ID

Family

Class

CA

SECURITY ASSESSMENT AND AUTHORIZATION

MANAGEMENT

PL

PLANNING

MANAGEMENT

PM

PROGRAM MANAGEMENT

MANAGEMENT

RA

RISK ASSESSMENT

MANAGEMENT

SA

SYSTEM AND SERVICES ACQUISITION

MANAGEMENT

 

ID

Family

Class

AC

ACCESS CONTROL

TECHNICAL

AU

AUDIT AND ACCOUNTABILITY

TECHNICAL

IA

IDENTIFICATION AND AUTHENTICATION

TECHNICAL

SC

SYSTEM AND COMMUNICATIONS PROTECTION

TECHNICAL

 

ID

Family

Class

AT

AWARENESS AND TRAINING

OPERATIONAL

CM

CONFIGURATION MANAGEMENT

OPERATIONAL

CP

CONTINGENCY PLANNING

OPERATIONAL

IR

INCIDENT RESPONSE

OPERATIONAL

MA

MAINTENANCE

OPERATIONAL

MP

MEDIA PROTECTION

OPERATIONAL

PE

PHYSICAL AND ENVIRONMENTAL PROTECTION

OPERATIONAL

PS

PERSONNEL SECURITY

OPERATIONAL

SI

SYSTEM AND INFORMATION INTEGRITY

OPERATIONAL

 

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-1 ACCESS CONTROL POLICY AND PROCEDURES

Control:

The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]:
    a. A formal, documented access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    b. Formal, documented procedures to facilitate the implementation of the access control policy and associated access controls.
    

Supplemental Guidance:

This control is intended to produce the policy and procedures that are required for the effective implementation of selected security controls and control enhancements in the access control family. The policy and procedures are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary. The access control policy can be included as part of the general information security policy for the organization. Access control procedures can be developed for the security program in general and for a particular information system, when required. The organizational risk management strategy is a key factor in the development of the access control policy. Related control: PM-9.

References:

NIST Special Publications 800-12, 800-100.

Priority and Baseline Allocation:

 

P1

LOW   AC-1

MOD   AC-1

HIGH   AC-1

ISO/IEC 27001 Annex A Control Mapping:

A.5.1.1	Information security policy document
A.5.1.2	Review of the information security policy
A.6.1.1	Management commitment to information security
A.6.1.3	Allocation of information security responsibilities
A.8.1.1	Roles and Responsibilities
A.10.1.1	Documented operating procedures
A.10.8.1	Information exchange policies and procedures
A.11.1.1	Access control policy
A.11.2.1	User registration
A.11.2.2	Privilege management
A.11.4.1	Policy on use of network services
A.11.7.1	Mobile computing and communications
A.11.7.2	Teleworking
A.15.1.1	Identification of applicable legislation
A.15.2.1	Compliance with security policies and standards

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-2 ACCOUNT MANAGEMENT

Control:

The organization manages information system accounts, including:
    a. Identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary);
    b. Establishing conditions for group membership;
    c. Identifying authorized users of the information system and specifying access privileges;
    d. Requiring appropriate approvals for requests to establish accounts;
    e. Establishing, activating, modifying, disabling, and removing accounts;
    f. Specifically authorizing and monitoring the use of guest/anonymous and temporary accounts;
    g. Notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes;
    h. Deactivating:
    (i) temporary accounts that are no longer required; and
    (ii) accounts of terminated or transferred users;
    i. Granting access to the system based on:
    (i) a valid access authorization;
    (ii) intended system usage; and
    (iii) other attributes as required by the organization or associated missions/business functions; and
    j. Reviewing accounts [Assignment: organization-defined frequency].

Supplemental Guidance:

The identification of authorized users of the information system and the specification of access privileges is consistent with the requirements in other security controls in the security plan. Users requiring administrative privileges on information system accounts receive additional scrutiny by organizational officials responsible for approving such accounts and privileged access. Related controls: AC-3, AC-4, AC-5, AC-6, AC-10, AC-17, AC-19, AC-20, AU-9, IA-4, IA-5, CM-5, CM-6, MA-3, MA-4, MA-5, SA-7, SC-13, SI-9.

Control Enhancements:

(1) The organization employs automated mechanisms to support the management of information system accounts.

(2) The information system automatically terminates temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].

(3) The information system automatically disables inactive accounts after [Assignment: organization-defined time period].

(4) The information system automatically audits account creation, modification, disabling, and termination actions and notifies, as required, appropriate individuals.

(5) The organization:
    (a) Requires that users log out when [Assignment: organization defined time-period of expected inactivity and/or description of when to log out];
    (b) Determines normal time-of-day and duration usage for information system accounts;
    (c) Monitors for atypical usage of information system accounts; and
    (d) Reports atypical usage to designated organizational officials.
    

(6) The information system dynamically manages user privileges and associated access authorizations.

Enchancement Supplemental Guidance:

In contrast to conventional access control approaches which employ static information system accounts and predefined sets of user privileges, many service-oriented architecture implementations rely on run time access control decisions facilitated by dynamic privilege management. While user identities remain relatively constant over time, user privileges may change more frequently based on the ongoing mission/business requirements and operational needs of the organization.

(7) The organization:
    (a) Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes information system and network privileges into roles; and
    (b) Tracks and monitors privileged role assignments.

Enchancement Supplemental Guidance:

Privileged roles include, for example, key management, network and system administration, database administration, web administration.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AC-2

MOD   AC-2 (1) (2) (3) (4)

HIGH   AC-2 (1) (2) (3) (4)

ISO/IEC 27001 Annex A Control Mapping:

A.8.3.3	Removal of access rights
A.11.2.1	User registration
A.11.2.2	Privilege management
A.11.2.4	Review of user access rights
A.15.2.1	Compliance with security policies and standards

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-3 ACCESS ENFORCEMENT

Control:

The information system enforces approved authorizations for logical access to the system in accordance with applicable policy.

Supplemental Guidance:

Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains) in the information system. In addition to enforcing authorized access at the information-system level, access enforcement mechanisms are employed at the application level, when necessary, to provide increased information security for the organization. Consideration is given to the implementation of an audited, explicit override of automated mechanisms in the event of emergencies or other serious events. If encryption of stored information is employed as an access enforcement mechanism, the cryptography used is FIPS 140-2 (as amended) compliant. For classified information, the cryptography used is largely dependent on the classification level of the information and the clearances of the individuals having access to the information. Mechanisms implemented by AC-3 are configured to enforce authorizations determined by other security controls. Related controls: AC-2, AC-4, AC-5, AC-6, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-22, AU-9, CM-5, CM-6, MA-3, MA-4, MA-5, SA-7, SC-13, SI-9.

Control Enhancements:

(1) [Withdrawn: Incorporated into AC-6].

(2) The information system enforces dual authorization, based on organizational policies and procedures for [Assignment: organization-defined privileged commands].

Enchancement Supplemental Guidance:

Dual authorization mechanisms require two forms of approval to execute. The organization does not employ dual authorization mechanisms when an immediate response is necessary to ensure public and environmental safety.

(3) The information system enforces [Assignment: organization-defined nondiscretionary access control policies] over [Assignment: organization-defined set of users and resources] where the policy rule set for each policy specifies:
    (a) Access control information (i.e., attributes) employed by the policy rule set (e.g., position, nationality, age, project, time of day); and
    (b) Required relationships among the access control information to permit access.
    

Enchancement Supplemental Guidance:

Nondiscretionary access control policies that may be implemented by organizations include, for example, Attribute-Based Access Control, Mandatory Access Control, and Originator Controlled Access Control. Nondiscretionary access control policies may be employed by organizations in addition to the employment of discretionary access control policies.

For Mandatory Access Control (MAC): Policy establishes coverage over all subjects and objects under its control to ensure that each user receives only that information to which the user is authorized access based on classification of the information, and on user clearance and formal access authorization. The information system assigns appropriate security attributes (e.g., labels/security domains/types) to subjects and objects, and uses these attributes as the basis for MAC decisions. The Bell-LaPadula security model defines allowed access with regard to an organization-defined set of strictly hierarchical security levels as follows: A subject can read an object only if the security level of the subject dominates the security level of the object and a subject can write to an object only if two conditions are met: the security level of the object dominates the security level of the subject, and the security level of the user's clearance dominates the security level of the object (no read up, no write down).

For Role-Based Access Control (RBAC): Policy establishes coverage over all users and resources to ensure that access rights are grouped by role name, and access to resources is restricted to users who have been authorized to assume the associated role.

(4) The information system enforces a Discretionary Access Control (DAC) policy that:
    (a) Allows users to specify and control sharing by named individuals or groups of individuals, or by both;
    (b) Limits propagation of access rights; and
    (c) Includes or excludes access to the granularity of a single user.

(5) The information system prevents access to [Assignment: organization-defined security-relevant information] except during secure, nonoperable system states.

Enchancement Supplemental Guidance:

Security-relevant information is any information within the information system that can potentially impact the operation of security functions in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data. Filtering rules for routers and firewalls, cryptographic key management information, key configuration parameters for security services, and access control lists are examples of security-relevant information. Secure, nonoperable system states are states in which the information system is not performing mission/business-related processing (e.g., the system is off-line for maintenance, troubleshooting, boot-up, shutdown).

(6) The organization encrypts or stores off-line in a secure location [Assignment: organization-defined user and/or system information].

Enchancement Supplemental Guidance:

The use of encryption by the organization reduces the probability of unauthorized disclosure of information and can also detect unauthorized changes to information. Removing information from online storage to offline storage eliminates the possibility of individuals gaining unauthorized access via a network. Related control: MP-4.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AC-3

MOD   AC-3

HIGH   AC-3

ISO/IEC 27001 Annex A Control Mapping:

A.10.8.1	Information exchange policies and procedures
A.11.4.4	Remote diagnostic and configuration port protection
A.11.4.6	Network connection control
A.11.5.4	Use of system utilities
A.11.6.1	Information access restriction
A.12.4.2	Protection of system test data

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-4 INFORMATION FLOW ENFORCEMENT

Control:

The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems in accordance with applicable policy.

Supplemental Guidance:

Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to that information. A few examples of flow control restrictions include: keeping export controlled information from being transmitted in the clear to the Internet, blocking outside traffic that claims to be from within the organization, and not passing any web requests to the Internet that are not from the internal web proxy. Information flow control policies and enforcement mechanisms are commonly employed by organizations to control the flow of information between designated sources and destinations (e.g., networks, individuals, devices) within information systems and between interconnected systems. Flow control is based on the characteristics of the information and/or the information path. Specific examples of flow control enforcement can be found in boundary protection devices (e.g., proxies, gateways, guards, encrypted tunnels, firewalls, and routers) that employ rule sets or establish configuration settings that restrict information system services, provide a packet-filtering capability based on header information, or message-filtering capability based on content (e.g., using key word searches or document characteristics). Mechanisms implemented by AC-4 are configured to enforce authorizations determined by other security controls. Related controls: AC-17, AC-19, AC-21, CM-7, SA-8, SC-2, SC-5, SC-7, SC-18.

Control Enhancements:

(1) The information system enforces information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions.

Enchancement Supplemental Guidance:

Information flow enforcement mechanisms compare security attributes on all information (data content and data structure), source and destination objects, and respond appropriately (e.g., block, quarantine, alert administrator) when the mechanisms encounter information flows not explicitly allowed by the information flow policy. Information flow enforcement using explicit security attributes can be used, for example, to control the release of certain types of information.

(2) The information system enforces information flow control using protected processing domains (e.g., domain type-enforcement) as a basis for flow control decisions.

(3) The information system enforces dynamic information flow control based on policy that allows or disallows information flows based on changing conditions or operational considerations.

(4) The information system prevents encrypted data from bypassing content-checking mechanisms.

(5) The information system enforces [Assignment: organization-defined limitations on the embedding of data types within other data types].

(6) The information system enforces information flow control on metadata.

(7) The information system enforces [Assignment: organization-defined one-way flows] using hardware mechanisms.

(8) The information system enforces information flow control using [Assignment: organization-defined security policy filters] as a basis for flow control decisions.

Enchancement Supplemental Guidance:

Organization-defined security policy filters include, for example, dirty word filters, file type checking filters, structured data filters, unstructured data filters, metadata content filters, and hidden content filters. Structured data permits the interpretation of its content by virtue of atomic elements that are understandable by an application and indivisible. Unstructured data refers to masses of (usually) digital information that does not have a data structure or has a data structure that is not easily readable by a machine. Unstructured data consists of two basic categories:
(i) bitmap objects that are inherently non language-based (i.e., image, video, or audio files); and
(ii) textual objects that are based on a written or printed language (i.e., commercial off-the-shelf word processing documents, spreadsheets, or emails).

(9) The information system enforces the use of human review for [Assignment: organization-defined security policy filters] when the system is not capable of making an information flow control decision.

(10) The information system provides the capability for a privileged administrator to enable/disable [Assignment: organization-defined security policy filters].

(11) The information system provides the capability for a privileged administrator to configure [Assignment: organization-defined security policy filters] to support different security policies.

Enchancement Supplemental Guidance:

For example, to reflect changes in the security policy, an administrator can change the list of ``dirty words'' that the security policy mechanism checks in accordance with the definitions provided by the organization.

(12) The information system, when transferring information between different security domains, identifies information flows by data type specification and usage.

Enchancement Supplemental Guidance:

Data type specification and usage include, for example, using file naming to reflect type of data and limiting data transfer based on file type.

(13) The information system, when transferring information between different security domains, decomposes information into policy-relevant subcomponents for submission to policy enforcement mechanisms.

Enchancement Supplemental Guidance:

Policy enforcement mechanisms include the filtering and/or sanitization rules that are applied to information prior to transfer to a different security domain. Parsing transfer files facilitates policy decisions on source, destination, certificates, classification, subject, attachments, and other information security-related component differentiators. Policy rules for cross domain transfers include, for example, limitations on embedding components/information types within other components/information types, prohibiting more than two-levels of embedding, and prohibiting the transfer of archived information types.

(14) The information system, when transferring information between different security domains, implements policy filters that constrain data structure and content to [Assignment: organization-defined information security policy requirements].

Enchancement Supplemental Guidance:

Constraining file lengths, allowed enumerations, character sets, schemas, and other data object attributes reduces the range of potential malicious and/or unsanctioned content. Examples of constraints include ensuring that:
(i) character data fields only contain printable ASCII;
(ii) character data fields only contain alpha-numeric characters;
(iii) character data fields do not contain special characters; or
(iv) maximum field sizes and file lengths are enforced based upon organization-defined security policy

(15) The information system, when transferring information between different security domains, detects unsanctioned information and prohibits the transfer of such information in accordance with the security policy.

Enchancement Supplemental Guidance:

Actions to support this enhancement include: checking all transferred information for malware, implementing dirty word list searches on transferred information, and applying the same protection measures to metadata (e.g., security attributes) that is applied to the information payload.

