect Authority to Collect () Not Specified Not Entered Not Assigned AP-1.1 X X - - - Not Met None NIST w/ DHS 4300A PRIV-AP-2 Purpose Specification Purpose Specification () Not Specified Not Entered Not Assigned AP-2.1 X X - - - Not Met None NIST w/ DHS 4300A Governance and Privacy Program Governance and Privacy Program () Not Specified Not Entered Not Assigned AR-1.1 X X - - - Not Met None
NIST w/ DHS 4300A PRIV-DI-1 Data Quality Data Quality () Not Specified Not Entered Not Assigned DI-1.1 X X - - - Not Met None NIST w/ DHS 4300A PRIV-DI-2 Data Integrity and Data Integrity Board Data Integrity and Data Integrity Board () Not Specified Not Entered Not Assigned DI-2.1 X X - - - Not Met None NIST w/ DHS Minimization of Personally Identifiable Information Minimization of Personally Identifiable Information () Not Specified Not Entered Not Assigned DM-1.1 X X - - - Not Met None NIST w/ DHS 4300A Data Retention and Disposal Data Retention and Disposal () Not Specified Not Entered Not Assigned DM-2.1 X X - - - Not Met None NIST w/ DHS 4300A Minimization of PII Used in Testing, Training, and Research Minimization of PII Used in Testing, Training, and Research () Not Specified Not Entered Not Assigned DM-3.1 X X - - - Not Met None NIST w/ DHS 4300A PRIV-IP-1 Consent Consent () Not Specified Not Entered Not Assigned IP-1.1 X X - - - Not Met None NIST w/ DHS 4300A PRIV-IP-2 Individual Access Individual Access () Not Specified Not Entered Not Assigned IP-2.1 X X - - - Not Met None NIST w/ DHS Redress Redress () Not Specified Not Entered Not Assigned IP-3.1 X X - - - Not Met None
NIST w/ DHS 4300A PRIV-IP-4 Complaint Management Complaint Management () Not Specified Not Entered Not Assigned IP-4.1 X X - - - Not Met None NIST w/ DHS 4300A PRIV-SE-1 Inventory of Personally Identifiable Information Inventory of Personally Identifiable Information () Not Specified Not Entered Not Assigned SE-1.1 X X - - - Not Met None NIST w/ DHS 4300A PRIV-SE-2 Privacy Incident Response Privacy Incident Response () Not Specified Not Entered Not Assigned SE-2.1 X X - - - Not Met None NIST w/ DHS Privacy Notice Privacy Notice () Not Specified Not Entered Not Assigned TR-1.1 X X - - - Not Met None NIST w/ DHS 4300A PRIV-TR-2 System of Records Notices and Privacy Act Statements System of Records Notices and Privacy Act Statements () Not Specified Not Entered Not Assigned TR-2.1 X X - - - Not Met None NIST w/ DHS of Privacy Program Information of Privacy Program Information () Not Specified Not Entered Not Assigned TR-3.1 X X - - - Not Met None NIST w/ DHS 4300A Internal Use Internal Use () Not Specified Not Entered Not Assigned UL-1.1 X X - - - Not Met None
NIST w/ DHS 4300A Information Sharing with Third Parties Information Sharing with Parties () Not Specified Not Entered Not Assigned UL-2.1 X X - - - Not Met None NIST w/ DHS 4300A Personnel Security Policy and Procedures Personnel Security Policy and Procedures (O) Not Specified Not Entered Not Assigned PS-1.1, PS-1.2 X X - - - Not Met None NIST w/ DHS PS-2 Position Position Risk Designation (O) Not Specified Not Entered Not Assigned PS-2.1 X X - - - Not Met None NIST w/ DHS 4300A Personnel Screening Personnel Screening (O) Not Specified Not Entered Not Assigned PS-3.1 X X - - - Not Met None NIST w/ DHS 4300A Personnel Termination Personnel Termination (O) Not Specified Not Entered Not Assigned PS-4.1 X X - - - Not Met None NIST w/ DHS 4300A (2) Automated Notification Personnel Termination (O) Not Specified Not Entered Not Assigned PS-4(2).1 X X - - - Not Met None NIST w/ DHS 4300A Personnel Transfer Personnel Transfer (O) Not Specified Not Entered Not Assigned PS-5.1 X X - - - Not Met None NIST w/ DHS 4300A Access Agreements Access Agreements (O) Not Specified Not Entered Not Assigned PS-6.1 X X - - - Not Met None NIST w/ DHS PS-7 Third-Party Personnel Security Third-Party Personnel Security (O) Not Specified Not Entered Not Assigned PS-7.1 X X - - - Not Met None
