Navigate

Overlay Cross Domain (Multilevel)

Additions

This overlay adds the following controls.

Control	Description
AC-3(2)	The information system enforces dual authorization for [one of ].
AC-3(3)	The information system enforces [one of ] over all subjects and objects where the policy: (a): Is uniformly enforced across all subjects and objects within the boundary of the information system; (b): Specifies that a subject that has been granted access to information is constrained from doing any of the following; (1): Passing the information to unauthorized subjects or objects; (2): Granting its privileges to other subjects; (3): Changing one or more security attributes on subjects, objects, the information system, or information system components; (4): Choosing the security attributes and attribute values to be associated with newly created or modified objects; or (5): Changing the rules governing access control; and (c): Specifies that [one of ] may explicitly be granted [one of ] such that they are not limited by some or all of the above constraints.
AC-3(5)	The information system prevents access to [one of ] except during secure, non-operable system states.
AC-3(7)	The information system enforces a role-based access control policy over defined subjects and objects and controls access based upon [one of ].
AC-3(9)	The information system does not release information outside of the established system boundary unless: (a): The receiving [one of ] provides [one of ]; and (b): [one of ] are used to validate the appropriateness of the information designated for release.
AC-4(1)	The information system uses [one of ] associated with [one of ] to enforce [one of ] as a basis for flow control decisions.
AC-4(2)	The information system uses protected processing domains to enforce [one of ] as a basis for flow control decisions.
AC-4(4)	The information system prevents encrypted information from bypassing content-checking mechanisms by [one or more of "decrypting the information"/"blocking the flow of the encrypted information"/"terminating communications sessions attempting to pass encrypted information"/" {{ insert: param, ac-4.4_prm_2 }} "].
AC-4(5)	The information system enforces [one of ] on embedding data types within other data types.
AC-4(6)	The information system enforces information flow control based on [one of ].
AC-4(8)	The information system enforces information flow control using [one of ] as a basis for flow control decisions for [one of ].
AC-4(10)	The information system provides the capability for privileged administrators to enable/disable [one of ] under the following conditions: [one of ].
AC-4(11)	The information system provides the capability for privileged administrators to configure [one of ] to support different security policies.
AC-4(12)	The information system, when transferring information between different security domains, uses [one of ] to validate data essential for information flow decisions.
AC-4(13)	The information system, when transferring information between different security domains, decomposes information into [one of ] for submission to policy enforcement mechanisms.
AC-4(14)	The information system, when transferring information between different security domains, implements [one of ] requiring fully enumerated formats that restrict data structure and content.
AC-4(15)	The information system, when transferring information between different security domains, examines the information for the presence of [one of ] and prohibits the transfer of such information in accordance with the [one of ].
AC-4(17)	The information system uniquely identifies and authenticates source and destination points by [one or more of "organization, system, application, individual"] for information transfer.
AC-4(18)	The information system binds security attributes to information using [one of ] to facilitate information flow policy enforcement.
AC-4(19)	The information system, when transferring information between different security domains, applies the same security policy filtering to metadata as it applies to data payloads.
AC-4(20)	The organization employs [one of ] to control the flow of [one of ] across security domains.
AC-4(21)	The information system separates information flows logically or physically using [one of ] to accomplish [one of ].
AC-5	The organization: a: Separates [one of ]; b: Documents separation of duties of individuals; and c: Defines information system access authorizations to support separation of duties.
AC-6(6)	The organization prohibits privileged access to the information system by non-organizational users.
AC-16(1)	The information system dynamically associates security attributes with [one of ] in accordance with [one of ] as information is created and combined.
AC-16(2)	The information system provides authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security attributes.
AC-16(3)	The information system maintains the association and integrity of [one of ] to [one of ].
AC-16(4)	The information system supports the association of [one of ] with [one of ] by authorized individuals (or processes acting on behalf of individuals).
AC-16(5)	The information system displays security attributes in human-readable form on each object that the system transmits to output devices to identify [one of ] using [one of ].
AC-16(7)	The organization provides a consistent interpretation of security attributes transmitted between distributed information system components.
AC-16(8)	The information system implements [one of ] with [one of ] in associating security attributes to information.
AC-16(9)	The organization ensures that security attributes associated with information are reassigned only via re-grading mechanisms validated using [one of ].
AC-21(1)	The information system enforces information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
AC-23	The organization employs [one of ] for [one of ] to adequately detect and protect against data mining.
AC-25	The information system implements a reference monitor for [one of ] that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.
AT-2(2)	The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.
AU-5(2)	The information system provides an alert in [one of ] to [one of ] when the following audit failure events occur: [one of ].
AU-5(4)	The information system invokes a [one of "full system shutdown"/"partial system shutdown"/"degraded operational mode with limited mission/business functionality available"] in the event of [one of ], unless an alternate audit capability exists.
AU-6	The organization: a: Reviews and analyzes information system audit records [one of ] for indications of [one of ]; and b: Reports findings to [one of ].
AU-6(5)	The organization integrates analysis of audit records with analysis of [one or more of "vulnerability scanning information"/"performance data"/"information system monitoring information"/" {{ insert: param, au-6.5_prm_2 }} "] to further enhance the ability to identify inappropriate or unusual activity.
AU-6(7)	The organization specifies the permitted actions for each [one or more of "information system process"/"role"/"user"] associated with the review, analysis, and reporting of audit information.
AU-6(8)	The organization performs a full text analysis of audited privileged commands in a physically distinct component or subsystem of the information system, or other information system that is dedicated to that analysis.
AU-6(9)	The organization correlates information from nontechnical sources with audit information to enhance organization-wide situational awareness.
AU-7(2)	The information system provides the capability to sort and search audit records for events of interest based on the content of [one of ].
AU-9(2)	The information system backs up audit records [one of ] onto a physically different system or system component than the system or component being audited.
AU-9(5)	The organization enforces dual authorization for [one or more of "movement"/"deletion"] of [one of ].
AU-9(6)	The organization authorizes read-only access to audit information to [one of ].
AU-10(1)	The information system: (a): Binds the identity of the information producer with the information to [one of ]; and (b): Provides the means for authorized individuals to determine the identity of the producer of the information.
AU-10(2)	The information system: (a): Validates the binding of the information producer identity to the information at [one of ]; and (b): Performs [one of ] in the event of a validation error.
AU-10(3)	The information system maintains reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released.
AU-10(4)	The information system: (a): Validates the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer between [one of ]; and (b): Performs [one of ] in the event of a validation error.
AU-12	The information system: a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [one of ]; b: Allows [one of ] to select which auditable events are to be audited by specific components of the information system; and c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
AU-14	The information system provides the capability for authorized users to select a user session to capture/record or view/hear.
AU-16	The organization employs [one of ] for coordinating [one of ] among external organizations when audit information is transmitted across organizational boundaries.