(16) The information system enforces security policies regarding information on interconnected systems.

Enchancement Supplemental Guidance:

Transferring information between interconnected information systems of differing security policies introduces risk that such transfers violate one or more policies. While security policy violations may not be absolutely prohibited, policy guidance from information owners/stewards is implemented at the policy enforcement point between the interconnected systems. Specific architectural solutions are mandated, when required, to reduce the potential for undiscovered vulnerabilities. Architectural solutions include, for example:
(i) prohibiting information transfers between interconnected systems (i.e. implementing access only, one way transfer mechanisms);
(ii) employing hardware mechanisms to enforce unitary information flow directions; and
(iii) implementing fully tested, re-grading mechanisms to reassign security attributes and associated security labels.

(17) The information system:
    (a) Uniquely identifies and authenticates source and destination domains for information transfer;
    (b) Binds security attributes to information to facilitate information flow policy enforcement; and
    (c) Tracks problems associated with the security attribute binding and information transfer.
    

Enchancement Supplemental Guidance:

Attribution is a critical component of a security concept of operations. The ability to identify source and destination points for information flowing in an information system, allows forensic reconstruction of events when required, and increases policy compliance by attributing policy violations to specific organizations/individuals. Means to enforce this enhancement include ensuring that the information system resolution labels distinguish between information systems and organizations, and between specific system components or individuals involved in preparing, sending, receiving, or disseminating information.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   AC-4

HIGH   AC-4

ISO/IEC 27001 Annex A Control Mapping:

A.10.6.1	Network controls
A.10.8.1	Information exchange policies and procedures
A.11.4.5	Segregation in networks
A.11.4.7	Network routing control
A.11.7.2	Teleworking
A.12.4.2	Protection of system test data
A.12.5.4	Information leakage

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-5 SEPARATION OF DUTIES

Control:

The organization:
    a. Separates duties of individuals as necessary, to prevent malevolent activity without collusion;
    b. Documents separation of duties; and
    c. Implements separation of duties through assigned information system access authorizations.
    

Supplemental Guidance:

Examples of separation of duties include:
(i) mission functions and distinct information system support functions are divided among different individuals/roles;
(ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security);
(iii) security personnel who administer access control functions do not administer audit functions; and
(iv) different administrator accounts for different roles. Access authorizations defined in this control are implemented by control AC-3. Related controls: AC-3.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   AC-5

HIGH   AC-5

ISO/IEC 27001 Annex A Control Mapping:

A.6.1.3	Allocation of information security responsibilities
A.8.1.1	Roles and Responsibilities
A.10.1.3	Segregation of duties
A.11.1.1	Access control policy
A.11.4.1	Policy on use of network services

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-6 LEAST PRIVILEGE

Control:

The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

Supplemental Guidance:

The access authorizations defined in this control are largely implemented by control AC-3. The organization employs the concept of least privilege for specific duties and information systems (including specific ports, protocols, and services) in accordance with risk assessments as necessary to adequately mitigate risk to organizational operations and assets, individuals, other organizations, and the Nation. Related controls: AC-2, AC-3, CM-7.

Control Enhancements:

(1) The organization explicitly authorizes access to [Assignment: organization-defined list of security functions (deployed in hardware, software, and firmware) and security-relevant information].

Enchancement Supplemental Guidance:

Establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters are examples of security functions. Explicitly authorized personnel include, for example, security administrators, system and network administrators, system security officers, system maintenance personnel, system programmers, and other privileged users. Related control: AC-17.

(2) The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined list of security functions or security-relevant information], use non-privileged accounts, or roles, when accessing other system functions, and if feasible, audits any use of privileged accounts, or roles, for such functions.

Enchancement Supplemental Guidance:

This control enhancement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy such as Role Based Access Control (RBAC) is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. Audit of privileged activity may require physical separation employing information systems on which the user does not have privileged access.

(3) The organization authorizes network access to [Assignment: organization-defined privileged commands] only for compelling operational needs and documents the rationale for such access in the security plan for the information system.

(4) The information system provides separate processing domains to enable finer-grained allocation of user privileges.

Enchancement Supplemental Guidance:

Employing virtualization techniques to allow greater privilege within a virtual machine while restricting privilege to the underlying actual machine is an example of providing separate processing domains for finer-grained allocation of user privileges.

(5) The organization limits authorization to super user accounts on the information system to designated system administration personnel.

Enchancement Supplemental Guidance:

Super user accounts are typically described as ``root'' or ``administrator'' for various types of commercial off-the-shelf operating systems. Configuring organizational information systems (e.g., notebook/laptop computers, servers, workstations) such that day-to-day users are not authorized access to super user accounts is an example of limiting system authorization. The organization may differentiate in the application of this control enhancement between allowed privileges for local information system accounts and for domain accounts provided the organization retains the ability to control the configuration of the system with regard to key security parameters and as otherwise necessary to sufficiently mitigate risk.

(6) The organization prohibits privileged access to the information system by non-organizational users.

Enchancement Supplemental Guidance:

A qualified organizational user may be advised by a non-organizational user, if necessary.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   AC-6 (1) (2)

HIGH   AC-6 (1) (2)

ISO/IEC 27001 Annex A Control Mapping:

A.6.1.3	Allocation of information security responsibilities
A.8.1.1	Roles and Responsibilities
A.11.1.1	Access control policy
A.11.2.2	Privilege management
A.11.4.1	Policy on use of network services
A.11.4.4	Remote diagnostic and configuration port protection
A.11.4.6	Network connection control
A.11.5.4	Use of system utilities
A.11.6.1	Information access restriction
A.12.4.3	Access control to program source code

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-7 UNSUCCESSFUL LOGIN ATTEMPTS

Control:

The information system:
    a. Enforces a limit of [Assignment: organization-defined number] consecutive invalid access attempts by a user during a [Assignment: organization-defined time period]; and
    b. Automatically [Selection: locks the account/node for an [Assignment: organization-defined time period]; locks the account/node until released by an administrator; delays next login prompt according to [Assignment: organization-defined delay algorithm]] when the maximum number of unsuccessful attempts is exceeded. The control applies regardless of whether the login occurs via a local or network connection.
    

Supplemental Guidance:

Due to the potential for denial of service, automatic lockouts initiated by the information system are usually temporary and automatically release after a predetermined time period established by the organization. If a delay algorithm is selected, the organization may chose to employ different algorithms for different information system components based on the capabilities of those components. Response to unsuccessful login attempts may be implemented at both the operating system and the application levels. This control applies to all accesses other than those accesses explicitly identified and documented by the organization in AC-14.

Control Enhancements:

(1) The information system automatically locks the account/node until released by an administrator when the maximum number of unsuccessful attempts is exceeded

(2) The information system provides additional protection for mobile devices accessed via login by purging information from the device after [Assignment: organization-defined number] consecutive, unsuccessful login attempts to the device.

Enchancement Supplemental Guidance:

This enhancement applies only to mobile devices for which a login occurs (e.g., personal digital assistants) and not to mobile devices accessed without a login such as removable media. In certain situations, this enhancement may not apply to mobile devices if the information on the device is encrypted with sufficiently strong encryption mechanisms, making purging unnecessary. The login is to the mobile device, not to any one account on the device. Therefore, a successful login to any account on the mobile device resets the unsuccessful login count to zero.

References:

None.

Priority and Baseline Allocation:

 

P2

LOW   AC-7

MOD   AC-7

HIGH   AC-7

ISO/IEC 27001 Annex A Control Mapping:

A.11.5.1

Secure log-on procedures

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-8 SYSTEM USE NOTIFICATION

Control:

The information system:
    a. Displays an approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:
    (i) users are accessing a U.S. Government information system;
    (ii) system usage may be monitored, recorded, and subject to audit;
    (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
    (iv) use of the system indicates consent to monitoring and recording;
    b. Retains the notification message or banner on the screen until users take explicit actions to log on to or further access the information system; and
    c. For publicly accessible systems:
    (i) displays the system use information when appropriate, before granting further access;
    (ii) displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
    (iii) includes in the notice given to public users of the information system, a description of the authorized uses of the system.
    

Supplemental Guidance:

System use notification messages can be implemented in the form of warning banners displayed when individuals log in to the information system. System use notification is intended only for information system access that includes an interactive login interface with a human user and is not intended to require notification when an interactive interface does not exist.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AC-8

MOD   AC-8

HIGH   AC-8

ISO/IEC 27001 Annex A Control Mapping:

A.6.2.2	Addressing security when dealing with customers
A.8.1.1	Roles and Responsibilities
A.11.5.1	Secure log-on procedures
A.15.1.5	Prevention of misuse of information processing facilities

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-9 PREVIOUS LOGON (ACCESS) NOTIFICATION

Control:

The information system notifies the user, upon successful logon (access), of the date and time of the last logon (access).

Supplemental Guidance:

This control is intended to cover both traditional logons to information systems and general accesses to information systems that occur in other types of architectural configurations (e.g., service oriented architectures).

Control Enhancements:

(1) The information system notifies the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.

(2) The information system notifies the user of the number of [Selection: successful logins/accesses; unsuccessful login/access attempts; both] during [Assignment: organization-defined time period].

(3) The information system notifies the user of [Assignment: organization-defined set of security-related changes to the user's account] during [Assignment: organization-defined time period].

References:

None.

Priority and Baseline Allocation:

 

P0

LOW   Not Selected

MOD   Not Selected

HIGH   Not Selected

ISO/IEC 27001 Annex A Control Mapping:

A.11.5.1

Secure log-on procedures

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-10 CONCURRENT SESSION CONTROL

Control:

The information system limits the number of concurrent sessions for each system account to [Assignment: organization-defined number].

Supplemental Guidance:

The organization may define the maximum number of concurrent sessions for an information system account globally, by account type, by account, or a combination. This control addresses concurrent sessions for a given information system account and does not address concurrent sessions by a single user via multiple system accounts.

References:

None.

Priority and Baseline Allocation:

 

P2

LOW   Not Selected

MOD   Not Selected

HIGH   AC-10

ISO/IEC 27001 Annex A Control Mapping:

A.11.5.1

Secure log-on procedures

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-11 SESSION LOCK

Control:

The information system:
    a. Prevents further access to the system by initiating a session lock after [Assignment: organization-defined time period] of inactivity or upon receiving a request from a user; and
    b. Retains the session lock until the user reestablishes access using established identification and authentication procedures.
    

Supplemental Guidance:

A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. This is typically at the operating system-level, but may be at the application-level. A session lock is not a substitute for logging out of the information system, for example, if the organization requires users to log out at the end of the workday.

Control Enhancements:

(1) The information system session lock mechanism, when activated on a device with a display screen, places a publically viewable pattern onto the associated display, hiding what was previously visible on the screen.

References:

OMB Memorandum 06-16.

Priority and Baseline Allocation:

 

P3

LOW   Not Selected

MOD   AC-11

HIGH   AC-11

ISO/IEC 27001 Annex A Control Mapping:

A.11.3.2	Unattended user equipment
A.11.3.3	Clear desk and clear screen policy
A.11.5.5	Session time-out

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-12 SESSION TERMINATION

Control:

[Withdrawn: Incorporated into SC-10].

Supplemental Guidance:

References:

Priority and Baseline Allocation:

 

---

LOW   ---

MOD   ---

HIGH   ---

ISO/IEC 27001 Annex A Control Mapping:

---

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-13 SUPERVISION AND REVIEW - ACCESS CONTROL

Control:

[Withdrawn: Incorporated into AC-2 and AU-6].

Supplemental Guidance:

References:

Priority and Baseline Allocation:

 

---

LOW   ---

MOD   ---

HIGH   ---

ISO/IEC 27001 Annex A Control Mapping:

---

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION

Control:

The organization:
    a. Identifies specific user actions that can be performed on the information system without identification or authentication; and
    b. Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification and authentication.
    

Supplemental Guidance:

This control is intended for those specific instances where an organization determines that no identification and authentication is required; it is not, however, mandating that such instances exist in given information system. The organization may allow a limited number of user actions without identification and authentication (e.g., when individuals access public websites or other publicly accessible federal information systems such as http://www.usa.gov). Organizations also identify any actions that normally require identification or authentication but may under certain circumstances (e.g., emergencies), allow identification or authentication mechanisms to be bypassed. Such bypass may be, for example, via a software-readable physical switch that commands bypass of the login functionality and is protected from accidental or unmonitored use. This control does not apply to situations where identification and authentication have already occurred and are not being repeated, but rather to situations where identification and/or authentication have not yet occurred. Related control: CP-2, IA-2.

Control Enhancements:

(1) The organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission/business objectives.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AC-14

MOD   AC-14 (1)

HIGH   AC-14 (1)

ISO/IEC 27001 Annex A Control Mapping:

A.11.6.1

Information access restriction

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-15 AUTOMATED MARKING

Control:

[Withdrawn: Incorporated into MP-3].

Supplemental Guidance:

References:

Priority and Baseline Allocation:

 

---

LOW   ---

MOD   ---

HIGH   ---

ISO/IEC 27001 Annex A Control Mapping:

---

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-16 SECURITY ATTRIBUTES

Control:

The information system supports and maintains the binding of [Assignment: organization-defined security attributes] to information in storage, in process, and in transmission.

Supplemental Guidance:

Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information. These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. The term security label is often used to associate a set of security attributes with a specific information object as part of the data structure for that object (e.g., user access privileges, nationality, affiliation as contractor). Related controls: AC-3, AC-4, SC-16, MP-3.

Control Enhancements:

(1) The information system dynamically reconfigures security attributes in accordance with an identified security policy as information is created and combined.

(2) The information system allows authorized entities to change security attributes.

(3) The information system maintains the binding of security attributes to information with sufficient assurance that the information--attribute association can be used as the basis for automated policy actions.

Enchancement Supplemental Guidance:

Examples of automated policy actions include automated access control decisions (e.g., Mandatory Access Control decisions), or decisions to release (or not release) information (e.g., information flows via cross domain systems).

(4) The information system allows authorized users to associate security attributes with information.

Enchancement Supplemental Guidance:

The support provided by the information system can vary from prompting users to select security attributes to be associated with specific information objects, to ensuring that the combination of attributes selected is valid.

(5) The information system displays security attributes in human-readable form on each object output from the system to system output devices to identify [Assignment: organization-identified set of special dissemination, handling, or distribution instructions] using [Assignment: organization-identified human readable, standard naming conventions].

Enchancement Supplemental Guidance:

Objects output from the information system include, for example, pages, screens, or equivalent. Output devices include, for example, printers and video displays on computer terminals, monitors, screens on notebook/laptop computers and personal digital assistants.

References:

None.