4300A (2) NIST w/ DHS 4300A (4) Vulnerability Scanning Vulnerability Scanning (M) Not Specified Not Entered Not Assigned RA-5(4).1 X X - - - Not Met None NIST w/ DHS 4300A (5) Vulnerability Scanning Vulnerability Scanning (M) Not Specified Not Entered Not Assigned RA-5(5).1 X X - - - Not Met None NIST w/ DHS 4300A Vulnerability Scanning Vulnerability Scanning (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A System and Services Acquisition Policy and Procedures System and Services Acquisition Policy and Procedures (M) Not Specified Not Entered Not Assigned SA-1.1, SA-1.2 X X - - - Not Met None NIST w/ DHS 4300A System and Services Acquisition Policy and Procedures System and Services Acquisition Policy and Procedures (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A System and Services Acquisition Policy and Procedures System and Services Acquisition Policy and Procedures (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A System and Services Acquisition System and Services Acquisition Not Specified Not Entered Not Assigned X X - - - Not Met None
Policy and Procedures Policy and Procedures (M) NIST w/ DHS 4300A System and Services Acquisition Policy and Procedures System and Services Acquisition Policy and Procedures (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Allocation of Resources Allocation of Resources (M) Not Specified Not Entered Not Assigned SA-2.1 X X - - - Not Met None NIST w/ DHS 4300A Life Support System Development Life Cycle (M) Not Specified Not Entered Not Assigned SA-3.1 X X - - - Not Met None NIST w/ DHS SA-3 Life Cycle Support System Development Life (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS SA-4 Acquisitions Acquisition Process (M) Not Specified Not Entered Not Assigned SA-4.1 X X - - - Not Met None NIST w/ DHS 4300A (1) Acquisitions Acquisition Process (M) Not Specified Not Entered Not Assigned SA-4(1).1 X X - - - Not Met None NIST w/ DHS 4300A (2) Acquisitions Acquisition Process (M) Not Specified Not Entered Not Assigned SA-4(2).1 X X - - - Not Met None NIST w/ DHS Acquisitions Acquisition Process (M) Not Specified Not Entered Not Assigned SA-4(9).1 X X - - - Not Met None
4300A (9) NIST w/ DHS 4300A (10) Acquisitions Acquisition Process (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Acquisitions Acquisition Process (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS SA-4 Acquisitions Acquisition Process (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Information System Information System (M) Not Specified Not Entered Not Assigned SA-5.1 X X - - - Not Met None NIST w/ DHS 4300A Security Engineering Principles Security Engineering Principles (M) Not Specified Not Entered Not Assigned SA-8.1 X X - - - Not Met None NIST w/ DHS 4300A External Information System Services External Information System Services (M) Not Specified Not Entered Not Assigned SA-9.1 X X - - - Not Met None NIST w/ DHS SA-9 (2) External Information System Services External Information System Services (M) Not Specified Not Entered Not Assigned SA-9(2).1 X X - - - Not Met None NIST w/ DHS 4300A Developer Configuration Management Developer Configuration Management (M) Not Specified Not Entered Not Assigned SA-10.1 X X - - - Not Met None
NIST w/ DHS 4300A Developer Security Testing and Evaluation Developer Security Testing and Evaluation (M) Not Specified Not Entered Not Assigned SA-11.1 X X - - - Not Met None NIST w/ DHS 4300A Supply Chain Protection Supply Chain Protection (M) Not Specified Not Entered Not Assigned SA-12.1 X X - - - Not Met None NIST w/ DHS 4300A Supply Chain Protection Supply Chain Protection (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Supply Chain Protection Supply Chain Protection (M) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Development Process, Standards, and Tools Development Process, Standards, and Tools (M) Not Specified Not Entered Not Assigned SA-15.1 X X - - - Not Met None NIST w/ DHS 4300A Training Training (M) Not Specified Not Entered Not Assigned SA-16.1 X X - - - Not Met None NIST w/ DHS 4300A Developer Security Architecture and Design Developer Security Architecture and Design (M) Not Specified Not Entered Not Assigned SA-17.1 X X - - - Not Met None NIST w/ DHS System and System and Not Specified Not Entered Not Assigned SC-1.1, SC-1.2 X X - - - Not Met None
