component of an application, then controls for the other components of the application must be identified individually. AU-12 Audit Generation SYSTEM CONTROL REQUIREMENT The Information System: a. Provides audit record generation capability for the auditable events defined in AU-2 a. at the operating system, services, applications, and network components; b. Allows authorized organization personnel to select auditable events are to be audited by specific components of the information system; and c. Generates audit records for the events and content defined in AU-3. Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually.
AU-13 Monitoring for Information Disclosure SYSTEM CONTROL REQUIREMENT The organization monitors organization-defined open source information and/or information sites at the appropriate organization-defined frequency for evidence of unauthorized disclosure of organizational information. Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually. AU-14 Session Audit CONTROL REQUIREMENT Withdrawn: Not applicable to COV AU-15 Alternate Capability CONTROL REQUIREMENT Withdrawn: Not applicable to COV AU-16 Auditing CONTROL REQUIREMENT Withdrawn: Not applicable to COV
identified individually. CA-4 Security Certification SYSTEM CONTROL REQUIREMENT Withdrawn: Incorporated into CA-2 Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually. CA-5 Plan of Action and Milestones CONTROL REQUIREMENT Withdrawn: Not applicable to COV CA-6 Security Authorization SYSTEM CONTROL REQUIREMENT The Organization: a. Assigns a senior-level executive or manager as the authorizing official for the information system; b. Ensures that the authorizing official authorizes the information system for processing before commencing operations; and
PE-8 Access Records SYSTEM CONTROL REQUIREMENT The organization: a. Maintains visitor access records to the facility where the information system resides for a minimum period of one year; and b. Reviews visitor access records at least once every Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually. PE-9 Power Equipment and Power Cabling SYSTEM CONTROL REQUIREMENT The organization protects power equipment and power cabling for the information system from damage and destruction. Implementation Status: Implemented Planned Common text in order to provide detailed information regarding the implementation strategy. If days
SA-7 User-Installed Software CONTROL REQUIREMENT Withdrawn: Incorporated into CM-11 and SI-7 SA-8 Security Engineering Principles SYSTEM CONTROL REQUIREMENT The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system. Implementation Status: Implemented Planned Common text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually. SA-9 External Information systems Services SYSTEM CONTROL REQUIREMENT The organization: a. Requires that providers of external information system services comply with organizational information security requirements and employ appropriate security controls in accordance with applicable Commonwealth laws, Executive Orders, directives, policies, regulations, standards, and guidance;
the application must be identified individually. SA-9-COV-3 SYSTEM CONTROL REQUIREMENT Each Agency shall (1) Perform an annual security audit of the environment or review the annual audit report of the environment conducted by an independent, third-party audit firm on an annual basis (2) Perform a monthly review of activity logs related to the operation of the service. At a minimum, the activity review must include the access time and action of each individual using the system during the review period. (3) Receive reports from the vendor on vulnerability scans of the operating system and supporting software at least once every 90-days (4) Ensure that the vendor conduct an independent vulnerability scan of the service at least once every and provide the results to Agency within (5) Submit a summary of all findings from the monthly activity log review once every 90-days to the appropriate regulatory authority (6) Submit the vulnerability scan information within of receipt from the vendor to the appropriate regulatory authority (7) Submit the results from the Data Owning Agency vulnerability scan of the service within 30 days of scan completion Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one
SA-21 Developer Screening CONTROL REQUIREMENT Withdrawn: Not applicable to COV SA-22 Unsupported System Components SYSTEM CONTROL REQUIREMENT The organization: a. Replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and b. Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs. Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually. SC-1 System and Communications Protection Policy and Procedures SYSTEM CONTROL REQUIREMENT The organization:
SC-11 Trusted Path CONTROL REQUIREMENT Withdrawn: Not applicable to COV SC-12 Cryptographic Key Establishment and Management SYSTEM CONTROL REQUIREMENT The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with the requirements for key generation, distribution, storage, access, and destruction. Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually. SC-12-COV SYSTEM CONTROL REQUIREMENT The organization shall: 1. Define the process for the creation and storage of any cryptographic keying material used to protect organization-defined information rated sensitive for
controls for the other components of the application must be identified individually. SC-16 Transmission of Security Attributes SYSTEM CONTROL REQUIREMENT Withdrawn: Not applicable to COV Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually. SC-17 Public Key Infrastructure Certification SYSTEM CONTROL REQUIREMENT The organization issues public key certificates under an approved organization-defined certificate policy or obtains public key certificates from an approved service provider.
SC-31 Covert Channel Analysis CONTROL REQUIREMENT Withdrawn: Not applicable to COV SC-32 Information System Partitioning CONTROL REQUIREMENT Withdrawn: Not applicable to COV SC-33 Transmission Preparation Integrity CONTROL REQUIREMENT Withdrawn: Incorporated into SC-8 SC-34 Non-Modifiable Executable Programs CONTROL REQUIREMENT Withdrawn: Not applicable to COV SC-35 Honey Clients CONTROL REQUIREMENT Withdrawn: Not applicable to COV SC-36 Distributed Processing and Storage CONTROL REQUIREMENT Withdrawn: Not applicable to COV SC-37 Out-of-Bounds Channels SYSTEM CONTROL REQUIREMENT The organization employs organization-defined channels for the physical delivery or electronic transmission of organization-defined information,
individually. SI-17 Fail-Safe Procedures CONTROL REQUIREMENT Withdrawn: Not applicable to COV PM- Project Management CONTROL REQUIREMENT Withdrawn: Not applicable to COV POAM/Remediation Plan Template When a control is not implemented, it must be tracked as a finding and have an associated plan of action and milestone documented. Please use the template located at the following URL. [Attach the document as an appendix to the SSP or insert the file object in this section. Submit updates quarterly to ]