Priority and Baseline Allocation:

 

P0

LOW   Not Selected

MOD   Not Selected

HIGH   Not Selected

ISO/IEC 27001 Annex A Control Mapping:

A.7.2.2

Information labeling and handling

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-17 REMOTE ACCESS

Control:

The organization:
    a. Documents allowed methods of remote access to the information system;
    b. Establishes usage restrictions and implementation guidance for each allowed remote access method;
    c. Monitors for unauthorized remote access to the information system;
    d. Authorizes remote access to the information system prior to connection; and
    e. Enforces requirements for remote connections to the information system.

Supplemental Guidance:

This control requires explicit authorization prior to allowing remote access to an information system without specifying a specific format for that authorization. For example, while the organization may deem it appropriate to use a system interconnection agreement to authorize a given remote access, such agreements are not required by this control. Remote access is any access to an organizational information system by a user (or process acting on behalf of a user) communicating through an external network (e.g., the Internet). Examples of remote access methods include dial-up, broadband, and wireless (see AC-18 for wireless access). A virtual private network when adequately provisioned with appropriate security controls, is considered an internal network (i.e., the organization establishes a network connection between organization-controlled endpoints in a manner that does not require the organization to depend on external networks to protect the confidentiality or integrity of information transmitted across the network). Remote access controls are applicable to information systems other than public web servers or systems specifically designed for public access. Enforcing access restrictions associated with remote connections is accomplished by control AC-3. Related controls: AC-3, AC-18, AC-20, IA-2, IA-3, IA-8, MA-4.

Control Enhancements:

(1) The organization employs automated mechanisms to facilitate the monitoring and control of remote access methods.

Enchancement Supplemental Guidance:

Automated monitoring of remote access sessions allows organizations to audit user activities on a variety of information system components (e.g., servers, workstations, notebook/laptop computers) and to ensure compliance with remote access policy.

(2) The organization uses cryptography to protect the confidentiality and integrity of remote access sessions.

Enchancement Supplemental Guidance:

The encryption strength of mechanism is selected based on the security categorization of the information. Related controls: SC-8, SC-9, SC-13.

(3) The information system routes all remote accesses through a limited number of managed access control points.

Enchancement Supplemental Guidance:

Related control: SC-7.

(4) The organization authorizes the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs and documents the rationale for such access in the security plan for the information system.

Enchancement Supplemental Guidance:

Related control: AC-6.

(5) The organization monitors for unauthorized remote connections to the information system [Assignment: organization-defined frequency], and takes appropriate action if an unauthorized connection is discovered.

(6) The organization ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.

(7) The organization ensures that remote sessions for accessing [Assignment: organization-defined list of security functions and security-relevant information] employ [Assignment: organization-defined additional security measures] and are audited.

Enchancement Supplemental Guidance:

Additional security measures are typically above and beyond standard bulk or session layer encryption (e.g., Secure Shell [SSH], Virtual Private Networking [VPN] with blocking mode enabled). Related controls: SC-8, SC-9.

(8) The organization disables [Assignment: organization-defined networking protocols within the information system deemed to be nonsecure] except for explicitly identified components in support of specific operational requirements.

Enchancement Supplemental Guidance:

The organization can either make a determination of the relative security of the networking protocol or base the security decision on the assessment of other entities. Bluetooth and peer-to-peer networking are examples of less than secure networking protocols.

References:

NIST Special Publications 800-46, 800-77, 800-113, 800-114, 800-121.

Priority and Baseline Allocation:

 

P1

LOW   AC-17

MOD   AC-17 (1) (2) (3) (4) (5) (7) (8)

HIGH   AC-17 (1) (2) (3) (4) (5) (7) (8)

ISO/IEC 27001 Annex A Control Mapping:

A.10.6.1	Network controls
A.10.8.1	Information exchange policies and procedures
A.11.1.1	Access control policy
A.11.4.1	Policy on use of network services
A.11.4.2	User authentication for external connections
A.11.4.4	Remote diagnostic and configuration port protection
A.11.4.6	Network connection control
A.11.4.7	Network routing control
A.11.7.1	Mobile computing and communications
A.11.7.2	Teleworking

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-18 WIRELESS ACCESS

Control:

The organization:
    a. Establishes usage restrictions and implementation guidance for wireless access;
    b. Monitors for unauthorized wireless access to the information system;
    c. Authorizes wireless access to the information system prior to connection; and
    d. Enforces requirements for wireless connections to the information system.
    

Supplemental Guidance:

Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication. In certain situations, wireless signals may radiate beyond the confines and control of organization-controlled facilities. Related controls: AC-3, IA-2, IA-3, IA-8.

Control Enhancements:

(1) The information system protects wireless access to the system using authentication and encryption.

Enchancement Supplemental Guidance:

Authentication applies to user, device, or both as necessary. Related control: SC-13.

(2) The organization monitors for unauthorized wireless connections to the information system, including scanning for unauthorized wireless access points [Assignment: organization-defined frequency], and takes appropriate action if an unauthorized connection is discovered.

Enchancement Supplemental Guidance:

Organizations proactively search for unauthorized wireless connections including the conduct of thorough scans for unauthorized wireless access points. The scan is not necessarily limited to only those areas within the facility containing the information systems, yet is conducted outside of those areas only as needed to verify that unauthorized wireless access points are not connected to the system.

(3) The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.

(4) The organization does not allow users to independently configure wireless networking capabilities.

(5) The organization confines wireless communications to organization-controlled boundaries.

Enchancement Supplemental Guidance:

Actions that may be taken by the organization to confine wireless communications to organization-controlled boundaries include:
(i) reducing the power of the wireless transmission such that it cannot transit the physical perimeter of the organization;
(ii) employing measures such as TEMPEST to control wireless emanations; and
(iii) configuring the wireless access such that it is point to point in nature.

References:

NIST Special Publications 800-48, 800-94, 800-97.

Priority and Baseline Allocation:

 

P1

LOW   AC-18

MOD   AC-18 (1)

HIGH   AC-18 (1) (2) (4) (5)

ISO/IEC 27001 Annex A Control Mapping:

A.10.6.1	Network controls
A.10.8.1	Information exchange policies and procedures
A.11.1.1	Access control policy
A.11.4.1	Policy on use of network services
A.11.4.2	User authentication for external connections
A.11.4.4	Remote diagnostic and configuration port protection
A.11.4.6	Network connection control
A.11.4.7	Network routing control
A.11.7.1	Mobile computing and communications
A.11.7.2	Teleworking

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-19 ACCESS CONTROL FOR MOBILE DEVICES

Control:

The organization:
    a. Establishes usage restrictions and implementation guidance for organization-controlled mobile devices;
    b. Authorizes connection of mobile devices meeting organizational usage restrictions and implementation guidance to organizational information systems;
    c. Monitors for unauthorized connections of mobile devices to organizational information systems;
    d. Enforces requirements for the connection of mobile devices to organizational information systems;
    e. Disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction;fg. Issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures; and
    g. Applies [Assignment: organization-defined inspection and preventative measures] to mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.

Supplemental Guidance:

Mobile devices include portable storage media (e.g., USB memory sticks, external hard disk drives) and portable computing and communications devices with information storage capability (e.g., notebook/laptop computers, personal digital assistants, cellular telephones, digital cameras, and audio recording devices). Organization-controlled mobile devices include those devices for which the organization has the authority to specify and the ability to enforce specific security requirements. Usage restrictions and implementation guidance related to mobile devices include, for example, configuration management, device identification and authentication, implementation of mandatory protective software (e.g., malicious code detection, firewall), scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware (e.g., wireless, infrared). Examples of information system functionality that provide the capability for automatic execution of code are AutoRun and AutoPlay.

Organizational policies and procedures for mobile devices used by individuals departing on and returning from travel include, for example, determining which locations are of concern, defining required configurations for the devices, ensuring that the devices are configured as intended before travel is initiated, and applying specific measures to the device after travel is completed. Specially configured mobile devices include, for example, computers with sanitized hard drives, limited applications, and additional hardening (e.g., more stringent configuration settings). Specified measures applied to mobile devices upon return from travel include, for example, examining the device for signs of physical tampering and purging/reimaging the hard disk drive. Protecting information residing on mobile devices is covered in the media protection family. Related controls: MP-4, MP-5.

Control Enhancements:

(1) The organization restricts the use of writable, removable media in organizational information systems.

(2) The organization prohibits the use of personally owned, removable media in organizational information systems.

(3) The organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner.

Enchancement Supplemental Guidance:

An identifiable owner (e.g., individual, organization, or project) for removable media helps to reduce the risk of using such technology by assigning responsibility and accountability for addressing known vulnerabilities in the media (e.g., malicious code insertion).

(4) The organization:
    (a) Prohibits the use of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information unless specifically permitted by the appropriate authorizing official(s); and
    (b) Enforces the following restrictions on individuals permitted to use mobile devices in facilities containing information systems processing, storing, or transmitting classified information:
    - Connection of unclassified mobile devices to classified information systems is prohibited;
    - Connection of unclassified mobile devices to unclassified information systems requires approval from the appropriate authorizing official(s);
    - Use of internal or external modems or wireless interfaces within the mobile devices is prohibited; and
    - Mobile devices and the information stored on those devices are subject to random reviews/inspections by [Assignment: organization-defined security officials], and if classified information is found, the incident handling policy is followed.
    

References:

NIST Special Publications 800-114, 800-124.

Priority and Baseline Allocation:

 

P1

LOW   AC-19

MOD   AC-19 (1) (2) (3)

HIGH   AC-19 (1) (2) (3)

ISO/IEC 27001 Annex A Control Mapping:

A.10.4.1	Controls against malicious code
A.11.1.1	Access control policy
A.11.4.3	Equipment identification in networks
A.11.7.1	Mobile computing and communications

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-20 USE OF EXTERNAL INFORMATION SYSTEMS

Control:

The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to:
    a. Access the information system from the external information systems; and
    b. Process, store, and/or transmit organization-controlled information using the external information systems.

Supplemental Guidance:

External information systems are information systems or components of information systems that are outside of the authorization boundary established by the organization and for which the organization typically has no direct supervision and authority over the application of required security controls or the assessment of security control effectiveness. External information systems include, but are not limited to:
(i) personally owned information systems (e.g., computers, cellular telephones, or personal digital assistants);
(ii) privately owned computing and communications devices resident in commercial or public facilities (e.g., hotels, convention centers, or airports);
(iii) information systems owned or controlled by nonfederal governmental organizations; and
(iv) federal information systems that are not owned by, operated by, or under the direct supervision and authority of the organization. For some external systems, in particular those systems operated by other federal agencies, including organizations subordinate to those agencies, the trust relationships that have been established between those organizations and the originating organization may be such, that no explicit terms and conditions are required. In effect, the information systems of these organizations would not be considered external. These situations typically occur when, for example, there is some pre-existing sharing or trust agreement (either implicit or explicit) established between federal agencies and/or organizations subordinate to those agencies, or such trust agreements are specified by applicable laws, Executive Orders, directives, or policies. Authorized individuals include organizational personnel, contractors, or any other individuals with authorized access to the organizational information system and over which the organization has the authority to impose rules of behavior with regard to system access. The restrictions that an organization imposes on authorized individuals need not be uniform, as those restrictions are likely to vary depending upon the trust relationships between organizations. Thus, an organization might impose more stringent security restrictions on a contractor than on a state, local, or tribal government.
This control does not apply to the use of external information systems to access public interfaces to organizational information systems and information (e.g., individuals accessing federal information through www.usa.gov). The organization establishes terms and conditions for the use of external information systems in accordance with organizational security policies and procedures. The terms and conditions address as a minimum;
(i) the types of applications that can be accessed on the organizational information system from the external information system; and
(ii) the maximum security categorization of information that can be processed, stored, and transmitted on the external information system. This control defines access authorizations enforced by AC-3, rules of behavior requirements enforced by PL-4, and session establishment rules enforced by AC-17. Related controls: AC-3, AC-17, PL-4.

Control Enhancements:

(1) The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:
    (a) Can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan; or
    (b) Has approved information system connection or processing agreements with the organizational entity hosting the external information system.

(2) The organization limits the use of organization-controlled portable storage media by authorized individuals on external information systems.

Enchancement Supplemental Guidance:

Limits on the use of organization-controlled portable storage media in external information systems can include, for example, complete prohibition of the use of such devices or restrictions on how the devices may be used and under what conditions the devices may be used.

References:

FIPS Publication 199.

Priority and Baseline Allocation:

 

P1

LOW   AC-20

MOD   AC-20 (1) (2)

HIGH   AC-20 (1) (2)

ISO/IEC 27001 Annex A Control Mapping:

A.7.1.3	Acceptable use of assets
A.8.1.1	Roles and Responsibilities
A.8.1.3	Terms and conditions of employment
A.10.6.1	Network controls
A.10.8.1	Information exchange policies and procedures
A.11.4.1	Policy on use of network services
A.11.4.2	User authentication for external connections

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-21 USER-BASED COLLABORATION AND INFORMATION SHARING

Control:

The organization:
    a. Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for [Assignment: organization-defined information sharing circumstances where user discretion is required]; and
    b. Employs [Assignment: list of organization-defined information sharing circumstances and automated mechanisms or manual processes required] to assist users in making information sharing/collaboration decisions.
    

Supplemental Guidance:

The control applies to information that may be restricted in some manner (e.g., privileged medical, contract-sensitive, proprietary, personally identifiable information, special access programs/compartments) based on some formal or administrative determination. Depending on the information-sharing circumstance, the sharing partner may be defined at the individual, group, or organization level and information may be defined by specific content, type, or security categorization. Related control: AC-3.

Control Enhancements:

(1) The information system employs automated mechanisms to enable authorized users to make information-sharing decisions based on access authorizations of sharing partners and access restrictions on information to be shared.

References:

None.

Priority and Baseline Allocation:

 

P0

LOW   Not Selected

MOD   Not Selected

HIGH   Not Selected

ISO/IEC 27001 Annex A Control Mapping:

A.11.2.1	User registration
A.11.2.2	Privilege management

FAMILY:ACCESS CONTROL

CLASS:TECHNICAL

AC-22 PUBLICLY ACCESSIBLE CONTENT

Control:

The organization:
    a. Designates individuals authorized to post information onto an organizational information system that is publicly accessible;
    b. Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
    c. Reviews the proposed content of publicly accessible information for nonpublic information prior to posting onto the organizational information system;
    d. Reviews the content on the publicly accessible organizational information system for nonpublic information [Assignment: organization-defined frequency]; and
    e. Removes nonpublic information from the publicly accessible organizational information system, if discovered.
    

Supplemental Guidance:

Nonpublic information is any information for which the general public is not authorized access in accordance with federal laws, Executive Orders, directives, policies, regulations, standards, or guidance. Information protected under the Privacy Act and vendor proprietary information are examples of nonpublic information. This control addresses posting information on an organizational information system that is accessible to the general public, typically without identification or authentication. The posting of information on non-organization information systems is covered by appropriate organizational policy. Related controls: AC-3, AU-13.

References:

None.

