An error occurred:

Overlay Int-B

Additions

This overlay adds the following controls.
Control Description
AC-3(2) The information system enforces dual authorization for [one of ].
AC-3(4) The information system enforces [one of ] over defined subjects and objects where the policy specifies that a subject that has been granted access to information can do one or more of the following:
  • (a): Pass the information to any other subjects or objects;
  • (b): Grant its privileges to other subjects;
  • (c): Change security attributes on subjects, objects, the information system, or the information system’s components;
  • (d): Choose the security attributes to be associated with newly created or revised objects; or
  • (e): Change the rules governing access control.
AC-5 The organization:
  • a: Separates [one of ];
  • b: Documents separation of duties of individuals; and
  • c: Defines information system access authorizations to support separation of duties.
AC-6 The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
AC-6(7) The organization:
  • (a): Reviews [one of ] the privileges assigned to [one of ] to validate the need for such privileges; and
  • (b): Reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.
AC-7(2) The information system purges/wipes information from [one of ] based on [one of ] after [one of ] consecutive, unsuccessful device logon attempts.
AC-9 The information system notifies the user, upon successful logon (access) to the system, of the date and time of the last logon (access).
AC-9(1) The information system notifies the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.
AC-10 The information system limits the number of concurrent sessions for each [one of ] to [one of ].
AC-11 The information system:
  • a: Prevents further access to the system by initiating a session lock after [one of ] of inactivity or upon receiving a request from a user; and
  • b: Retains the session lock until the user reestablishes access using established identification and authentication procedures.
AC-11(1) The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.
AC-12 The information system automatically terminates a user session after [one of ].
AC-16 The organization:
  • a: Provides the means to associate [one of ] having [one of ] with information in storage, in process, and/or in transmission;
  • b: Ensures that the security attribute associations are made and retained with the information;
  • c: Establishes the permitted [one of ] for [one of ]; and
  • d: Determines the permitted [one of ] for each of the established security attributes.
AC-16(5) The information system displays security attributes in human-readable form on each object that the system transmits to output devices to identify [one of ] using [one of ].
AC-16(6) The organization allows personnel to associate, and maintain the association of [one of ] with [one of ] in accordance with [one of ].
AC-16(7) The organization provides a consistent interpretation of security attributes transmitted between distributed information system components.
AC-18 The organization:
  • a: Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and
  • b: Authorizes wireless access to the information system prior to allowing such connections.
AC-18(3) The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.
AC-18(4) The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.
AC-19 The organization:
  • a: Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and
  • b: Authorizes the connection of mobile devices to organizational information systems.
AC-20 The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to:
  • a: Access the information system from external information systems; and
  • b: Process, store, or transmit organization-controlled information using external information systems.
AC-20(1) The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:
  • (a): Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or
  • (b): Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.
AC-20(2) The organization [one of "restricts"/"prohibits"] the use of organization-controlled portable storage devices by authorized individuals on external information systems.
AC-20(3) The organization [one of "restricts"/"prohibits"] the use of non-organizationally owned information systems, system components, or devices to process, store, or transmit organizational information.
AC-20(4) The organization prohibits the use of [one of ] in external information systems.
AT-2 The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):
  • a: As part of initial training for new users;
  • b: When required by information system changes; and
  • c: [one of ] thereafter.
AT-2(2) The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.
AU-5(2) The information system provides an alert in [one of ] to [one of ] when the following audit failure events occur: [one of ].
AU-6 The organization:
  • a: Reviews and analyzes information system audit records [one of ] for indications of [one of ]; and
  • b: Reports findings to [one of ].
AU-6(4) The information system provides the capability to centrally review and analyze audit records from multiple components within the system.
AU-6(5) The organization integrates analysis of audit records with analysis of [one or more of "vulnerability scanning information"/"performance data"/"information system monitoring information"/" {{ insert: param, au-6.5_prm_2 }} "] to further enhance the ability to identify inappropriate or unusual activity.
AU-6(6) The organization correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
AU-6(7) The organization specifies the permitted actions for each [one or more of "information system process"/"role"/"user"] associated with the review, analysis, and reporting of audit information.
AU-6(8) The organization performs a full text analysis of audited privileged commands in a physically distinct component or subsystem of the information system, or other information system that is dedicated to that analysis.
AU-6(9) The organization correlates information from nontechnical sources with audit information to enhance organization-wide situational awareness.
AU-7 The information system provides an audit reduction and report generation capability that:
  • a: Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and
  • b: Does not alter the original content or time ordering of audit records.
AU-7(1) The information system provides the capability to process audit records for events of interest based on [one of ].
