Access Control
- AC-02: Manage system accounts and monitor account activity
- AC-03: Enforce approved authorizations for logical system access
- AC-07: Enforce limits for consecutive invalid logon attempts
- AC-08: Display system use notification messages before access
- AC-14: Identify and authorize actions without user authentication
- AC-17: Establish and manage usage for remote access
- AC-18: Establish and manage usage for wireless access
- AC-19: Establish and manage usage for mobile devices
- AC-20: Establish terms and conditions for external systems
- AC-22: Manage and review information on public websites
Awareness and Training
- AT-02: Provide basic security awareness training to users
- AT-02(2): Provide awareness training regarding potential insider threats
- AT-03: Provide security training for specific assigned roles
- AT-04: Document and monitor individual security training status
Audit and Accountability
- AU-02: Select and log security relevant system events
- AU-03: Ensure audit records contain necessary security information
- AU-04: Provide sufficient storage capacity for audit logs
- AU-05: Respond appropriately to audit logging process failures
- AU-06: Review and analyze system audit records regularly
- AU-08: Use internal system clocks for audit timestamps
- AU-09: Protect audit information from unauthorized access attempts
- AU-11: Retain audit records for the required duration
- AU-12: Generate audit records for specific system events
Assessment, Authorization, and Monitoring
- CA-02: Assess system security controls for continued effectiveness
- CA-03: Manage and authorize external system information exchanges
- CA-05: Document plans to correct security control weaknesses
- CA-06: Authorize system operation based on risk assessment
- CA-07: Monitor system security posture on continuous basis
- CA-07(4): Monitor risk to organizational operations and assets
- CA-09: Authorize and document all internal system connections
Configuration Management
- CM-02: Maintain current baseline configurations for organizational systems
- CM-04: Analyze security impact of proposed system changes
- CM-05: Enforce physical and logical access for changes
- CM-06: Establish and enforce secure system configuration settings
- CM-07: Configure systems to provide only essential functions
- CM-08: Maintain a current inventory of system components
- CM-10: Comply with software usage and license restrictions
- CM-11: Enforce policies regarding user installed system software
Identification and Authentication
- IA-02: Uniquely identify and authenticate all organizational users
- IA-02(1): Enforce multi-factor authentication for privileged account access
- IA-02(2): Enforce multi-factor authentication for nonprivileged account access
- IA-02(08): Implement replay resistant authentication for network access
- IA-02(12): Accept Personal Identity Verification credentials for authentication
- IA-04: Manage system user and device identifier lifecycles
- IA-05: Manage system authenticators throughout their entire lifecycle
- IA-05(1): Enforce specific requirements for password based authentication
- IA-06: Obscure authentication feedback to prevent shoulder surfing
- IA-07: Authenticate to cryptographic modules using approved methods
- IA-08: Identify and authenticate all non-organizational users
- IA-08(1): Accept PIV credentials from other federal agencies
- IA-08(2): Accept authorized external authenticators for system access
- IA-08(4): Implement specific profiles for non-organizational users
- IA-11: Require reauthentication for specific system access events
Incident Response
- IR-02: Provide incident response training to specific personnel
- IR-03: Test incident response capabilities for organizational systems
- IR-04: Implement incident handling for security related events
- IR-05: Track and document all system security incidents
- IR-06: Report system security incidents to designated officials
- IR-07: Provide incident response support for system users
- IR-08: Develop and maintain an incident response plan
Media Protection
- MP-02: Restrict access to specific system media types
- MP-06: Sanitize system media before disposal or reuse
- MP-07: Restrict use of system media on components
Physical and Environmental Protection
- PE-02: Authorize physical access to facilities and systems
- PE-03: Implement physical access controls at facility boundaries
- PE-06: Monitor physical access to the system environment
- PE-08: Maintain logs of all facility visitor access
- PE-12: Provide emergency lighting for system facility exits
- PE-13: Maintain fire suppression and detection for systems
- PE-14: Maintain temperature and humidity within acceptable levels
- PE-15: Protect systems from damage caused by water
- PE-16: Control system component deliveries and removals securely
Risk Assessment
- RA-02: Categorize information and systems according to impact
- RA-03: Conduct periodic assessments of organizational security risk
- RA-03(1): Assess risks associated with the supply chain
- RA-05: Scan for vulnerabilities in organizational system components
- RA-05(2): Update the list of vulnerabilities being scanned
- RA-05(11): Establish a program for public vulnerability disclosure
- RA-07: Implement risk response measures for identified threats