Priority and Baseline Allocation:

 

P2

LOW   AC-22

MOD   AC-22

HIGH   AC-22

ISO/IEC 27001 Annex A Control Mapping:

None

FAMILY:AWARENESS AND TRAINING

CLASS:OPERATIONAL

AT-1 SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES

Control:

The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]:
    a. A formal, documented security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    b. Formal, documented procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls.
    

Supplemental Guidance:

This control is intended to produce the policy and procedures that are required for the effective implementation of selected security controls and control enhancements in the security awareness and training family. The policy and procedures are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary. The security awareness and training policy can be included as part of the general information security policy for the organization. Security awareness and training procedures can be developed for the security program in general and for a particular information system, when required. The organizational risk management strategy is a key factor in the development of the security awareness and training policy. Related control: PM-9.

References:

NIST Special Publications 800-12, 800-16, 800-50, 800-100.

Priority and Baseline Allocation:

 

P1

LOW   AT-1

MOD   AT-1

HIGH   AT-1

ISO/IEC 27001 Annex A Control Mapping:

A.5.1.1	Information security policy document
A.5.1.2	Review of the information security policy
A.6.1.1	Management commitment to information security
A.6.1.3	Allocation of information security responsibilities
A.8.1.1	Roles and Responsibilities
A.10.1.1	Documented operating procedures
A.15.1.1	Identification of applicable legislation
A.15.2.1	Compliance with security policies and standards

FAMILY:AWARENESS AND TRAINING

CLASS:OPERATIONAL

AT-2 SECURITY AWARENESS

Control:

The organization provides basic security awareness training to all information system users (including managers, senior executives, and contractors) as part of initial training for new users, when required by system changes, and [Assignment: organization-defined frequency] thereafter.

Supplemental Guidance:

The organization determines the appropriate content of security awareness training and security awareness techniques based on the specific requirements of the organization and the information systems to which personnel have authorized access. The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The content also addresses awareness of the need for operations security as it relates to the organization's information security program. Security awareness techniques can include, for example, displaying posters, offering supplies inscribed with security reminders, generating email advisories/notices from senior organizational officials, displaying logon screen messages, and conducting information security awareness events.

Control Enhancements:

(1) The organization includes practical exercises in security awareness training that simulate actual cyber attacks.

Enchancement Supplemental Guidance:

Practical exercises may include, for example, no-notice social engineering attempts to collect information, gain unauthorized access, or simulate the adverse impact of opening malicious email attachments or invoking malicious web links.

References:

C.F.R. Part 5 Subpart C (5 C.F.R 930.301); NIST Special Publication 800-50.

Priority and Baseline Allocation:

 

P1

LOW   AT-2

MOD   AT-2

HIGH   AT-2

ISO/IEC 27001 Annex A Control Mapping:

A.6.2.2	Addressing security when dealing with customers
A.8.1.1	Roles and Responsibilities
A.8.2.2	Awareness, education, and training
A.9.1.5	Working in secure areas
A.10.4.1	Controls against malicious code

FAMILY:AWARENESS AND TRAINING

CLASS:OPERATIONAL

AT-3 SECURITY TRAINING

Control:

The organization provides role-based security-related training:
    (i) before authorizing access to the system or performing assigned duties;
    (ii) when required by system changes; and
    (iii) [Assignment: organization-defined frequency] thereafter.

Supplemental Guidance:

The organization determines the appropriate content of security training based on assigned roles and responsibilities and the specific requirements of the organization and the information systems to which personnel have authorized access. In addition, the organization provides information system managers, system and network administrators, personnel performing independent verification and validation activities, security control assessors, and other personnel having access to system-level software, adequate security-related technical training to perform their assigned duties. Organizational security training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical safeguards and countermeasures. The organization also provides the training necessary for these individuals to carry out their responsibilities related to operations security within the context of the organization's information security program. Related controls: AT-2, SA-3.

Control Enhancements:

(1) The organization provides employees with initial and [Assignment: organization-defined frequency] training in the employment and operation of environmental controls.

Enchancement Supplemental Guidance:

Environmental controls include, for example, fire suppression and detection devices/systems, sprinkler systems, handheld fire extinguishers, fixed fire hoses, smoke detectors, temperature/humidity, HVAC, and power within the facility.

(2) The organization provides employees with initial and [Assignment: organization-defined frequency] training in the employment and operation of physical security controls.

Enchancement Supplemental Guidance:

Physical security controls include, for example, physical access control devices, physical intrusion alarms, monitoring and surveillance equipment, and security guards (deployment and operating procedures).

References:

C.F.R. Part 5 Subpart C (5 C.F.R 930.301); NIST Special Publications 800-16, 800-50.

Priority and Baseline Allocation:

 

P1

LOW   AT-3

MOD   AT-3

HIGH   AT-3

ISO/IEC 27001 Annex A Control Mapping:

A.8.1.1	Roles and Responsibilities
A.8.2.2	Awareness, education, and training
A.9.1.5	Working in secure areas

FAMILY:AWARENESS AND TRAINING

CLASS:OPERATIONAL

AT-4 SECURITY TRAINING RECORDS

Control:

The organization:
    a. Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and
    b. Retains individual training records for [Assignment: organization-defined time period].
    

Supplemental Guidance:

While an organization may deem that organizationally mandated individual training programs and the development of individual training plans are necessary, this control does not mandate either. Documentation for specialized training may be maintained by individual supervisors at the option of the organization.

References:

None.

Priority and Baseline Allocation:

 

P3

LOW   AT-4

MOD   AT-4

HIGH   AT-4

ISO/IEC 27001 Annex A Control Mapping:

None

FAMILY:AWARENESS AND TRAINING

CLASS:OPERATIONAL

AT-5 CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS

Control:

The organization establishes and institutionalizes contact with selected groups and associations within the security community:
    - To facilitate ongoing security education and training for organizational personnel;
    - To stay up to date with the latest recommended security practices, techniques, and technologies; and
    - To share current security-related information including threats, vulnerabilities, and incidents.
    

Supplemental Guidance:

Ongoing contact with security groups and associations is of paramount importance in an environment of rapid technology changes and dynamic threats. Security groups and associations can include, for example, special interest groups, specialized forums, professional associations, news groups, and/or peer groups of security professionals in similar organizations. The groups and associations selected are consistent with the organization's mission/business requirements. Information-sharing activities regarding threats, vulnerabilities, and incidents related to information systems are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

References:

None.

Priority and Baseline Allocation:

 

P0

LOW   Not Selected

MOD   Not Selected

HIGH   Not Selected

ISO/IEC 27001 Annex A Control Mapping:

A.6.1.7

Contact with special interest groups

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-1 AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES

Control:

The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]:
    a. A formal, documented audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    b. Formal, documented procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.
    

Supplemental Guidance:

This control is intended to produce the policy and procedures that are required for the effective implementation of selected security controls and control enhancements in the audit and accountability family. The policy and procedures are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary. The audit and accountability policy can be included as part of the general information security policy for the organization. Audit and accountability procedures can be developed for the security program in general and for a particular information system, when required. The organizational risk management strategy is a key factor in the development of the audit and accountability policy. Related control: PM-9.

References:

NIST Special Publications 800-12, 800-100.

Priority and Baseline Allocation:

 

P1

LOW   AU-1

MOD   AU-1

HIGH   AU-1

ISO/IEC 27001 Annex A Control Mapping:

A.5.1.1	Information security policy document
A.5.1.2	Review of the information security policy
A.6.1.1	Management commitment to information security
A.6.1.3	Allocation of information security responsibilities
A.8.1.1	Roles and Responsibilities
A.10.1.1	Documented operating procedures
A.10.10.2	Monitoring system use
A.15.1.1	Identification of applicable legislation
A.15.2.1	Compliance with security policies and standards
A.15.3.1	Information systems audit controls

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-2 AUDITABLE EVENTS

Control:

The organization:
    a. Determines, based on a risk assessment and mission/business needs, that the information system must be capable of auditing the following events: [Assignment: organization-defined list of auditable events];
    b. Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events;
    c. Provides a rationale for why the list of auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and
    d. Determines, based on current threat information and ongoing assessment of risk, that the following events are to be audited within the information system: [Assignment: organization-defined subset of the auditable events defined in AU-2 a. to be audited along with the frequency of (or situation requiring) auditing for each identified event].
    
    

Supplemental Guidance:

The purpose of this control is for the organization to identify events which need to be auditable as significant and relevant to the security of the information system; giving an overall system requirement in order to meet ongoing and specific audit needs. To balance auditing requirements with other information system needs, this control also requires identifying that subset of auditable events that are to be audited at a given point in time. For example, the organization may determine that the information system must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the extreme burden on system performance. In addition, audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the right level of abstraction for audit record generation is a critical aspect of an audit capability and can facilitate the identification of root causes to problems. Related control: AU-3.

Control Enhancements:

(1) [Withdrawn: Incorporated into AU-12].

(2) [Withdrawn: Incorporated into AU-12].

(3) The organization reviews and updates the list of auditable events [Assignment: organization-defined frequency].

Enchancement Supplemental Guidance:

The list of auditable events is defined in AU-2.

(4) The organization includes execution of privileged functions in the list of events to be audited by the information system.

References:

NIST Special Publication 800-92; Web: CSRC.NIST.GOV/PCIG/CIG.HTML.

Priority and Baseline Allocation:

 

P1

LOW   AU-2

MOD   AU-2 (3) (4)

HIGH   AU-2 (3) (4)

ISO/IEC 27001 Annex A Control Mapping:

A.10.10.1	Audit logging
A.10.10.4	Administrator and operator logs
A.10.10.5	Fault logging
A.15.3.1	Information systems audit controls

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-3 CONTENT OF AUDIT RECORDS

Control:

The information system produces audit records that contain sufficient information to, at a minimum, establish what type of event occurred, when (date and time) the event occurred, where the event occurred, the source of the event, the outcome (success or failure) of the event, and the identity of any user/subject associated with the event.

Supplemental Guidance:

Audit record content that may be necessary to satisfy the requirement of this control, includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Related controls: AU-2, AU-8.

Control Enhancements:

(1) The information system includes [Assignment: organization-defined additional, more detailed information] in the audit records for audit events identified by type, location, or subject.

Enchancement Supplemental Guidance:

An example of detailed information that the organization may require in audit records is full-text recording of privileged commands or the individual identities of group account users.

(2) The organization centrally manages the content of audit records generated by [Assignment: organization-defined information system components].

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AU-3

MOD   AU-3 (1)

HIGH   AU-3 (1) (2)

ISO/IEC 27001 Annex A Control Mapping:

A.10.10.1

Audit logging

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-4 AUDIT STORAGE CAPACITY

Control:

The organization allocates audit record storage capacity and configures auditing to reduce the likelihood of such capacity being exceeded.

Supplemental Guidance:

The organization considers the types of auditing to be performed and the audit processing requirements when allocating audit storage capacity. Related controls: AU-2, AU-5, AU-6, AU-7, SI-4.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AU-4

MOD   AU-4

HIGH   AU-4

ISO/IEC 27001 Annex A Control Mapping:

A.10.10.1	Audit logging
A.10.3.1	Capacity management

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-5 RESPONSE TO AUDIT PROCESSING FAILURES

Control:

The information system:
    a. Alerts designated organizational officials in the event of an audit processing failure; and
    b. Takes the following additional actions: [Assignment: organization-defined actions to be taken (e.g., shut down information system, overwrite oldest audit records, stop generating audit records)].
    

Supplemental Guidance:

Audit processing failures include, for example, software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Related control: AU-4.

Control Enhancements:

(1) The information system provides a warning when allocated audit record storage volume reaches [Assignment: organization-defined percentage] of maximum audit record storage capacity.

(2) The information system provides a real-time alert when the following audit failure events occur: [Assignment: organization-defined audit failure events requiring real-time alerts].

(3) The information system enforces configurable traffic volume thresholds representing auditing capacity for network traffic and [Selection: rejects or delays] network traffic above those thresholds.

(4) The information system invokes a system shutdown in the event of an audit failure, unless an alternative audit capability exists.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AU-5

MOD   AU-5

HIGH   AU-5 (1) (2)

ISO/IEC 27001 Annex A Control Mapping:

A.10.3.1	Capacity management
A.10.10.1	Audit logging

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-6 AUDIT REVIEW, ANALYSIS, AND REPORTING

Control:

The organization:
    a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of inappropriate or unusual activity, and reports findings to designated organizational officials; and
    b. Adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to organizational operations, organizational assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.
    

Supplemental Guidance:

Related control: AU-7.

Control Enhancements:

(1) The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

(2) [Withdrawn: Incorporated into SI-4].

(3) The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.

(4) The information system centralizes the review and analysis of audit records from multiple components within the system.

Enchancement Supplemental Guidance:

An example of an automated mechanism for centralized review and analysis is a Security Information Management (SIM) product. Related control: AU-2.

(5) The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to further enhance the ability to identify inappropriate or unusual activity.

Enchancement Supplemental Guidance:

A Security Event/Information Management system tool can facilitate audit record aggregation and consolidation from multiple information system components as well as audit record correlation and analysis. The use of standardized audit record analysis scripts developed by the organization (with localized script adjustments, as necessary), provides a more cost-effective approach for analyzing audit record information collected. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of the vulnerability scans and correlating attack detection events with scanning results. Related control: AU-7, RA-5, SI-4.

(6) The organization correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.

Enchancement Supplemental Guidance:

Related control: PE-6.

(7) The organization specifies the permitted actions for each authorized information system process, role, and/or user in the audit and accountability policy.

Enchancement Supplemental Guidance:

Permitted actions for information system processes, roles, and/or users associated with the review, analysis, and reporting of audit records include, for example, read, write, append, and delete.

(8) The organization employs automated mechanisms to alert security personnel of the following inappropriate or unusual activities with security implications: [Assignment: organization-defined list of inappropriate or unusual activities that are to result in alerts].

(9) The organization performs, in a physically dedicated information system, full-text analysis of privileged functions executed.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AU-6

MOD   AU-6

HIGH   AU-6 (1)

ISO/IEC 27001 Annex A Control Mapping:

A.10.10.2	Monitoring system use
A.10.10.5	Fault logging
A.13.1.1	Reporting information security events
A.15.1.5	Prevention of misuse of information processing facilities

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-7 AUDIT REDUCTION AND REPORT GENERATION

Control:

The information system provides an audit reduction and report generation capability.

Supplemental Guidance:

An audit reduction and report generation capability provides support for near real-time audit review, analysis, and reporting requirements described in AU-6 and after-the-fact investigations of security incidents. Audit reduction and reporting tools do not alter original audit records. Related control: AU-6.

Control Enhancements:

(1) The information system provides the capability to automatically process audit records for events of interest based on selectable event criteria.

References:

None.

Priority and Baseline Allocation:

 

P2

LOW   Not Selected

MOD   AU-7 (1)

HIGH   AU-7 (1)

ISO/IEC 27001 Annex A Control Mapping:

A.10.10.2

Monitoring system use

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-8 TIME STAMPS

Control:

The information system uses internal system clocks to generate time stamps for audit records.