AU-7(2) The information system provides the capability to sort and search audit records for events of interest based on the content of [one of ].
AU-9(6) The organization authorizes read-only access to audit information to [one of ].
AU-10 The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed [one of ].
AU-12 The information system:
  • a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [one of ];
  • b: Allows [one of ] to select which auditable events are to be audited by specific components of the information system; and
  • c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
AU-14 The information system provides the capability for authorized users to select a user session to capture/record or view/hear.
AU-16 The organization employs [one of ] for coordinating [one of ] among external organizations when audit information is transmitted across organizational boundaries.
AU-16(1) The organization requires that the identity of individuals be preserved in cross-organizational audit trails.
AU-16(2) The organization provides cross-organizational audit information to [one of ] based on [one of ].
CA-3 The organization:
  • a: Authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements;
  • b: Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and
  • c: Reviews and updates Interconnection Security Agreements [one of ].
CA-3(2) The organization prohibits the direct connection of a classified, national security system to an external network without the use of [one of ].
CM-3(6) The organization ensures that cryptographic mechanisms used to provide [one of ] are under configuration management.
CM-5(5) The organization:
  • (a): Limits privileges to change information system components and system-related information within a production or operational environment; and
  • (b): Reviews and reevaluates privileges [one of ].
IA-2 The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
IA-2(1) The information system implements multifactor authentication for network access to privileged accounts.
IA-2(2) The information system implements multifactor authentication for network access to non-privileged accounts.
IA-5(2) The information system, for PKI-based authentication:
  • (a): Validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information;
  • (b): Enforces authorized access to the corresponding private key;
  • (c): Maps the authenticated identity to the account of the individual or group; and
  • (d): Implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.
IR-4(1) The organization employs automated mechanisms to support the incident handling process.
IR-4(3) The organization identifies [one of ] and [one of ] to ensure continuation of organizational missions and business functions.
IR-4(10) The organization coordinates incident handling activities involving supply chain events with other organizations involved in the supply chain.
IR-5(1) The organization employs automated mechanisms to assist in the tracking of security incidents and in the collection and analysis of incident information.
IR-9 The organization responds to information spills by:
  • a: Identifying the specific information involved in the information system contamination;
  • b: Alerting [one of ] of the information spill using a method of communication not associated with the spill;
  • c: Isolating the contaminated information system or system component;
  • d: Eradicating the information from the contaminated information system or component;
  • e: Identifying other information systems or system components that may have been subsequently contaminated; and
  • f: Performing other [one of ].
IR-9(1) The organization assigns [one of ] with responsibility for responding to information spills.
IR-9(2) The organization provides information spillage response training [one of ].
IR-9(4) The organization employs [one of ] for personnel exposed to information not within assigned access authorizations.
MA-3(3) The organization prevents the unauthorized removal of maintenance equipment containing organizational information by:
  • (a): Verifying that there is no organizational information contained on the equipment;
  • (b): Sanitizing or destroying the equipment;
  • (c): Retaining the equipment within the facility; or
  • (d): Obtaining an exemption from [one of ] explicitly authorizing removal of the equipment from the facility.
MA-3(4) The information system restricts the use of maintenance tools to authorized personnel only.
MA-4(1) The organization:
  • (a): Audits nonlocal maintenance and diagnostic sessions [one of ]; and
  • (b): Reviews the records of the maintenance and diagnostic sessions.
MA-4(2) The organization documents in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.
MA-4(4) The organization protects nonlocal maintenance sessions by:
  • (a): Employing [one of ]; and
  • (b): Separating the maintenance sessions from other network sessions with the information system by either:
    • (1): Physically separated communications paths; or
    • (2): Logically separated communications paths based upon encryption.
MA-4(5) The organization:
  • (a): Requires the approval of each nonlocal maintenance session by [one of ]; and
  • (b): Notifies [one of ] of the date and time of planned nonlocal maintenance.
MA-5(2) The organization ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.
MA-5(4) The organization ensures that:
  • (a): Cleared foreign nationals (i.e., foreign nationals with appropriate security clearances), are used to conduct maintenance and diagnostic activities on classified information systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments; and
  • (b): Approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified information systems are fully documented within Memoranda of Agreements.
MA-5(5) The organization ensures that non-escorted personnel performing maintenance activities not directly associated with the information system but in the physical proximity of the system, have required access authorizations.
