Access Control
- AC-02
- AC-03
- AC-07
- AC-08
- AC-14
- AC-17
- AC-18
- AC-19
- AC-20
- AC-22
Awareness and Training
Audit and Accountability
- AU-02
- AU-03
- AU-04
- AU-05
- AU-06
- AU-08
- AU-09
- AU-11
- AU-12
Assessment, Authorization, and Monitoring
- CA-02
- CA-03
- CA-05
- CA-06
- CA-07
- CA-07(04)
- CA-09
Configuration Management
- CM-02
- CM-04
- CM-05
- CM-06
- CM-07
- CM-08
- CM-10
- CM-11
Contingency Planning
Identification and Authentication
- IA-02
- IA-02(01)
- IA-02(02)
- IA-02(08)
- IA-02(12)
- IA-04
- IA-05
- IA-05(01)
- IA-06
- IA-07
- IA-08
- IA-08(01)
- IA-08(02)
- IA-08(04)
- IA-11
Incident Response
- IR-02
- IR-04
- IR-05
- IR-06
- IR-07
- IR-08
Maintenance
Media Protection
Risk Assessment
- RA-02
- RA-03
- RA-03(01)
- RA-05
- RA-05(02)
- RA-05(11)
- RA-07
System and Services Acquisition
- SA-02
- SA-03
- SA-04
- SA-04(10)
- SA-05
- SA-08
- SA-09
- SA-22
System and Communications Protection
- SC-05
- SC-07
- SC-12
- SC-13
- SC-15
- SC-20
- SC-21
- SC-22
- SC-39
System and Information Integrity
- SI-02
- SI-03
- SI-04
- SI-05
- SI-12
Supply Chain Risk Management
- SR-02
- SR-03
- SR-05
- SR-10
- SR-11
- SR-11(01)
- SR-11(02)
- SR-12