Supplemental Guidance:

Time stamps generated by the information system include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. Related control: AU-3.

Control Enhancements:

(1) The information system synchronizes internal information system clocks [Assignment: organization-defined frequency] with [Assignment: organization-defined authoritative time source].

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AU-8

MOD   AU-8 (1)

HIGH   AU-8 (1)

ISO/IEC 27001 Annex A Control Mapping:

A.10.10.1	Audit logging
A.10.10.6	Clock synchronization

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-9 PROTECTION OF AUDIT INFORMATION

Control:

The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

Supplemental Guidance:

Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Related controls: AC-3, AC-6.

Control Enhancements:

(1) The information system produces audit records on hardware-enforced, write-once media.

(2) The information system backs up audit records [Assignment: organization-defined frequency] onto a different system or media than the system being audited.

(3) The information system uses cryptographic mechanisms to protect the integrity of audit information and audit tools.

Enchancement Supplemental Guidance:

An example of a cryptographic mechanism for the protection of integrity is the computation and application of a cryptographic-signed hash using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information.

(4) The organization:
    (a) Authorizes access to management of audit functionality to only a limited subset of privileged users; and
    (b) Protects the audit records of non-local accesses to privileged accounts and the execution of privileged functions.

Enchancement Supplemental Guidance:

Auditing may not be reliable when performed by the information system to which the user being audited has privileged access. The privileged user may inhibit auditing or modify audit records. This control enhancement helps mitigate this risk by requiring that privileged access be further defined between audit-related privileges and other privileges, thus, limiting the users with audit-related privileges. Reducing the risk of audit compromises by privileged users can also be achieved, for example, by performing audit activity on a separate information system or by using storage media that cannot be modified (e.g., write-once recording devices).

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AU-9

MOD   AU-9

HIGH   AU-9

ISO/IEC 27001 Annex A Control Mapping:

A.10.10.3	Protection of log information
A.13.2.3	Collection of evidence
A.15.1.3	Protection of organizational records
A.15.3.2

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-10 NON-REPUDIATION

Control:

The information system protects against an individual falsely denying having performed a particular action.

Supplemental Guidance:

Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. Non-repudiation services can be used to determine if information originated from an individual, or if an individual took specific actions (e.g., sending an email, signing a contract, approving a procurement request) or received specific information. Non-repudiation services are obtained by employing various techniques or mechanisms (e.g., digital signatures, digital message receipts).

Control Enhancements:

(1) The information system associates the identity of the information producer with the information.

Enchancement Supplemental Guidance:

This control enhancement supports audit requirements that provide appropriate organizational officials the means to identify who produced specific information in the event of an information transfer. The nature and strength of the binding between the information producer and the information are determined and approved by the appropriate organizational officials based on the security categorization of the information and relevant risk factors.

(2) The information system validates the binding of the information producer's identity to the information.

Enchancement Supplemental Guidance:

This control enhancement is intended to mitigate the risk that information is modified between production and review. The validation of bindings can be achieved, for example, by the use of cryptographic checksums.

(3) The information system maintains reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released.

Enchancement Supplemental Guidance:

If the reviewer is a human or if the review function is automated but separate from the release/transfer function, the information system associates the identity of the reviewer of the information to be released with the information and the information label. In the case of human reviews, this control enhancement provides appropriate organizational officials the means to identify who reviewed and released the information. In the case of automated reviews, this control enhancement helps ensure that only approved review functions are employed.

(4) The information system validates the binding of the reviewer's identity to the information at the transfer/release point prior to release/transfer from one security domain to another security domain.

Enchancement Supplemental Guidance:

This control enhancement is intended to mitigate the risk that information is modified between review and transfer/release.

(5) The organization employs [Selection: FIPS-validated; NSA-approved] cryptography to implement digital signatures.

Enchancement Supplemental Guidance:

Related control: SC-13.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   Not Selected

HIGH   AU-10

ISO/IEC 27001 Annex A Control Mapping:

A.10.9.1	Electronic commerce
A.12.2.3	Message integrity

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-11 AUDIT RECORD RETENTION

Control:

The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

Supplemental Guidance:

The organization retains audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoena, and law enforcement actions. Standard categorizations of audit records relative to such types of actions and standard response processes for each type of action are developed and disseminated. The National Archives and Records Administration (NARA) General Records Schedules (GRS) provide federal policy on record retention.

References:

None.

Priority and Baseline Allocation:

 

P3

LOW   AU-11

MOD   AU-11

HIGH   AU-11

ISO/IEC 27001 Annex A Control Mapping:

A.10.10.1	Audit logging
A.10.10.2	Monitoring system use
A.15.1.3	Protection of organizational records

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-12 AUDIT GENERATION

Control:

The information system:
    a. Provides audit record generation capability for the list of auditable events defined in AU-2 at [Assignment: organization-defined information system components];
    b. Allows designated organizational personnel to select which auditable events are to be audited by specific components of the system; and
    c. Generates audit records for the list of audited events defined in AU-2 with the content as defined in AU-3.
    

Supplemental Guidance:

Audits records can be generated from various components within the information system. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records (i.e., auditable events). Related controls: AU-2, AU-3.

Control Enhancements:

(1) The information system compiles audit records from [Assignment: organization-defined information system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail].

Enchancement Supplemental Guidance:

The audit trail is time-correlated if the time stamp in the individual audit records can be reliably related to the time stamp in other audit records to achieve a time ordering of the records within the organization-defined tolerance.

(2) The information system produces a system-wide (logical or physical) audit trail composed of audit records in a standardized format.

Enchancement Supplemental Guidance:

Audit information normalized to a common standard promotes interoperability and exchange of such information between dissimilar devices and information systems. This facilitates an audit system that produces event information that can be more readily analyzed and correlated. System log records and audit records compliant with the Common Event Expression (CEE) are examples of standard formats for audit records. If individual logging mechanisms within the information system do not conform to a standardized format, the system may convert individual audit records into a standardized format when compiling the system-wide audit trail.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   AU-12

MOD   AU-12

HIGH   AU-12 (1)

ISO/IEC 27001 Annex A Control Mapping:

A.10.10.1	Audit logging
A.10.10.4	Administrator and operator logs
A.10.10.5	Fault logging

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-13 MONITORING FOR INFORMATION DISCLOSURE

Control:

The organization monitors open source information for evidence of unauthorized exfiltration or disclosure of organizational information [Assignment: organization-defined frequency].

Supplemental Guidance:

None.

References:

None.

Priority and Baseline Allocation:

 

P0

LOW   Not Selected

MOD   Not Selected

HIGH   Not Selected

ISO/IEC 27001 Annex A Control Mapping:

None

FAMILY:AUDIT AND ACCOUNTABILITY

CLASS:TECHNICAL

AU-14 SESSION AUDIT

Control:

The information system provides the capability to:
    a. Capture/record and log all content related to a user session; and
    b. Remotely view/hear all content related to an established user session in real time.
    

Supplemental Guidance:

Session auditing activities are developed, integrated, and used in consultation with legal counsel in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations.

Control Enhancements:

(1) The information system initiates session audits at system start-up.

References:

None.

Priority and Baseline Allocation:

 

P0

LOW   Not Selected

MOD   Not Selected

HIGH   Not Selected

ISO/IEC 27001 Annex A Control Mapping:

None

FAMILY:SECURITY ASSESSMENT AND AUTHORIZATION

CLASS:MANAGEMENT

CA-1 SECURITY ASSESSMENT AND AUTHORIZATION POLICIES AND PROCEDURES

Control:

The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]:
    a. Formal, documented security assessment and authorization policies that address purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    b. Formal, documented procedures to facilitate the implementation of the security assessment and authorization policies and associated security assessment and authorization controls.

Supplemental Guidance:

This control is intended to produce the policy and procedures that are required for the effective implementation of selected security controls and control enhancements in the security assessment and authorization family. The policies and procedures are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary. The security assessment/authorization policies can be included as part of the general information security policy for the organization. Security assessment/authorization procedures can be developed for the security program in general and for a particular information system, when required. The organizational risk management strategy is a key factor in the development of the security assessment and authorization policy. Related control: PM-9.

References:

NIST Special Publications 800-12, 800-37, 800-53A, 800-100.

Priority and Baseline Allocation:

 

P1

LOW   CA-1

MOD   CA-1

HIGH   CA-1

ISO/IEC 27001 Annex A Control Mapping:

A.5.1.1	Information security policy document
A.5.1.2	Review of the information security policy
A.6.1.1	Management commitment to information security
A.6.1.3	Allocation of information security responsibilities
A.6.1.4	Authorization process for information processing facilities
A.8.1.1	Roles and Responsibilities
A.10.1.1	Documented operating procedures
A.15.1.1	Identification of applicable legislation
A.15.2.1	Compliance with security policies and standards

FAMILY:SECURITY ASSESSMENT AND AUTHORIZATION

CLASS:MANAGEMENT

CA-2 SECURITY ASSESSMENTS

Control:

The organization:
    a. Develops a security assessment plan that describes the scope of the assessment including:
    - Security controls and control enhancements under assessment;
    - Assessment procedures to be used to determine security control effectiveness; and
    - Assessment environment, assessment team, and assessment roles and responsibilities;
    b. Assesses the security controls in the information system [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system;
    c. Produces a security assessment report that documents the results of the assessment; and
    d. Provides the results of the security control assessment, in writing, to the authorizing official or authorizing official designated representative.
    

Supplemental Guidance:

The organization assesses the security controls in an information system as part of:
(i) security authorization or reauthorization;
(ii) meeting the FISMA requirement for annual assessments;
(iii) continuous monitoring; and
(iv) testing/evaluation of the information system as part of the system development life cycle process. The assessment report documents the assessment results in sufficient detail as deemed necessary by the organization, to determine the accuracy and completeness of the report and whether the security controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements of the information system. The FISMA requirement for (at least) annual security control assessments should not be interpreted by organizations as adding additional assessment requirements to those requirements already in place in the security authorization process. To satisfy the FISMA annual assessment requirement, organizations can draw upon the security control assessment results from any of the following sources, including but not limited to:
(i) assessments conducted as part of an information system authorization or reauthorization process;
(ii) continuous monitoring (see CA-7); or
(iii) testing and evaluation of an information system as part of the ongoing system development life cycle (provided that the testing and evaluation results are current and relevant to the determination of security control effectiveness). Existing security control assessment results are reused to the extent that they are still valid and are supplemented with additional assessments as needed.
Subsequent to the initial authorization of the information system and in accordance with OMB policy, the organization assesses a subset of the security controls annually during continuous monitoring. The organization establishes the security control selection criteria and subsequently selects a subset of the security controls within the information system and its environment of operation for assessment. Those security controls that are the most volatile (i.e., controls most affected by ongoing changes to the information system or its environment of operation) or deemed critical by the organization to protecting organizational operations and assets, individuals, other organizations, and the Nation are assessed more frequently in accordance with an organizational assessment of risk. All other controls are assessed at least once during the information system's three-year authorization cycle. The organization can use the current year's assessment results from any of the above sources to meet the FISMA annual assessment requirement provided that the results are current, valid, and relevant to determining security control effectiveness. External audits (e.g., audits conducted by external entities such as regulatory agencies) are outside the scope of this control. Related controls: CA-6, CA-7, PM-9, SA-11.

Control Enhancements:

(1) The organization employs an independent assessor or assessment team to conduct an assessment of the security controls in the information system.

Enchancement Supplemental Guidance:

An independent assessor or assessment team is any individual or group capable of conducting an impartial assessment of an organizational information system. Impartiality implies that the assessors are free from any perceived or actual conflicts of interest with respect to the developmental, operational, and/or management chain associated with the information system or to the determination of security control effectiveness. Independent security assessment services can be obtained from other elements within the organization or can be contracted to a public or private sector entity outside of the organization. Contracted assessment services are considered independent if the information system owner is not directly involved in the contracting process or cannot unduly influence the impartiality of the assessor or assessment team conducting the assessment of the security controls in the information system. The authorizing official determines the required level of assessor independence based on the security categorization of the information system and/or the ultimate risk to organizational operations and assets, and to individuals. The authorizing official determines if the level of assessor independence is sufficient to provide confidence that the assessment results produced are sound and can be used to make a credible, risk-based decision. In special situations, for example when the organization that owns the information system is small or the organizational structure requires that the assessment be accomplished by individuals that are in the developmental, operational, and/or management chain of the system owner, independence in the assessment process can be achieved by ensuring that the assessment results are carefully reviewed and analyzed by an independent team of experts to validate the completeness, accuracy, integrity, and reliability of the results.

(2) The organization includes as part of security control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection: in-depth monitoring; malicious user testing; penetration testing; red team exercises; [Assignment: organization-defined other forms of security testing]].

Enchancement Supplemental Guidance:

Penetration testing exercises both physical and technical security controls. A standard method for penetration testing consists of:
(i) pretest analysis based on full knowledge of the target system;
(ii) pretest identification of potential vulnerabilities based on pretest analysis; and
(iii) testing designed to determine exploitability of identified vulnerabilities. Detailed rules of engagement are agreed upon by all parties before the commencement of any penetration testing scenario. These rules of engagement are correlated with the tools, techniques, and procedures that are anticipated to be employed by threat-sources in carrying out attacks. An organizational assessment of risk guides the decision on the level of independence required for penetration agents or penetration teams conducting penetration testing. Red team exercises are conducted as a simulated adversarial attempt to compromise organizational missions and/or business processes to provide a comprehensive assessment of the security capability of the information system and organization. While penetration testing may be laboratory-based testing, red team exercises are intended to be more comprehensive in nature and reflect real-world conditions. Information system monitoring, malicious user testing, penetration testing, red-team exercises, and other forms of security testing (e.g., independent verification and validation) are conducted to improve the readiness of the organization by exercising organizational capabilities and indicating current performance levels as a means of focusing organizational actions to improve the security state of the system and organization. Testing is conducted in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. Testing methods are approved by authorizing officials in coordination with the organization's Risk Executive Function. Vulnerabilities uncovered during red team exercises are incorporated into the vulnerability remediation process. Related controls: RA-5, SI-2.

References:

FIPS Publication 199; NIST Special Publications 800-37, 800-53A, 800-115.

Priority and Baseline Allocation:

 

P2

LOW   CA-2

MOD   CA-2 (1)

HIGH   CA-2 (1) (2)

ISO/IEC 27001 Annex A Control Mapping:

A.6.1.8	Independent review of information security
A.10.3.2	System acceptance
A.15.2.1	Compliance with security policies and standards
A.15.2.2	Technical compliance checking

FAMILY:SECURITY ASSESSMENT AND AUTHORIZATION

CLASS:MANAGEMENT

CA-3 INFORMATION SYSTEM CONNECTIONS

Control:

The organization:
    a. Authorizes connections from the information system to other information systems outside of the authorization boundary through the use of Interconnection Security Agreements;
    b. Documents, for each connection, the interface characteristics, security requirements, and the nature of the information communicated; and
    c. Monitors the information system connections on an ongoing basis verifying enforcement of security requirements.
    