MP-1 The organization:
  • a: Develops, documents, and disseminates to [one of ]:
    • 1: A media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    • 2: Procedures to facilitate the implementation of the media protection policy and associated media protection controls; and
  • b: Reviews and updates the current:
    • 1: Media protection policy [one of ]; and
    • 2: Media protection procedures [one of ].
MP-2 The organization restricts access to [one of ] to [one of ].
MP-3 The organization:
  • a: Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
  • b: Exempts [one of ] from marking as long as the media remain within [one of ].
MP-4 The organization:
  • a: Physically controls and securely stores [one of ] within [one of ]; and
  • b: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-5 The organization:
  • a: Protects and controls [one of ] during transport outside of controlled areas using [one of ];
  • b: Maintains accountability for information system media during transport outside of controlled areas;
  • c: Documents activities associated with the transport of information system media; and
  • d: Restricts the activities associated with the transport of information system media to authorized personnel.
MP-5(3) The organization employs an identified custodian during transport of information system media outside of controlled areas.
MP-5(4) The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.
MP-6 The organization:
  • a: Sanitizes [one of ] prior to disposal, release out of organizational control, or release for reuse using [one of ] in accordance with applicable federal and organizational standards and policies; and
  • b: Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
MP-6(1) The organization reviews, approves, tracks, documents, and verifies media sanitization and disposal actions.
MP-6(2) The organization tests sanitization equipment and procedures [one of ] to verify that the intended sanitization is being achieved.
MP-6(3) The organization applies nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the information system under the following circumstances: [one of ].
MP-7 The organization [one of "restricts"/"prohibits"] the use of [one of ] on [one of ] using [one of ].
MP-8 The organization:
  • a: Establishes [one of ] that includes employing downgrading mechanisms with [one of ];
  • b: Ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;
  • c: Identifies [one of ]; and
  • d: Downgrades the identified information system media using the established process.
MP-8(1) The organization documents information system media downgrading actions.
MP-8(2) The organization employs [one of ] of downgrading equipment and procedures to verify correct performance [one of ].
MP-8(4) The organization downgrades information system media containing classified information prior to release to individuals without required access authorizations in accordance with NSA standards and policies.
PE-2(3) The organization restricts unescorted access to the facility where the information system resides to personnel with [one or more of "security clearances for all information contained within the system"/"formal access authorizations for all information contained within the system"/"need for access to all information contained within the system"/" {{ insert: param, pe-2.3_prm_2 }} "].
PE-3(1) The organization enforces physical access authorizations to the information system in addition to the physical access controls for the facility at [one of ].
PE-3(2) The organization performs security checks [one of ] at the physical boundary of the facility or information system for unauthorized exfiltration of information or removal of information system components.
PE-3(3) The organization employs guards and/or alarms to monitor every physical access point to the facility where the information system resides 24 hours per day, 7 days per week.
PE-4 The organization controls physical access to [one of ] within organizational facilities using [one of ].
PE-5 The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.
PE-5(3) The organization marks [one of ] indicating the appropriate security marking of the information permitted to be output from the device.
PE-6(1) The organization monitors physical intrusion alarms and surveillance equipment.
PE-6(2) The organization employs automated mechanisms to recognize [one of ] and initiate [one of ].
PE-6(3) The organization employs video surveillance of [one of ] and retains video recordings for [one of ].
PE-6(4) The organization monitors physical access to the information system in addition to the physical access monitoring of the facility as [one of ].
PE-19 The organization protects the information system from information leakage due to electromagnetic signals emanations.
PE-19(1) The organization ensures that information system components, associated data communications, and networks are protected in accordance with national emissions and TEMPEST policies and procedures based on the security category or classification of the information.
PS-3(1) The organization ensures that individuals accessing an information system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.
PS-3(2) The organization ensures that individuals accessing an information system processing, storing, or transmitting types of classified information which require formal indoctrination, are formally indoctrinated for all of the relevant types of information to which they have access on the system.
PS-4 The organization, upon termination of individual employment:
  • a: Disables information system access within [one of ];
  • b: Terminates/revokes any authenticators/credentials associated with the individual;
  • c: Conducts exit interviews that include a discussion of [one of ];
  • d: Retrieves all security-related organizational information system-related property;
  • e: Retains access to organizational information and information systems formerly controlled by terminated individual; and
  • f: Notifies [one of ] within [one of ].
PS-4(1) The organization:
  • (a): Notifies terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information; and
  • (b): Requires terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.
PS-6(2) The organization ensures that access to classified information requiring special protection is granted only to individuals who:
  • (a): Have a valid access authorization that is demonstrated by assigned official government duties;
  • (b): Satisfy associated personnel security criteria; and
  • (c): Have read, understood, and signed a nondisclosure agreement.