AU-16(1)	The organization requires that the identity of individuals be preserved in cross-organizational audit trails.
AU-16(2)	The organization provides cross-organizational audit information to [one of ] based on [one of ].
CA-2(3)	The organization accepts the results of an assessment of [one of ] performed by [one of ] when the assessment meets [one of ].
CA-3(2)	The organization prohibits the direct connection of a classified, national security system to an external network without the use of [one of ].
CA-8(1)	The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.
CM-2(6)	The organization maintains a baseline configuration for information system development and test environments that is managed separately from the operational baseline configuration.
CM-4(2)	The organization, after the information system is changed, checks the security functions to verify that the functions are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security requirements for the system.
CM-5(4)	The organization enforces dual authorization for implementing changes to [one of ].
CM-5(5)	The organization: (a): Limits privileges to change information system components and system-related information within a production or operational environment; and (b): Reviews and reevaluates privileges [one of ].
CP-10(6)	The organization protects backup and restoration hardware, firmware, and software.
IA-2	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
IA-2(1)	The information system implements multifactor authentication for network access to privileged accounts.
IA-2(2)	The information system implements multifactor authentication for network access to non-privileged accounts.
IA-5(5)	The organization requires developers/installers of information system components to provide unique authenticators or change default authenticators prior to delivery/installation.
MP-2	The organization restricts access to [one of ] to [one of ].
PL-7	The organization: a: Develops a security Concept of Operations (CONOPS) for the information system containing at a minimum, how the organization intends to operate the system from the perspective of information security; and b: Reviews and updates the CONOPS [one of ].
RA-5(3)	The organization employs vulnerability scanning procedures that can identify the breadth and depth of coverage (i.e., information system components scanned and vulnerabilities checked).
RA-6	The organization employs a technical surveillance countermeasures survey at [one of ] [one or more of " {{ insert: param, ra-6_prm_3 }} "/" {{ insert: param, ra-6_prm_4 }} "].
SA-10(6)	The organization requires the developer of the information system, system component, or information system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.
SA-11(1)	The organization requires the developer of the information system, system component, or information system service to employ static code analysis tools to identify common flaws and document the results of the analysis.
SA-11(2)	The organization requires the developer of the information system, system component, or information system service to perform threat and vulnerability analyses and subsequent testing/evaluation of the as-built system, component, or service.
SA-11(3)	The organization: (a): Requires an independent agent satisfying [one of ] to verify the correct implementation of the developer security assessment plan and the evidence produced during security testing/evaluation; and (b): Ensures that the independent agent is either provided with sufficient information to complete the verification process or granted the authority to obtain such information.
SA-11(6)	The organization requires the developer of the information system, system component, or information system service to perform attack surface reviews.
SA-11(7)	The organization requires the developer of the information system, system component, or information system service to verify that the scope of security testing/evaluation provides complete coverage of required security controls at [one of ].
SA-13	The organization: a: Describes the trustworthiness required in the [one of ] supporting its critical missions/business functions; and b: Implements [one of ] to achieve such trustworthiness.
SA-15(5)	The organization requires the developer of the information system, system component, or information system service to reduce attack surfaces to [one of ].
SA-15(8)	The organization requires the developer of the information system, system component, or information system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.
SA-15(11)	The organization requires the developer of the information system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review.
SA-17(2)	The organization requires the developer of the information system, system component, or information system service to: (a): Define security-relevant hardware, software, and firmware; and (b): Provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.
SA-17(5)	The organization requires the developer of the information system, system component, or information system service to: (a): Design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics; and (b): Internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.
SA-17(6)	The organization requires the developer of the information system, system component, or information system service to structure security-relevant hardware, software, and firmware to facilitate testing.
SA-17(7)	The organization requires the developer of the information system, system component, or information system service to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.
SA-18	The organization implements a tamper protection program for the information system, system component, or information system service.
SA-19(2)	The organization maintains configuration control over [one of ] awaiting service/repair and serviced/repaired components awaiting return to service.
SA-19(3)	The organization disposes of information system components using [one of ].
SA-21	The organization requires that the developer of [one of ]: a: Have appropriate access authorizations as determined by assigned [one of ]; and b: Satisfy [one of ].
SC-2(1)	The information system prevents the presentation of information system management-related functionality at an interface for non-privileged users.
SC-3(1)	The information system utilizes underlying hardware separation mechanisms to implement security function isolation.
SC-3(2)	The information system isolates security functions enforcing access and information flow control from nonsecurity functions and from other security functions.
SC-3(3)	The organization minimizes the number of nonsecurity functions included within the isolation boundary containing security functions.
SC-7(15)	The information system routes all networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.
SC-7(16)	The information system prevents discovery of specific system components composing a managed interface.
SC-7(17)	The information system enforces adherence to protocol formats.
SC-7(22)	The information system implements separate network addresses (i.e., different subnets) to connect to systems in different security domains.
SC-7(23)	The information system disables feedback to senders on protocol format validation failure.
SC-11	The information system establishes a trusted communications path between the user and the following security functions of the system: [one of ].
SC-16	The information system associates [one of ] with information exchanged between information systems and between system components.
SC-16(1)	The information system validates the integrity of transmitted security attributes.
SC-31	The organization: a: Performs a covert channel analysis to identify those aspects of communications within the information system that are potential avenues for covert [one or more of "storage"/"timing"] channels; and b: Estimates the maximum bandwidth of those channels.
SC-31(1)	The organization tests a subset of the identified covert channels to determine which channels are exploitable.
SC-32	The organization partitions the information system into [one of ] residing in separate physical domains or environments based on [one of ].
SC-41	The organization physically disables or removes [one of ] on [one of ].
SI-3(4)	The information system updates malicious code protection mechanisms only when directed by a privileged user.
SI-4(7)	The information system notifies [one of ] of detected suspicious events and takes [one of ].
SI-4(9)	The organization tests intrusion-monitoring tools [one of ].
SI-4(13)	The organization: (a): Analyzes communications traffic/event patterns for the information system; (b): Develops profiles representing common traffic patterns and/or events; and (c): Uses the traffic/event profiles in tuning system-monitoring devices to reduce the number of false positives and the number of false negatives.
SI-4(14)	The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.
SI-4(24)	The information system discovers, collects, distributes, and uses indicators of compromise.
SI-7(6)	The information system implements cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
SI-7(9)	The information system verifies the integrity of the boot process of [one of ].
SI-7(10)	The information system implements [one of ] to protect the integrity of boot firmware in [one of ].

