Access Control
- AC-02
 - AC-03
 - AC-07
 - AC-08
 - AC-14
 - AC-17
 - AC-18
 - AC-19
 - AC-20
 - AC-22
 
Awareness and Training
Audit and Accountability
- AU-02
 - AU-03
 - AU-04
 - AU-05
 - AU-06
 - AU-08
 - AU-09
 - AU-11
 - AU-12
 
Assessment, Authorization, and Monitoring
- CA-02
 - CA-03
 - CA-05
 - CA-06
 - CA-07
 - CA-07(04)
 - CA-09
 
Configuration Management
- CM-02
 - CM-04
 - CM-05
 - CM-06
 - CM-07
 - CM-08
 - CM-10
 - CM-11
 
Contingency Planning
Identification and Authentication
- IA-02
 - IA-02(01)
 - IA-02(02)
 - IA-02(08)
 - IA-02(12)
 - IA-04
 - IA-05
 - IA-05(01)
 - IA-06
 - IA-07
 - IA-08
 - IA-08(01)
 - IA-08(02)
 - IA-08(04)
 - IA-11
 
Incident Response
- IR-02
 - IR-04
 - IR-05
 - IR-06
 - IR-07
 - IR-08
 
Maintenance
Media Protection
Risk Assessment
- RA-02
 - RA-03
 - RA-03(01)
 - RA-05
 - RA-05(02)
 - RA-05(11)
 - RA-07
 
System and Services Acquisition
- SA-02
 - SA-03
 - SA-04
 - SA-04(10)
 - SA-05
 - SA-08
 - SA-09
 - SA-22
 
System and Communications Protection
- SC-05
 - SC-07
 - SC-12
 - SC-13
 - SC-15
 - SC-20
 - SC-21
 - SC-22
 - SC-39
 
System and Information Integrity
- SI-02
 - SI-03
 - SI-04
 - SI-05
 - SI-12
 
Supply Chain Risk Management
- SR-02
 - SR-03
 - SR-05
 - SR-10
 - SR-11
 - SR-11(01)
 - SR-11(02)
 - SR-12