Xylok Scanner CCIs

Number	Definition	Status	Related
CCI-000781	The information system authenticates devices before establishing network connections using bidirectional authentication between devices that is cryptographically based.	Draft
CCI-000782	The organization standardizes, with regard to dynamic address allocation, Dynamic Host Control Protocol (DHCP) lease information and the time assigned to DHCP-enabled devices.	Draft
CCI-000783	Audit lease information when assigned to a device.	Draft	IA-3(3)
CCI-000784	The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a user identifier.	Draft
CCI-000785	The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a device identifier.	Draft
CCI-000786	The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies an individual.	Draft
CCI-000787	The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies a device.	Draft
CCI-000788	The organization manages information system identifiers for users and devices by assigning the user identifier to the intended party.	Draft
CCI-000789	The organization manages information system identifiers for users and devices by assigning the device identifier to the intended device.	Draft
CCI-000790	The organization defines a time period for which the reuse of user identifiers is prohibited.	Draft
CCI-000791	The organization defines a time period for which the reuse of device identifiers is prohibited.	Draft
CCI-000792	The organization manages information system identifiers for users and devices by preventing reuse of user identifiers for an organization-defined time period.	Draft
CCI-000793	The organization manages information system identifiers for users and devices by preventing reuse of device identifiers for an organization-defined time period.	Draft
CCI-000794	The organization defines a time period of inactivity after which the identifier is disabled.	Draft	IA-4
CCI-000795	The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.	Draft	IA-4
CCI-000796	Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.	Draft	IA-4(1)
CCI-000797	The organization requires that registration to receive a user ID and password include authorization by a supervisor.	Draft
CCI-000798	The organization requires that registration to receive a user ID and password be done in person before a designated registration authority.	Draft
CCI-000799	The organization requires multiple forms of certification of individual identification, such as documentary evidence or a combination of documents and biometrics, be presented to the registration authority.	Draft	IA-4(3)
CCI-000800	Defines characteristics for identifying individual status.	Draft	IA-4(4)
CCI-000801	Manage individual identifiers by uniquely identifying each individual as organization-defined characteristics identifying individual status.	Draft	IA-4(4)
CCI-000802	The information system dynamically manages identifiers, attributes, and associated access authorizations.	Draft
CCI-000803	Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.	Draft	IA-7
CCI-000804	Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.	Draft	IA-8
CCI-000805	Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.	Draft	IR-1
CCI-000806	Disseminate an organization-level; mission/business process-level; and/or system-level incident response policy to organization-defined personnel or roles.	Draft	IR-1
CCI-000807	Review and update the current incident response policy in accordance with organization-defined frequency.	Draft	IR-1
CCI-000808	Defines the frequency with which to review and update the current incident response policy.	Draft	IR-1
CCI-000809	Develop and document procedures to facilitate the implementation of incident response policy and associated incident response controls.	Draft	IR-1
CCI-000810	Disseminate the incident response procedures to organization-defined personnel or roles.	Draft	IR-1

CCI-000781

The information system authenticates devices before establishing network connections using bidirectional authentication between devices that is cryptographically based.

Draft

CCI-000782

The organization standardizes, with regard to dynamic address allocation, Dynamic Host Control Protocol (DHCP) lease information and the time assigned to DHCP-enabled devices.

Draft

CCI-000783

Audit lease information when assigned to a device.

Draft

IA-3(3)

CCI-000784

The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a user identifier.