4300A Protection Policy and Procedures Protection Policy and Procedures (T) NIST w/ DHS 4300A System and Protection Policy and Procedures System and Protection Policy and Procedures (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A System and Protection Policy and Procedures System and Protection Policy and Procedures (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS SC-1 System and Protection Policy and Procedures System and Protection Policy and Procedures (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A System and Protection Policy and Procedures System and Protection Policy and Procedures (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A System and Protection System and Protection Not Specified Not Entered Not Assigned X X - - - Not Met None
NIST w/ DHS 4300A Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned SC-7.1 X X - - - Not Met None NIST w/ DHS 4300A (3) Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned SC-7(3).1 X X - - - Not Met None NIST w/ DHS 4300A (4) Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned SC-7(4).1 X X - - - Not Met None NIST w/ DHS 4300A (5) Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned SC-7(5).1 X X - - - Not Met None NIST w/ DHS SC-7 (7) Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned SC-7(7).1 X X - - - Not Met None NIST w/ DHS SC-7 (8) Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned SC-7(8).1 X X - - - Not Met None NIST w/ DHS 4300A (18) Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A (21) Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned X X - - - Not Met None
NIST w/ DHS 4300A Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Boundary Protection Boundary Protection (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Transmission Integrity Transmission and Integrity (T) Not Specified Not Entered Not Assigned SC-8.1 X X - - - Not Met None NIST w/ DHS SC-8 (1) Transmission Integrity Transmission and Integrity (T) Not Specified Not Entered Not Assigned SC-8(1).1 X X - - - Not Met None NIST w/ DHS 4300A Network Disconnect Network Disconnect (T) Not Specified Not Entered Not Assigned SC-10.1 X X - - - Not Met None NIST w/ DHS 4300A Key Establishment and Management Key Establishment and Management (T) Not Specified Not Entered Not Assigned SC-12.1 X X - - - Not Met None NIST w/ DHS Key Establishment Key Establishment Not Specified Not Entered Not Assigned X X - - - Not Met None
NIST w/ DHS 4300A Collaborative Computing Devices Collaborative Computing Devices (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS SC-15 Collaborative Computing Devices Collaborative Computing Devices (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS SC-17 Public Key Infrastructure Certificates Public Key Infrastructure Certificates (T) Not Specified Not Entered Not Assigned SC-17.1 X X - - - Not Met None NIST w/ DHS 4300A Mobile Code Mobile Code (T) Not Specified Not Entered Not Assigned SC-18.1 X X - - - Not Met None NIST w/ DHS 4300A Voice Over Internet Protocol Voice Over Internet Protocol (T) Not Specified Not Entered Not Assigned SC-19.1 X X - - - Not Met None NIST w/ DHS SC-20 Secure Resolution Service (Authoritative Source) Secure Name / Address Resolution Service (Authoritative Source) (T) Not Specified Not Entered Not Assigned SC-20.1 X X - - - Not Met None NIST w/ DHS 4300A Secure Resolution Service (Authoritative Source) Secure Name / Address Resolution Service (Authoritative Source) (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS Secure Secure Name / Address Not Specified Not Entered Not Assigned SC-21.1 X X - - - Not Met None