PS-6(3) The organization:
  • (a): Notifies individuals of applicable, legally binding post-employment requirements for protection of organizational information; and
  • (b): Requires individuals to sign an acknowledgment of these requirements, if applicable, as part of granting initial access to covered information.
RA-5(3) The organization employs vulnerability scanning procedures that can identify the breadth and depth of coverage (i.e., information system components scanned and vulnerabilities checked).
RA-6 The organization employs a technical surveillance countermeasures survey at [one of ] [one or more of " {{ insert: param, ra-6_prm_3 }} "/" {{ insert: param, ra-6_prm_4 }} "].
SA-4(2) The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [one or more of "security-relevant external system interfaces"/"high-level design"/"low-level design"/"source code or hardware schematics"/" {{ insert: param, sa-4.2_prm_2 }} "] at [one of ].
SA-4(6) The organization:
  • (a): Employs only government off-the-shelf (GOTS) or commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted; and
  • (b): Ensures that these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.
SA-11(3) The organization:
  • (a): Requires an independent agent satisfying [one of ] to verify the correct implementation of the developer security assessment plan and the evidence produced during security testing/evaluation; and
  • (b): Ensures that the independent agent is either provided with sufficient information to complete the verification process or granted the authority to obtain such information.
SA-12(9) The organization employs [one of ] in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.
SA-15(9) The organization approves, documents, and controls the use of live data in development and test environments for the information system, system component, or information system service.
SC-2 The information system separates user functionality (including user interface services) from information system management functionality.
SC-2(1) The information system prevents the presentation of information system management-related functionality at an interface for non-privileged users.
SC-3 The information system isolates security functions from nonsecurity functions.
SC-4 The information system prevents unauthorized and unintended information transfer via shared system resources.
SC-8 The information system protects the [one or more of "confidentiality"/"integrity"] of transmitted information.
SC-8(1) The information system implements cryptographic mechanisms to [one or more of "prevent unauthorized disclosure of information"/"detect changes to information"] during transmission unless otherwise protected by [one of ].
SC-8(2) The information system maintains the [one or more of "confidentiality"/"integrity"] of information during preparation for transmission and during reception.
SC-8(3) The information system implements cryptographic mechanisms to protect message externals unless otherwise protected by [one of ].
SC-8(4) The information system implements cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [one of ].
SC-10 The information system terminates the network connection associated with a communications session at the end of the session or after [one of ] of inactivity.
SC-12(2) The organization produces, controls, and distributes symmetric cryptographic keys using [one of "NIST FIPS-compliant"/"NSA-approved"] key management technology and processes.
SC-12(3) The organization produces, controls, and distributes asymmetric cryptographic keys using [one of "NSA-approved key management technology and processes"/"approved PKI Class 3 certificates or prepositioned keying material"/"approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user’s private key"].
SC-13 The information system implements [one of ] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
SC-15(1) The information system provides physical disconnect of collaborative computing devices in a manner that supports ease of use.
SC-15(3) The organization disables or removes collaborative computing devices from [one of ] in [one of ].
SC-15(4) The information system provides an explicit indication of current participants in [one of ].
SC-28 The information system protects the [one or more of "confidentiality"/"integrity"] of [one of ].
SC-28(1) The information system implements cryptographic mechanisms to prevent unauthorized disclosure and modification of [one of ] on [one of ].
SC-42 The information system:
  • a: Prohibits the remote activation of environmental sensing capabilities with the following exceptions: [one of ]; and
  • b: Provides an explicit indication of sensor use to [one of ].
SC-42(3) The organization prohibits the use of devices possessing [one of ] in [one of ].
SI-3(4) The information system updates malicious code protection mechanisms only when directed by a privileged user.
SI-4(2) The organization employs automated tools to support near real-time analysis of events.
SI-4(14) The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.
SI-4(19) The organization implements [one of ] of individuals who have been identified by [one of ] as posing an increased level of risk.
SI-4(21) The organization implements [one of ] of individuals during [one of ].
SI-7 The organization employs integrity verification tools to detect unauthorized changes to [one of ].
SI-7(1) The information system performs an integrity check of [one of ] [one or more of "at startup"/"at {{ insert: param, si-7.1_prm_3 }} "/" {{ insert: param, si-7.1_prm_4 }} "].
SI-7(2) The organization employs automated tools that provide notification to [one of ] upon discovering discrepancies during integrity verification.
SI-10(3) The information system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.
SI-14(1) The organization ensures that software and data employed during information system component and service refreshes are obtained from [one of ].