Supplemental Guidance:

This control applies to dedicated connections between information systems and does not apply to transitory, user-controlled connections such as email and website browsing. The organization carefully considers the risks that may be introduced when information systems are connected to other systems with different security requirements and security controls, both within the organization and external to the organization. Authorizing officials determine the risk associated with each connection and the appropriate controls employed. If the interconnecting systems have the same authorizing official, an Interconnection Security Agreement is not required. Rather, the interface characteristics between the interconnecting information systems are described in the security plans for the respective systems. If the interconnecting systems have different authorizing officials but the authorizing officials are in the same organization, the organization determines whether an Interconnection Security Agreement is required, or alternatively, the interface characteristics between systems are described in the security plans of the respective systems. Instead of developing an Interconnection Security Agreement, organizations may choose to incorporate this information into a formal contract, especially if the interconnection is to be established between a federal agency and a nonfederal (private sector) organization. In every case, documenting the interface characteristics is required, yet the formality and approval process vary considerably even though all accomplish the same fundamental objective of managing the risk being incurred by the interconnection of the information systems. Risk considerations also include information systems sharing the same networks. Information systems may be identified and authenticated as devices in accordance with IA-3. Related controls: AC-4, IA-3, SC-7, SA-9.

Control Enhancements:

(1) The organization prohibits the direct connection of an unclassified, national security system to an external network.

Enchancement Supplemental Guidance:

An external network is a network that is not controlled by the organization (e.g., the Internet). No direct connection means that an information system cannot connect to an external network without the use of an approved boundary protection device (e.g., firewall) that mediates the communication between the system and the network

(2) The organization prohibits the direct connection of a classified, national security system to an external network.

Enchancement Supplemental Guidance:

An external network is a network that is not controlled by the organization (e.g., the Internet). No direct connection means that an information system cannot connect to an external network without the use of an approved boundary protection device (e.g., firewall) that mediates the communication between the system and the network. In addition, the approved boundary protection device (typically a managed interface/cross-domain system), provides information flow enforcement from the information system to the external network consistent with AC-4.

References:

FIPS Publication 199; NIST Special Publication 800-47.

Priority and Baseline Allocation:

 

P1

LOW   CA-3

MOD   CA-3

HIGH   CA-3

ISO/IEC 27001 Annex A Control Mapping:

A.6.2.1	Identification of risks related to external parties
A.6.2.3	Addressing security in third party agreements
A.10.6.1	Network controls
A.10.8.1	Information exchange policies and procedures
A.10.8.2	Exchange agreements
A.10.8.5	Business information systems
A.11.4.2	User authentication for external connections

FAMILY:SECURITY ASSESSMENT AND AUTHORIZATION

CLASS:MANAGEMENT

CA-4 SECURITY CERTIFICATION

Control:

[Withdrawn: Incorporated into CA-2].

Supplemental Guidance:

References:

Priority and Baseline Allocation:

 

---

LOW   ---

MOD   ---

HIGH   ---

ISO/IEC 27001 Annex A Control Mapping:

---

FAMILY:SECURITY ASSESSMENT AND AUTHORIZATION

CLASS:MANAGEMENT

CA-5 PLAN OF ACTION AND MILESTONES

Control:

The organization:
    a. Develops a plan of action and milestones for the information system to document the organization's planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system; and
    b. Updates existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from security controls assessments, security impact analyses, and continuous monitoring activities.
    

Supplemental Guidance:

The plan of action and milestones is a key document in the security authorization package and is subject to federal reporting requirements established by OMB. Related control: PM-4.

Control Enhancements:

(1) The organization employs automated mechanisms to help ensure that the plan of action and milestones for the information system is accurate, up to date, and readily available.

References:

OMB Memorandum 02-01; NIST Special Publication 800-37.

Priority and Baseline Allocation:

 

P3

LOW   CA-5

MOD   CA-5

HIGH   CA-5

ISO/IEC 27001 Annex A Control Mapping:

None

FAMILY:SECURITY ASSESSMENT AND AUTHORIZATION

CLASS:MANAGEMENT

CA-6 SECURITY AUTHORIZATION

Control:

The organization:
    a. Assigns a senior-level executive or manager to the role of authorizing official for the information system;
    b. Ensures that the authorizing official authorizes the information system for processing before commencing operations; and
    c. Updates the security authorization [Assignment: organization-defined frequency].
    

Supplemental Guidance:

Security authorization is the official management decision given by a senior organizational official or executive (i.e., authorizing official) to authorize operation of an information system and to explicitly accept the risk to organizational operations and assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls. Authorizing officials typically have budgetary oversight for information systems or are responsible for the mission or business operations supported by the systems. Security authorization is an inherently federal responsibility and therefore, authorizing officials must be federal employees. Through the security authorization process, authorizing officials are accountable for the security risks associated with information system operations. Accordingly, authorizing officials are in management positions with a level of authority commensurate with understanding and accepting such information system-related security risks. Through the employment of a comprehensive continuous monitoring process, the critical information contained in the authorization package (i.e., the security plan (including risk assessment), the security assessment report, and the plan of action and milestones) is updated on an ongoing basis, providing the authorizing official and the information system owner with an up-to-date status of the security state of the information system. To reduce the administrative cost of security reauthorization, the authorizing official uses the results of the continuous monitoring process to the maximum extent possible as the basis for rendering a reauthorization decision. OMB policy requires that federal information systems are reauthorized at least every three years or when there is a significant change to the system. The organization defines what constitutes a significant change to the information system. Related controls: CA-2, CA-7, PM-9, PM-10.

References:

OMB Circular A-130; NIST Special Publication 800-37.

Priority and Baseline Allocation:

 

P3

LOW   CA-6

MOD   CA-6

HIGH   CA-6

ISO/IEC 27001 Annex A Control Mapping:

A.6.1.4	Authorization process for information processing facilities
A.10.3.2	System acceptance

FAMILY:SECURITY ASSESSMENT AND AUTHORIZATION

CLASS:MANAGEMENT

CA-7 CONTINUOUS MONITORING

Control:

The organization establishes a continuous monitoring strategy and implements a continuous monitoring program that includes:
    a. A configuration management process for the information system and its constituent components;
    b. A determination of the security impact of changes to the information system and environment of operation;
    c. Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; and
    d. Reporting the security state of the information system to appropriate organizational officials [Assignment: organization-defined frequency].
    

Supplemental Guidance:

A continuous monitoring program allows an organization to maintain the security authorization of an information system over time in a highly dynamic environment of operation with changing threats, vulnerabilities, technologies, and missions/business processes. Continuous monitoring of security controls using automated support tools facilitates near real-time risk management and promotes organizational situational awareness with regard to the security state of the information system. The implementation of a continuous monitoring program results in ongoing updates to the security plan, the security assessment report, and the plan of action and milestones, the three principal documents in the security authorization package. A rigorous and well executed continuous monitoring program significantly reduces the level of effort required for the reauthorization of the information system. Continuous monitoring activities are scaled in accordance with the impact level of the information system. Related controls: CA-2, CA-5, CA-6, CM-3, CM-4.

Control Enhancements:

(1) The organization employs an independent assessor or assessment team to monitor the security controls in the information system on an ongoing basis.

Enchancement Supplemental Guidance:

The organization can extend and maximize the value of the ongoing assessment of security controls during the continuous monitoring process by requiring an independent assessor or team to assess all of the security controls during the information system's three-year authorization cycle. See supplemental guidance for CA-2, enhancement (1), for further information on assessor independence. Related controls: CA-2, CA-5, CA-6, CM-4.

(2) The organization plans, schedules, and conducts assessments [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection: in-depth monitoring; malicious user testing; penetration testing; red team exercises; [Assignment: organization-defined other forms of security assessment]] to ensure compliance with all vulnerability mitigation procedures.

Enchancement Supplemental Guidance:

Examples of vulnerability mitigation procedures are contained in Information Assurance Vulnerability Alerts. Testing is intended to ensure that the information system continues to provide adequate security against constantly evolving threats and vulnerabilities. Conformance testing also provides independent validation. See supplemental guidance for CA-2, enhancement (2) for further information on malicious user testing, penetration testing, red-team exercises, and other forms of security testing. Related control: CA-2.

References:

NIST Special Publications 800-37, 800-53A; US-CERT Technical Cyber Security Alerts; DOD Information Assurance Vulnerability Alerts.

Priority and Baseline Allocation:

 

P3

LOW   CA-7

MOD   CA-7

HIGH   CA-7

ISO/IEC 27001 Annex A Control Mapping:

A.6.1.8	Independent review of information security
A.15.2.1	Compliance with security policies and standards
A.15.2.2	Technical compliance checking

FAMILY:CONFIGURATION MANAGEMENT

CLASS:OPERATIONAL

CM-1 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES

Control:

The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]:
    a. A formal, documented configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    b. Formal, documented procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.

Supplemental Guidance:

This control is intended to produce the policy and procedures that are required for the effective implementation of selected security controls and control enhancements in the configuration management family. The policy and procedures are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary. The configuration management policy can be included as part of the general information security policy for the organization. Configuration management procedures can be developed for the security program in general and for a particular information system, when required. The organizational risk management strategy is a key factor in the development of the configuration management policy. Related control: PM-9.

References:

NIST Special Publications 800-12, 800-100.

Priority and Baseline Allocation:

 

P1

LOW   CM-1

MOD   CM-1

HIGH   CM-1

ISO/IEC 27001 Annex A Control Mapping:

A.5.1.1	Information security policy document
A.5.1.2	Review of the information security policy
A.6.1.1	Management commitment to information security
A.6.1.3	Allocation of information security responsibilities
A.8.1.1	Roles and Responsibilities
A.10.1.1	Documented operating procedures
A.10.1.2	Change management
A.12.4.1	Control of operational software
A.12.5.1	Change control procedures
A.15.1.1	Identification of applicable legislation
A.15.2.1	Compliance with security policies and standards

FAMILY:CONFIGURATION MANAGEMENT

CLASS:OPERATIONAL

CM-2 BASELINE CONFIGURATION

Control:

The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

Supplemental Guidance:

This control establishes a baseline configuration for the information system and its constituent components including communications and connectivity-related aspects of the system. The baseline configuration provides information about the components of an information system (e.g., the standard software load for a workstation, server, network component, or mobile device including operating system/installed applications with current version numbers and patch information), network topology, and the logical placement of the component within the system architecture. The baseline configuration is a documented, up-to-date specification to which the information system is built. Maintaining the baseline configuration involves creating new baselines as the information system changes over time. The baseline configuration of the information system is consistent with the organization's enterprise architecture. Related controls: CM-3, CM-6, CM-8, CM-9.

Control Enhancements:

(1) The organization reviews and updates the baseline configuration of the information system:
    (a) [Assignment: organization-defined frequency];
    (b) When required due to [Assignment organization-defined circumstances]; and
    (c) As an integral part of information system component installations and upgrades.
    

(2) The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.

Enchancement Supplemental Guidance:

Software inventory tools are examples of automated mechanisms that help organizations maintain consistent baseline configurations for information systems. Software inventory tools can be deployed for each operating system in use within the organization (e.g., on workstations, servers, network components, mobile devices) and used to track operating system version numbers, applications and types of software installed on the operating systems, and current patch levels. Software inventory tools can also scan information systems for unauthorized software to validate organization-defined lists of authorized and unauthorized software programs.

(3) The organization retains older versions of baseline configurations as deemed necessary to support rollback.

(4) The organization:
    (a) Develops and maintains [Assignment: organization-defined list of software programs not authorized to execute on the information system]; and
    (b) Employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system.
    

(5) The organization:
    (a) Develops and maintains [Assignment: organization-defined list of software programs authorized to execute on the information system]; and
    (b) Employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system.
    

(6) The organization maintains a baseline configuration for development and test environments that is managed separately from the operational baseline configuration.

References:

NIST Special Publication 800-128.

Priority and Baseline Allocation:

 

P1

LOW   CM-2

MOD   CM-2 (1) (3) (4)

HIGH   CM-2 (1) (2) (3) (5) (6)

ISO/IEC 27001 Annex A Control Mapping:

A.12.4.1	Control of operational software
A.10.1.4	Separation of development, test and operational facilities

FAMILY:CONFIGURATION MANAGEMENT

CLASS:OPERATIONAL

CM-3 CONFIGURATION CHANGE CONTROL

Control:

The organization:
    a. Determines the types of changes to the information system that are configuration controlled;
    b. Approves configuration-controlled changes to the system with explicit consideration for security impact analyses;
    c. Documents approved configuration-controlled changes to the system;
    d. Retains and reviews records of configuration-controlled changes to the system;
    e. Audits activities associated with configuration-controlled changes to the system; and
    f. Coordinates and provides oversight for configuration change control activities through [Assignment: organization-defined configuration change control element (e.g., committee, board] that convenes [Selection: (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined configuration change conditions]].
    

Supplemental Guidance:

The organization determines the types of changes to the information system that are configuration controlled. Configuration change control for the information system involves the systematic proposal, justification, implementation, test/evaluation, review, and disposition of changes to the system, including upgrades and modifications. Configuration change control includes changes to components of the information system, changes to the configuration settings for information technology products (e.g., operating systems, applications, firewalls, routers), emergency changes, and changes to remediate flaws. A typical organizational process for managing configuration changes to the information system includes, for example, a chartered Configuration Control Board that approves proposed changes to the system. Auditing of changes refers to changes in activity before and after a change is made to the information system and the auditing activities required to implement the change. Related controls: CM-4, CM-5, CM-6, SI-2.

Control Enhancements:

(1) The organization employs automated mechanisms to:
    (a) Document proposed changes to the information system;
    (b) Notify designated approval authorities;
    (c) Highlight approvals that have not been received by [Assignment: organization-defined time period];
    (d) Inhibit change until designated approvals are received; and
    (e) Document completed changes to the information system.
    

(2) The organization tests, validates, and documents changes to the information system before implementing the changes on the operational system.

Enchancement Supplemental Guidance:

The organization ensures that testing does not interfere with information system operations. The individual/group conducting the tests understands the organizational information security policies and procedures, the information system security policies and procedures, and the specific health, safety, and environmental risks associated with a particular facility and/or process. An operational system may need to be taken off-line, or replicated to the extent feasible, before testing can be conducted. If an information system must be taken off-line for testing, the tests are scheduled to occur during planned system outages whenever possible. In situations where the organization cannot conduct testing of an operational system, the organization employs compensating controls (e.g., providing a replicated system to conduct testing) in accordance with the general tailoring guidance.

(3) The organization employs automated mechanisms to implement changes to the current information system baseline and deploys the updated baseline across the installed base.

