Control Number Control Name/Requirement Security Baselines Low High Baseline Configuration CM-2.1 Reviews and Updates Refer to CITR-017: Security Configuration Checklist Program for control details. Baseline configuration documentation must be reviewed and updated: At least annually; When required due to a significant system change; and As an integral part of information system component installations and updates. X X CM-2.3 Retention of Previous Configurations The DOC requires OUs to retain at minimum one previous version of the system configuration to support rollback. X X CM-2.4 Configure Systems, Components, or Devices for High-Risk Areas Refer to CITR-20: Safeguarding Information While on Foreign Travel for control details. X X Security Impact Analysis CM-4 Security Impact Analysis Refer to CITR-019: Risk Management Framework (RMF) for control details. X X X CM-4.1 Separate Test Environments to CITR-019: Risk Management Framework (RMF) for control details. X Configuration Settings CM-6 Configuration Settings Refer to CITR-017: Security Configuration Checklist Program for control details. X X X Least Functionality CM-7.1 Periodic Review Refer to CITR-019: Risk Management Framework (RMF) for control details. X X CM-7.2 Prevent Program Execution The list of prohibited and/or restricted functions, ports, protocols, and/or services, shall be included in the SSP. X X Information System Component Inventory CM-8 Information System Component Inventory X X X
to CITR-017: Security Configuration Checklist Program for control details. CM-8.3 E(3) Automated Unauthorized Component Detection Refer to CITR-017: Security Configuration Checklist Program for control details. The DOC requires OUs to take action as appropriate to address detection of unauthorized components. X X Software Usage Restrictions CM-10 Software Usage Restrictions Refer to CITR-011, Peer-to-Peer Technology and Access and Use for control details. X X X User-Installed Software CM-11 User-Installed Software to CITR-022: Access and Use, for control details. X X X Contingency Planning (CP) Control Number Control Name/Requirement Security Baselines Low High Contingency Plan CP-2 Contingency Plan The DOC requires the OUs to develop and implement a Contingency Plan for the information system addressing contingency responsibilities, assigned individuals with contact information, and activities associated with restoring the system after a disruption or failure. Designated officials within the organization review and approve the Contingency Plan and distribute copies of the plan to key contingency personnel at least annually and update as needed. X X X CP-2.3 Resume Essential Missions/Business Functions See OMB M-04-15: Development of Homeland Security Presidential Directive (HSPD) - 7 Critical Infrastructure Protection to Protect Federal Critical Infrastructures and Key Resources for related requirements. X X CP-2.8 Identify Critical Assets See OMB M-04-15: Development of Homeland Security Presidential Directive (HSPD) - 7 Critical Infrastructure Protection Plans to Protect Federal Critical X X
c. Coordinate results of reviews and investigations with the organizational incident response capability. Visitor Access Records PE-8 Visitor Access Records The DOC requires the OUs to: a. Maintain visitor access records to the facility where the information system resides for at least one year; and b. Review visitor access records at annually. X X X Planning (PL) Control Number Control Name/Requirement Security Baselines Low High System Security Plan PL-2 System Security Plan to CITR-019: Risk Management Framework (RMF) for control details. X X X Rules of Behavior PL-4 of Behavior The DOC requires the OUs to ensure written acknowledgement of CITR-022: Access and Use Policy and/or an OU-specific equivalent policy prior to granting access to any non-public IT systems, networks, or resources. This may be accomplished by providing employees with a copy of the policy and obtaining a written acknowledgement that they have read and understood the policy, or by developing a separate access and use form that describes this policy, to be signed by an employee or associate prior to that individual being provided access to IT systems/network/resources. X X X PL-4.1 Social Media And Networking Restrictions Refer to CITR-022: Access and Use Policy and the DOC Social Media Policy for control details. X X Information Security Architecture PL-8 Information Security Architecture The DOC requires the OUs to: a. Develop an information security architecture for the information system that: 1. Describe the overall philosophy, requirements, and approach to be taken with regard to protecting the X X
SC-7.3 Access Points Refer to the M-08-05: Implementation of Trusted Internet Connections (TIC) and the Trusted Internet Connections (TIC) Reference Architecture Document Version 2.0 for control details. X X SC-7.4 External Telecommunications Services The DOC requires OUs to: (a) Implement a managed interface for each external telecommunication service; (b) Establish a traffic flow policy for each managed interface; (c) Protect the confidentiality and integrity of the information being transmitted across each interface; (d) Document each exception to the traffic flow policy with a supporting mission/business need and duration of that need; and (e) Review exceptions to the traffic flow policy annually and removes exceptions that are no longer supported by an explicit mission/business need. X X Network Disconnect SC-10 Network Disconnect The DOC requires the OUs to ensure the information system terminates a network connection at the end of a session or after thirty (30) minutes of inactivity. X X System and Information Integrity (SI) Control Number Control Name/Requirement Security Baselines Low High Malicious Code Protection SI-3 Malicious Code Protection The DOC requires OUs to: a. Employ malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b. Update malicious code protection mechanisms whenever new releases are available in accordance with OU configuration management policy and procedures; c. Configure malicious code protection mechanisms to: X X X
The DOC requires the OUs to employ automated mechanisms to support management of distributed security testing. Software and Information Integrity SI-7 Software, Firmware, and Information Integrity The DOC requires the OUs to ensure the information system detects and protects against unauthorized changes to software, firmware, and information. X X SI-7.1 Integrity Checks The DOC requires the OUs to reassess the integrity of software, firmware, and information by performing integrity of the system at least X X SI-7.3 Centrally-Managed Integrity Tools The DOC requires the OUs to employ centrally managed integrity verification tools. X Program Management (PM) Control Number Control Name/Requirement Security Baselines Low High Information Security Resources PM-3 Information Security Resources The DOC requires OUs to follow OMB Budget Data Request requirements provided by DOC for reporting IT Security expenditures. X X X Plan of Action and Milestones Process PM-4 Plan of Action and Milestones Process Refer to CITR-018: IT Security Plans of Action and Milestones (POA&M) for control details. X X X Information System Inventory PM-5 Information System Inventory OUs must enter all FISMA-reportable systems into CSAM, review their inventory at least once a fiscal year, and make updates as necessary. X X X Information Security Measures of Performance PM-6 Information Security Measures of Performance OUs must provide FISMA and CyberCAP metrics per DOC OCS guidance, as well as their own performance measures, as appropriate. X X X Critical Infrastructure Plan
Information Security Architecture An embedded, integral part of the enterprise architecture that describes the structure and behavior for an enterprise’s security processes, information security systems, personnel and organizational subunits, showing their alignment with the enterprise’s mission and strategic plans. Information Security Risk See Risk.
Information System-Related Security Risks that arise through the loss of confidentiality, integrity, or availability of information or information systems and that considers impacts to the organization (including assets, mission, functions, image, or reputation), individuals, other organizations, and the Nation. See Risk.
Personally Identifiable Information (PII), Non-Sensitive The following additional of PII may be transmitted electronically without protection because they are not considered sufficiently sensitive to require protection. Work, home and cell phone numbers Work and home addresses Work and personal e-mail addresses Resumes that do not include an SSN or where the SSN is redacted General about found in resumes and Position and