Removals

This overlay removes the following controls.

Control	Description
AC-16(6)	The organization allows personnel to associate, and maintain the association of [one of ] with [one of ] in accordance with [one of ].
AC-22	The organization: a: Designates individuals authorized to post information onto a publicly accessible information system; b: Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c: Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and d: Reviews the content on the publicly accessible information system for nonpublic information [one of ] and removes such information, if discovered.
IA-8(2)	The information system accepts only FICAM-approved third-party credentials.
IA-8(3)	The organization employs only FICAM-approved information system components in [one of ] to accept third-party credentials.
SA-9	The organization: a: Requires that providers of external information system services comply with organizational information security requirements and employ [one of ] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance; b: Defines and documents government oversight and user roles and responsibilities with regard to external information system services; and c: Employs [one of ] to monitor security control compliance by external service providers on an ongoing basis.
SA-9(1)	The organization: (a): Conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services; and (b): Ensures that the acquisition or outsourcing of dedicated information security services is approved by [one of ].
SA-9(2)	The organization requires providers of [one of ] to identify the functions, ports, protocols, and other services required for the use of such services.
SC-20	The information system: a: Provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and b: Provides the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.
SC-21	The information system requests and performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
SC-22	The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation.
SI-3(2)	The information system automatically updates malicious code protection mechanisms.