Enchancement Supplemental Guidance:

Related controls: CM-2, CM-6.

(4) The organization requires an information security representative to be a member of the [Assignment: organization-defined configuration change control element (e.g., committee, board)].

Enchancement Supplemental Guidance:

Information security representatives can include, for example, information system security officers or information system security managers. The configuration change control element in this control enhancement is consistent with the change control element defined by the organization in CM-3.

References:

NIST Special Publication 800-128.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   CM-3 (2)

HIGH   CM-3 (1) (2)

ISO/IEC 27001 Annex A Control Mapping:

A.10.1.1	Documented operating procedures
A.10.1.2	Change management
A.10.3.2	System acceptance
A.12.4.1	Control of operational software
A.12.5.1	Change control procedures
A.12.5.2	Technical review of applications after operating system changes
A.12.5.3	Restrictions on changes to software packages

FAMILY:CONFIGURATION MANAGEMENT

CLASS:OPERATIONAL

CM-4 SECURITY IMPACT ANALYSIS

Control:

The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

Supplemental Guidance:

Security impact analyses are conducted by organizational personnel with information security responsibilities, including for example, Information System Administrators, Information System Security Officers, Information System Security Managers, and Information System Security Engineers. Individuals conducting security impact analyses have the appropriate skills and technical expertise to analyze the changes to information systems and the associated security ramifications. Security impact analysis may include, for example, reviewing information system documentation such as the security plan to understand how specific security controls are implemented within the system and how the changes might affect the controls. Security impact analysis may also include an assessment of risk to understand the impact of the changes and to determine if additional security controls are required. Security impact analysis is scaled in accordance with the impact level of the information system. Related controls: CA-2, CA-7, CM-3, CM-9, SI-2.

Control Enhancements:

(1) The organization analyzes new software in a separate test environment before installation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.

(2) The organization, after the information system is changed, checks the security functions to verify that the functions are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security requirements for the system.

Enchancement Supplemental Guidance:

Changes include information system upgrades and modifications.

References:

NIST Special Publication 800-128.

Priority and Baseline Allocation:

 

P2

LOW   CM-4

MOD   CM-4

HIGH   CM-4 (1)

ISO/IEC 27001 Annex A Control Mapping:

A.10.1.2	Change management
A.10.3.2	System acceptance
A.12.4.1	Control of operational software
A.12.5.2	Technical review of applications after operating system changes
A.12.5.3	Restrictions on changes to software packages

FAMILY:CONFIGURATION MANAGEMENT

CLASS:OPERATIONAL

CM-5 ACCESS RESTRICTIONS FOR CHANGE

Control:

The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.

Supplemental Guidance:

Any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. Additionally, maintaining records of access is essential for ensuring that configuration change control is being implemented as intended and for supporting after-the-fact actions should the organization become aware of an unauthorized change to the information system. Access restrictions for change also include software libraries. Examples of access restrictions include, for example, physical and logical access controls (see AC-3 and PE-3), workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover). Some or all of the enforcement mechanisms and processes necessary to implement this security control are included in other controls. For measures implemented in other controls, this control provides information to be used in the implementation of the other controls to cover specific needs related to enforcing authorizations to make changes to the information system, auditing changes, and retaining and review records of changes. Related controls: AC-3, AC-6, PE-3.

Control Enhancements:

(1) The organization employs automated mechanisms to enforce access restrictions and support auditing of the enforcement actions.

(2) The organization conducts audits of information system changes [Assignment: organization-defined frequency] and when indications so warrant to determine whether unauthorized changes have occurred.

(3) The information system prevents the installation of [Assignment: organization-defined critical software programs] that are not signed with a certificate that is recognized and approved by the organization.

Enchancement Supplemental Guidance:

Critical software programs and/or modules include, for example, patches, service packs, and where applicable, device drivers.

(4) The organization enforces a two-person rule for changes to [Assignment: organization-defined information system components and system-level information].

(5) The organization:
    (a) Limits information system developer/integrator privileges to change hardware, software, and firmware components and system information directly within a production environment; and
    (b) Reviews and reevaluates information system developer/integrator privileges [Assignment: organization-defined frequency].
    

(6) The organization limits privileges to change software resident within software libraries (including privileged programs).

(7) The information system automatically implements [Assignment: organization-defined safeguards and countermeasures] if security functions (or mechanisms) are changed inappropriately.

Enchancement Supplemental Guidance:

The information system reacts automatically when inappropriate and/or unauthorized modifications have occurred to security functions or mechanisms. Automatic implementation of safeguards and countermeasures includes, for example, reversing the change, halting the information system or triggering an audit alert when an unauthorized modification to a critical security file occurs.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   CM-5

HIGH   CM-5 (1) (2) (3)

ISO/IEC 27001 Annex A Control Mapping:

A.10.1.2	Change management
A.11.1.1	Access control policy
A.11.6.1	Information access restriction
A.12.4.1	Control of operational software
A.12.4.3	Access control to program source code
A.12.5.3	Restrictions on changes to software packages

FAMILY:CONFIGURATION MANAGEMENT

CLASS:OPERATIONAL

CM-6 CONFIGURATION SETTINGS

Control:

The organization:
    a. Establishes and documents mandatory configuration settings for information technology products employed within the information system using [Assignment: organization-defined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements;
    b. Implements the configuration settings;
    c. Identifies, documents, and approves exceptions from the mandatory configuration settings for individual components within the information system based on explicit operational requirements; and
    d. Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
    

Supplemental Guidance:

Configuration settings are the configurable security-related parameters of information technology products that are part of the information system. Security-related parameters are those parameters impacting the security state of the system including parameters related to meeting other security control requirements. Security-related parameters include, for example, registry settings; account, file, and directory settings (i.e., permissions); and settings for services, ports, protocols, and remote connections. Organizations establish organization-wide mandatory configuration settings from which the settings for a given information system are derived. A security configuration checklist (sometimes referred to as a lockdown guide, hardening guide, security guide, security technical implementation guide [STIG], or benchmark) is a series of instructions or procedures for configuring an information system component to meet operational requirements. Checklists can be developed by information technology developers and vendors, consortia, academia, industry, federal agencies (and other government organizations), and others in the public and private sectors. An example of a security configuration checklist is the Federal Desktop Core Configuration (FDCC) which potentially affects the implementation of CM-6 and other controls such as AC-19 and CM-7. The Security Content Automation Protocol (SCAP) and defined standards within the protocol (e.g., Common Configuration Enumeration) provide an effective method to uniquely identify, track, and control configuration settings. OMB establishes federal policy on configuration requirements for federal information systems. Related controls: CM-2, CM-3, SI-4.

Control Enhancements:

(1) The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings.

(2) The organization employs automated mechanisms to respond to unauthorized changes to [Assignment: organization-defined configuration settings].

Enchancement Supplemental Guidance:

Responses to unauthorized changes to configuration settings can include, for example, alerting designated organizational personnel, restoring mandatory/organization-defined configuration settings, or in the extreme case, halting affected information system processing.

(3) The organization incorporates detection of unauthorized, security-relevant configuration changes into the organization's incident response capability to ensure that such detected events are tracked, monitored, corrected, and available for historical purposes.

Enchancement Supplemental Guidance:

Related controls: IR-4, IR-5.

(4) The information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance (i.e., security checklists), prior to being introduced into a production environment.

References:

OMB Memoranda 07-11, 07-18, 08-22; NIST Special Publications 800-70, 800-128; Web: NVD.NIST.GOV; WWW.NSA.GOV.

Priority and Baseline Allocation:

 

P1

LOW   CM-6

MOD   CM-6 (3)

HIGH   CM-6 (1) (2) (3)

ISO/IEC 27001 Annex A Control Mapping:

None

FAMILY:CONFIGURATION MANAGEMENT

CLASS:OPERATIONAL

CM-7 LEAST FUNCTIONALITY

Control:

The organization configures the information system to provide only essential capabilities and specifically prohibits or restricts the use of the following functions, ports, protocols, and/or services: [Assignment: organization-defined list of prohibited or restricted functions, ports, protocols, and/or services].

Supplemental Guidance:

Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from a single component of an information system, but doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit component functionality to a single function per device (e.g., email server or web server, not both). The functions and services provided by organizational information systems, or individual components of information systems, are carefully reviewed to determine which functions and services are candidates for elimination (e.g., Voice Over Internet Protocol, Instant Messaging, auto-execute, file sharing). Organizations consider disabling unused or unnecessary physical and logical ports and protocols (e.g., Universal Serial Bus [USB], File Transfer Protocol [FTP], Internet Protocol Version 6 [IPv6], Hyper Text Transfer Protocol [HTTP]) on information system components to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling. Organizations can utilize network scanning tools, intrusion detection and prevention systems, and end-point protections such as firewalls and host-based intrusion detection systems to identify and prevent the use of prohibited functions, ports, protocols, and services. Related control: RA-5.

Control Enhancements:

(1) The organization reviews the information system [Assignment: organization-defined frequency] to identify and eliminate unnecessary functions, ports, protocols, and/or services.

(2) The organization employs automated mechanisms to prevent program execution in accordance with [Selection (one or more): list of authorized software programs; list of unauthorized software programs; rules authorizing the terms and conditions of software program usage].

Enchancement Supplemental Guidance:

Related control: CM-2.

(3) The organization ensures compliance with [Assignment: organization-defined registration requirements for ports, protocols, and services].

Enchancement Supplemental Guidance:

Organizations use the registration process to manage, track, and provide oversight for information systems and implemented functionality.

References:

None.

Priority and Baseline Allocation:

 

P1

LOW   CM-7

MOD   CM-7 (1)

HIGH   CM-7 (1) (2)

ISO/IEC 27001 Annex A Control Mapping:

None

FAMILY:CONFIGURATION MANAGEMENT

CLASS:OPERATIONAL

CM-8 INFORMATION SYSTEM COMPONENT INVENTORY

Control:

The organization develops, documents, and maintains an inventory of information system components that:
    a. Accurately reflects the current information system;
    b. Is consistent with the authorization boundary of the information system;
    c. Is at the level of granularity deemed necessary for tracking and reporting;
    d. Includes [Assignment: organization-defined information deemed necessary to achieve effective property accountability]; and
    e. Is available for review and audit by designated organizational officials.
    

Supplemental Guidance:

Information deemed to be necessary by the organization to achieve effective property accountability can include, for example, hardware inventory specifications (manufacturer, type, model, serial number, physical location), software license information, information system/component owner, and for a networked component/device, the machine name and network address. Related controls: CM-2, CM-6.

Control Enhancements:

(1) The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.

(2) The organization employs automated mechanisms to help maintain an up-to-date, complete, accurate, and readily available inventory of information system components.

Enchancement Supplemental Guidance:

Organizations maintain the information system inventory to the extent feasible. Virtual machines, for example, can be difficult to monitor because they are not visible to the network when not in use. In such cases, the intent of this control enhancement is to maintain as up-to-date, complete, and accurate an inventory as is reasonable.

(3) The organization:
    (a) Employs automated mechanisms [Assignment: organization-defined frequency] to detect the addition of unauthorized components/devices into the information system; and
    (b) Disables network access by such components/devices or notifies designated organizational officials.
    

Enchancement Supplemental Guidance:

This control enhancement is applied in addition to the monitoring for unauthorized remote connections in AC-17 and for unauthorized mobile devices in AC-19. The monitoring for unauthorized components/devices on information system networks may be accomplished on an ongoing basis or by the periodic scanning of organizational networks for that purpose. Automated mechanisms can be implemented within the information system and/or in another separate information system or device. Related controls: AC-17, AC-19.

(4) The organization includes in property accountability information for information system components, a means for identifying by [Selection (one or more): name; position; role] individuals responsible for administering those components.

(5) The organization verifies that all components within the authorization boundary of the information system are either inventoried as a part of the system or recognized by another system as a component within that system.

(6) The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.

Enchancement Supplemental Guidance:

: This control enhancement focuses on the configuration settings established by the organization for its information system components, the specific information system components that have been assessed to determine compliance with the required configuration settings, and any approved deviations from established configuration settings in the deployed information system components. Related controls: CM-2, CM-6.

References:

NIST Special Publication 800-128.

Priority and Baseline Allocation:

 

P1

LOW   CM-8

MOD   CM-8 (1) (5)

HIGH   CM-8 (1) (2) (3) (4) (5)

ISO/IEC 27001 Annex A Control Mapping:

A.7.1.1	Inventory of assets
A.7.1.2	Ownership of assets

FAMILY:CONFIGURATION MANAGEMENT

CLASS:OPERATIONAL

CM-9 CONFIGURATION MANAGEMENT PLAN

Control:

The organization develops, documents, and implements a configuration management plan for the information system that:
    a. Addresses roles, responsibilities, and configuration management processes and procedures;
    b. Defines the configuration items for the information system and when in the system development life cycle the configuration items are placed under configuration management; and
    c. Establishes the means for identifying configuration items throughout the system development life cycle and a process for managing the configuration of the configuration items.
    

Supplemental Guidance:

Configuration items are the information system items (hardware, software, firmware, and documentation) to be configuration managed. The configuration management plan satisfies the requirements in the organization's configuration management policy while being tailored to the individual information system. The configuration management plan defines detailed processes and procedures for how configuration management is used to support system development life cycle activities at the information system level. The plan describes how to move a change through the change management process, how configuration settings and configuration baselines are updated, how the information system component inventory is maintained, how development, test, and operational environments are controlled, and finally, how documents are developed, released, and updated. The configuration management approval process includes designation of key management stakeholders that are responsible for reviewing and approving proposed changes to the information system, and security personnel that would conduct an impact analysis prior to the implementation of any changes to the system. Related control: SA-10.

Control Enhancements:

(1) The organization assigns responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.

Enchancement Supplemental Guidance:

In the absence of a dedicated configuration management team, the system integrator may be tasked with developing the configuration management process.

References:

NIST Special Publication 800-128.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   CM-9

HIGH   CM-9

ISO/IEC 27001 Annex A Control Mapping:

A.6.1.3.A.7.1.1
A.7.1.2	Ownership of assets
A.8.1.1	Roles and Responsibilities
A.10.1.1	Documented operating procedures
A.10.1.2	Change management
A.10.3.2	System acceptance
A.12.4.1	Control of operational software
A.12.4.3	Access control to program source code
A.12.5.1	Change control procedures
A.12.5.2	Technical review of applications after operating system changes
A.12.5.3	Restrictions on changes to software packages

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-1 CONTINGENCY PLANNING POLICY AND PROCEDURES

Control:

The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]:
    a. A formal, documented contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    b. Formal, documented procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls.
    

Supplemental Guidance:

This control is intended to produce the policy and procedures that are required for the effective implementation of selected security controls and control enhancements in the contingency planning family. The policy and procedures are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary. The contingency planning policy can be included as part of the general information security policy for the organization. Contingency planning procedures can be developed for the security program in general and for a particular information system, when required. The organizational risk management strategy is a key factor in the development of the contingency planning policy. Related control: PM-9.