4300A Resolution Service (Recursive or Caching Resolver) Resolution Service (Recursive or Caching Resolver) (T) NIST w/ DHS 4300A Architecture and Provisioning for Resolution Service Architecture and Provisioning for Resolution Service (T) Not Specified Not Entered Not Assigned SC-22.1 X X - - - Not Met None NIST w/ DHS 4300A Session Authenticity Session Authenticity (T) Not Specified Not Entered Not Assigned SC-23.1 X X - - - Not Met None NIST w/ DHS 4300A Fail in State Fail in Known State (T) Not Specified Not Entered Not Assigned SC-24.1 X X - - - Not Met None NIST w/ DHS 4300A Protection of Information at Rest Protection of Information at Rest (T) Not Specified Not Entered Not Assigned SC-28.1 X X - - - Not Met None NIST w/ DHS 4300A Protection of Information at Rest Protection of Information at Rest (T) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS 4300A Process Isolation Process Isolation (T) Not Specified Not Entered Not Assigned SC-39.1 X X - - - Not Met None NIST w/ DHS SI-1 System and Information Integrity System and Information Integrity Not Specified Not Entered Not Assigned SI-1.1, X X - - - Not Met None
NIST w/ DHS 4300A SI-3 (1) Malicious Code Protection Malicious Code Protection (O) Not Specified Not Entered Not Assigned SI-3(1).1 X X - - - Not Met None NIST w/ DHS 4300A SI-3 (2) Malicious Code Protection Malicious Code Protection (O) Not Specified Not Entered Not Assigned SI-3(2).1 X X - - - Not Met None NIST w/ DHS 4300A SI-3 (10) Malicious Code Protection Malicious Code Protection (O) Not Specified Not Entered Not Assigned SI-3(10).1 X X - - - Not Met None NIST w/ DHS 4300A SI-3 Malicious Code Protection Malicious Code Protection (O) Not Specified Not Entered Not Assigned X X - - - Not Met None NIST w/ DHS SI-4 Information System Monitoring Information System Monitoring (O) Not Specified Not Entered Not Assigned SI-4.1 X X - - - Not Met None NIST w/ DHS 4300A SI-4 (2) Information System Monitoring Information System Monitoring (O) Not Specified Not Entered Not Assigned SI-4(2).1 X X - - - Not Met None NIST w/ DHS 4300A SI-4 (4) Information System Monitoring Information System Monitoring (O) Not Specified Not Entered Not Assigned SI-4(4).1 X X - - - Not Met None NIST w/ DHS 4300A SI-4 (5) Information System Monitoring Information System Monitoring (O) Not Specified Not Entered Not Assigned SI-4(5).1 X X - - - Not Met None NIST w/ DHS 4300A SI-5 Security Alerts, Advisories, Security Alerts, Advisories, Not Specified Not Entered Not Assigned SI-5.1 X X - - - Not Met None
and Directives and Directives (O) NIST w/ DHS SI-5 (1) Security Alerts, Advisories, and Directives Security Alerts, Advisories, and Directives (O) Not Specified Not Entered Not Assigned SI-5(1).1 X X - - - Not Met None NIST w/ DHS 4300A SI-6 Security Functionality Verification Security Function Verification (O) Not Specified Not Entered Not Assigned SI-6.1 X X - - - Not Met None NIST w/ DHS 4300A SI-7 Software and Information Integrity Software, Firmware, and Information Integrity (O) Not Specified Not Entered Not Assigned SI-7.1 X X - - - Not Met None NIST w/ DHS 4300A SI-7 (1) Software and Information Integrity Software, Firmware, and Information Integrity (O) Not Specified Not Entered Not Assigned SI-7(1).1 X X - - - Not Met None NIST w/ DHS SI-7 (2) Software and Information Integrity Software, Firmware, and Information Integrity (O) Not Specified Not Entered Not Assigned SI-7(2).1 X X - - - Not Met None NIST w/ DHS 4300A SI-7 (5) Software and Information Integrity Software, Firmware, and Information Integrity (O) Not Specified Not Entered Not Assigned SI-7(5).1 X X - - - Not Met None NIST w/ DHS Software and Information Integrity Software, Firmware, and Not Specified Not Entered Not Assigned SI-7(7).1 X X - - - Not Met None