References:

Federal Continuity Directive 1; NIST Special Publications 800-12, 800-34, 800-100.

Priority and Baseline Allocation:

 

P1

LOW   CP-1

MOD   CP-1

HIGH   CP-1

ISO/IEC 27001 Annex A Control Mapping:

A.5.1.1	Information security policy document
A.5.1.2	Review of the information security policy
A.6.1.1	Management commitment to information security
A.6.1.3	Allocation of information security responsibilities
A.8.1.1	Roles and Responsibilities
A.9.1.4	Protecting against external and environmental threats
A.10.1.1	Documented operating procedures
A.10.1.2	Change management
A.14.1.1	Including information security in the business continuity management process
A.14.1.3	Developing and implementing continuity plans including information security
A.15.1.1	Identification of applicable legislation
A.15.2.1	Compliance with security policies and standards

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-2 CONTINGENCY PLAN

Control:

The organization:
    a. Develops a contingency plan for the information system that:
    - Identifies essential missions and business functions and associated contingency requirements;
    - Provides recovery objectives, restoration priorities, and metrics;
    - Addresses contingency roles, responsibilities, assigned individuals with contact information;
    - Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;
    - Addresses eventual, full information system restoration without deterioration of the security measures originally planned and implemented; and
    - Is reviewed and approved by designated officials within the organization;
    b. Distributes copies of the contingency plan to [Assignment: organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements];
    c. Coordinates contingency planning activities with incident handling activities;
    d. Reviews the contingency plan for the information system [Assignment: organization-defined frequency];
    e. Revises the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; and
    f. Communicates contingency plan changes to [Assignment: organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements].
    

Supplemental Guidance:

Contingency planning for information systems is part of an overall organizational program for achieving continuity of operations for mission/business operations. Contingency planning addresses both information system restoration and implementation of alternative mission/business processes when systems are compromised. Information system recovery objectives are consistent with applicable laws, Executive Orders, directives, policies, standards, or regulations. In addition to information system availability, contingency plans also address other security-related events resulting in a reduction in mission/business effectiveness, such as malicious attacks compromising the confidentiality or integrity of the information system. Examples of actions to call out in contingency plans include, for example, graceful degradation, information system shutdown, fall back to a manual mode, alternate information flows, or operating in a mode that is reserved solely for when the system is under attack. Related controls: AC-14, CP-6, CP-7, CP-8, IR-4, PM-8, PM-11.

Control Enhancements:

(1) The organization coordinates contingency plan development with organizational elements responsible for related plans.

Enchancement Supplemental Guidance:

Examples of related plans include Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Crisis Communications Plan, Critical Infrastructure Plan, Cyber Incident Response Plan, and Occupant Emergency Plan.

(2) The organization conducts capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.

(3) The organization plans for the resumption of essential missions and business functions within [Assignment: organization-defined time period] of contingency plan activation.

(4) The organization plans for the full resumption of missions and business functions within [Assignment: organization-defined time period] of contingency plan activation.

(5) The organization plans for the continuance of essential missions and business functions with little or no loss of operational continuity and sustains that continuity until full information system restoration at primary processing and/or storage sites.

(6) The organization provides for the transfer of all essential missions and business functions to alternate processing and/or storage sites with little or no loss of operational continuity and sustains that continuity through restoration to primary processing and/or storage sites.

References:

Federal Continuity Directive 1; NIST Special Publication 800-34.

Priority and Baseline Allocation:

 

P1

LOW   CP-2

MOD   CP-2 (1)

HIGH   CP-2 (1) (2) (3)

ISO/IEC 27001 Annex A Control Mapping:

A.6.1.2	Information security coordination
A.9.1.4	Protecting against external and environmental threats
A.10.3.1	Capacity management
A.14.1.1	Including information security in the business continuity management process
A.14.1.2	Business continuity and risk assessment
A.14.1.3	Developing and implementing continuity plans including information security
A.14.1.4	Business continuity planning framework
A.14.1.5	Testing, maintaining and reassessing business continuity plans

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-3 CONTINGENCY TRAINING

Control:

The organization trains personnel in their contingency roles and responsibilities with respect to the information system and provides refresher training [Assignment: organization-defined frequency].

Supplemental Guidance:

None.

Control Enhancements:

(1) The organization incorporates simulated events into contingency training to facilitate effective response by personnel in crisis situations.

(2) The organization employs automated mechanisms to provide a more thorough and realistic training environment.

References:

NIST Special Publications 800-16, 800-50.

Priority and Baseline Allocation:

 

P2

LOW   CP-3

MOD   CP-3

HIGH   CP-3 (1)

ISO/IEC 27001 Annex A Control Mapping:

A.8.2.2	Awareness, education, and training
A.9.1.4	Protecting against external and environmental threats
A.14.1.3	Developing and implementing continuity plans including information security

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-4 CONTINGENCY PLAN TESTING AND EXERCISES

Control:

The organization:
    a. Tests and/or exercises the contingency plan for the information system [Assignment: organization-defined frequency] using [Assignment: organization-defined tests and/or exercises] to determine the plan's effectiveness and the organization's readiness to execute the plan; and
    b. Reviews the contingency plan test/exercise results and initiates corrective actions.
    

Supplemental Guidance:

There are several methods for testing and/or exercising contingency plans to identify potential weaknesses (e.g., checklist, walk-through/tabletop, simulation: parallel, full interrupt). Contingency plan testing and/or exercises include a determination of the effects on organizational operations and assets (e.g., reduction in mission capability) and individuals arising due to contingency operations in accordance with the plan.

Control Enhancements:

(1) The organization coordinates contingency plan testing and/or exercises with organizational elements responsible for related plans.

Enchancement Supplemental Guidance:

Examples of related plans include Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Crisis Communications Plan, Critical Infrastructure Plan, Cyber Incident Response Plan, and Occupant Emergency Plan.

(2) The organization tests/exercises the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources and to evaluate the site's capabilities to support contingency operations.

(3) The organization employs automated mechanisms to more thoroughly and effectively test/exercise the contingency plan by providing more complete coverage of contingency issues, selecting more realistic test/exercise scenarios and environments, and more effectively stressing the information system and supported missions.

(4) The organization includes a full recovery and reconstitution of the information system to a known state as part of contingency plan testing.

Enchancement Supplemental Guidance:

Related controls: CP-10, SC-24.

References:

FIPS Publication 199; NIST Special Publications 800-34, 800-84.

Priority and Baseline Allocation:

 

P2

LOW   CP-4

MOD   CP-4 (1)

HIGH   CP-4 (1) (2) (4)

ISO/IEC 27001 Annex A Control Mapping:

A.6.1.2	Information security coordination
A.9.1.4	Protecting against external and environmental threats
A.14.1.1	Including information security in the business continuity management process
A.14.1.3	Developing and implementing continuity plans including information security
A.14.1.4	Business continuity planning framework
A.14.1.5	Testing, maintaining and reassessing business continuity plans

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-5 CONTINGENCY PLAN UPDATE

Control:

[Withdrawn: Incorporated into CP-2].

Supplemental Guidance:

References:

Priority and Baseline Allocation:

 

---

LOW   ---

MOD   ---

HIGH   ---

ISO/IEC 27001 Annex A Control Mapping:

---

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-6 ALTERNATE STORAGE SITE

Control:

The organization establishes an alternate storage site including necessary agreements to permit the storage and recovery of information system backup information.

Supplemental Guidance:

Related controls: CP-2, CP-9, MP-4.

Control Enhancements:

(1) The organization identifies an alternate storage site that is separated from the primary storage site so as not to be susceptible to the same hazards.

Enchancement Supplemental Guidance:

Hazards of concern to the organization are typically defined in an organizational assessment of risk.

(2) The organization configures the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.

(3) The organization identifies potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

Enchancement Supplemental Guidance:

Explicit mitigation actions include, for example, duplicating backup information at another alternate storage site if access to the first alternate site is hindered; or, if electronic accessibility to the alternate site is disrupted, planning for physical access to retrieve backup information.

References:

NIST Special Publication 800-34.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   CP-6 (1) (3)

HIGH   CP-6 (1) (2) (3)

ISO/IEC 27001 Annex A Control Mapping:

A.9.1.4	Protecting against external and environmental threats
A.14.1.3	Developing and implementing continuity plans including information security

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-7 ALTERNATE PROCESSING SITE

Control:

The organization:
    a. Establishes an alternate processing site including necessary agreements to permit the resumption of information system operations for essential missions and business functions within [Assignment: organization-defined time period consistent with recovery time objectives] when the primary processing capabilities are unavailable; and
    b. Ensures that equipment and supplies required to resume operations are available at the alternate site or contracts are in place to support delivery to the site in time to support the organization-defined time period for resumption.
    

Supplemental Guidance:

Related control: CP-2.

Control Enhancements:

(1) The organization identifies an alternate processing site that is separated from the primary processing site so as not to be susceptible to the same hazards.

Enchancement Supplemental Guidance:

Hazards that might affect the information system are typically defined in the risk assessment.

(2) The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

(3) The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with the organization's availability requirements.

(4) The organization configures the alternate processing site so that it is ready to be used as the operational site supporting essential missions and business functions.

(5) The organization ensures that the alternate processing site provides information security measures equivalent to that of the primary site

References:

NIST Special Publication 800-34.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   CP-7 (1) (2) (3) (5)

HIGH   CP-7 (1) (2) (3) (4) (5)

ISO/IEC 27001 Annex A Control Mapping:

A.9.1.4	Protecting against external and environmental threats
A.14.1.3	Developing and implementing continuity plans including information security

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-8 TELECOMMUNICATIONS SERVICES

Control:

The organization establishes alternate telecommunications services including necessary agreements to permit the resumption of information system operations for essential missions and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable.

Supplemental Guidance:

Related control: CP-2.

Control Enhancements:

(1) The organization:
    (a) Develops primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with the organization's availability requirements; and
    (b) Requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.
    

(2) The organization obtains alternate telecommunications services with consideration for reducing the likelihood of sharing a single point of failure with primary telecommunications services.

(3) The organization obtains alternate telecommunications service providers that are separated from primary service providers so as not to be susceptible to the same hazards.

(4) The organization requires primary and alternate telecommunications service providers to have contingency plans.

References:

NIST Special Publication 800-34; Web: TSP.NCS.GOV.

Priority and Baseline Allocation:

 

P1

LOW   Not Selected

MOD   CP-8 (1) (2)

HIGH   CP-8 (1) (2) (3) (4)

ISO/IEC 27001 Annex A Control Mapping:

A.9.1.4	Protecting against external and environmental threats
A.10.6.1	Network controls
A.14.1.3	Developing and implementing continuity plans including information security

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-9 INFORMATION SYSTEM BACKUP

Control:

The organization:
    a. Conducts backups of user-level information contained in the information system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives];
    b. Conducts backups of system-level information contained in the information system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives];
    c. Conducts backups of information system documentation including security-related documentation [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; and
    d. Protects the confidentiality and integrity of backup information at the storage location.
    

Supplemental Guidance:

System-level information includes, for example, system-state information, operating system and application software, and licenses. Digital signatures and cryptographic hashes are examples of mechanisms that can be employed by organizations to protect the integrity of information system backups. An organizational assessment of risk guides the use of encryption for protecting backup information. The protection of system backup information while in transit is beyond the scope of this control. Related controls: CP-6, MP-4.

Control Enhancements:

(1) The organization tests backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity.

(2) The organization uses a sample of backup information in the restoration of selected information system functions as part of contingency plan testing.

(3) The organization stores backup copies of the operating system and other critical information system software, as well as copies of the information system inventory (including hardware, software, and firmware components) in a separate facility or in a fire-rated container that is not colocated with the operational system.

(4) [Withdrawn: Incorporated into CP-9].

(5) The organization transfers information system backup information to the alternate storage site [Assignment: organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives].

(6) The organization accomplishes information system backup by maintaining a redundant secondary system, not collocated, that can be activated without loss of information or disruption to the operation.

References:

NIST Special Publication 800-34.

Priority and Baseline Allocation:

 

P1

LOW   CP-9

MOD   CP-9 (1)

HIGH   CP-9 (1) (2) (3)

ISO/IEC 27001 Annex A Control Mapping:

A.9.1.4	Protecting against external and environmental threats
A.10.5.1	Information backup
A.14.1.3	Developing and implementing continuity plans including information security
A.15.1.3	Protection of organizational records

FAMILY:CONTINGENCY PLANNING

CLASS:OPERATIONAL

CP-10 INFORMATION SYSTEM RECOVERY AND RECONSTITUTION

Control:

The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

Supplemental Guidance:

Recovery is executing information system contingency plan activities to restore essential missions and business functions. Reconstitution takes place following recovery and includes activities for returning the information system to its original functional state before contingency plan activation. Recovery and reconstitution procedures are based on organizational priorities, established recovery point/time and reconstitution objectives, and appropriate metrics. Reconstitution includes the deactivation of any interim information system capability that may have been needed during recovery operations. Reconstitution also includes an assessment of the fully restored information system capability, a potential system reauthorization and the necessary activities to prepare the system against another disruption, compromise, or failure. Recovery and reconstitution capabilities employed by the organization can be a combination of automated mechanisms and manual procedures. Related controls: CA-2, CA-6, CA-7, SC-24.

Control Enhancements:

(1) [Withdrawn: Incorporated into CP-4].

(2) The information system implements transaction recovery for systems that are transaction-based.

Enchancement Supplemental Guidance:

Database management systems and transaction processing systems are examples of information systems that are transaction-based. Transaction rollback and transaction journaling are examples of mechanisms supporting transaction recovery.

(3) The organization provides compensating security controls for [Assignment: organization-defined circumstances that can inhibit recovery and reconstitution to a known state].

(4) The organization provides the capability to reimage information system components within [Assignment: organization-defined restoration time-periods] from configuration-controlled and integrity-protected disk images representing a secure, operational state for the components.

(5) The organization provides [Selection: real-time; near-real-time] [Assignment: organization-defined failover capability for the information system].

Enchancement Supplemental Guidance:

Examples of failover capability are incorporating mirrored information system operations at an alternate processing site or periodic data mirroring at regular intervals during a time period defined by the organization's recovery time period.

(6) The organization protects backup and restoration hardware, firmware, and software.

Enchancement Supplemental Guidance:

Protection of backup and restoration hardware, firmware, and software includes both physical and technical measures. Router tables, compilers, and other security-relevant system software are examples of backup and restoration software.

References:

NIST Special Publication 800-34.

Priority and Baseline Allocation:

 

P1

LOW   CP-10

MOD   CP-10 (2) (3)

HIGH   CP-10 (2) (3) (4)

ISO/IEC 27001 Annex A Control Mapping:

A.9.1.4	Protecting against external and environmental threats
A.14.1.3	Developing and implementing continuity plans including information security