Navigate

Overlay Privacy (Mod)

Additions

This overlay adds the following controls.

Control	Description
AC-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the access control policy and associated access controls; and b: Reviews and updates the current: 1: Access control policy [one of ]; and 2: Access control procedures [one of ].
AC-2	The organization: a: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [one of ]; b: Assigns account managers for information system accounts; c: Establishes conditions for group and role membership; d: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; e: Requires approvals by [one of ] for requests to create information system accounts; f: Creates, enables, modifies, disables, and removes information system accounts in accordance with [one of ]; g: Monitors the use of information system accounts; h: Notifies account managers: 1: When accounts are no longer required; 2: When users are terminated or transferred; and 3: When individual information system usage or need-to-know changes; i: Authorizes access to the information system based on: 1: A valid access authorization; 2: Intended system usage; and 3: Other attributes as required by the organization or associated missions/business functions; j: Reviews accounts for compliance with account management requirements [one of ]; and k: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
AC-2(13)	The organization disables accounts of users posing a significant risk within [one of ] of discovery of the risk.
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-3(9)	The information system does not release information outside of the established system boundary unless: (a): The receiving [one of ] provides [one of ]; and (b): [one of ] are used to validate the appropriateness of the information designated for release.
AC-4	The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [one of ].
AC-4(15)	The information system, when transferring information between different security domains, examines the information for the presence of [one of ] and prohibits the transfer of such information in accordance with the [one of ].
AC-4(17)	The information system uniquely identifies and authenticates source and destination points by [one or more of "organization, system, application, individual"] for information transfer.
AC-4(18)	The information system binds security attributes to information using [one of ] to facilitate information flow policy enforcement.
AC-5	The organization: a: Separates [one of ]; b: Documents separation of duties of individuals; and c: Defines information system access authorizations to support separation of duties.
AC-6	The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
AC-6(2)	The organization requires that users of information system accounts, or roles, with access to [one of ], use non-privileged accounts or roles, when accessing nonsecurity functions.
AC-6(7)	The organization: (a): Reviews [one of ] the privileges assigned to [one of ] to validate the need for such privileges; and (b): Reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.
AC-6(9)	The information system audits the execution of privileged functions.
AC-6(10)	The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
AC-11	The information system: a: Prevents further access to the system by initiating a session lock after [one of ] of inactivity or upon receiving a request from a user; and b: Retains the session lock until the user reestablishes access using established identification and authentication procedures.
AC-16	The organization: a: Provides the means to associate [one of ] having [one of ] with information in storage, in process, and/or in transmission; b: Ensures that the security attribute associations are made and retained with the information; c: Establishes the permitted [one of ] for [one of ]; and d: Determines the permitted [one of ] for each of the established security attributes.
AC-16(3)	The information system maintains the association and integrity of [one of ] to [one of ].
AC-17	The organization: a: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b: Authorizes remote access to the information system prior to allowing such connections.
AC-17(1)	The information system monitors and controls remote access methods.
AC-17(2)	The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
AC-18(1)	The information system protects wireless access to the system using authentication of [one or more of "users"/"devices"] and encryption.
AC-19	The organization: a: Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and b: Authorizes the connection of mobile devices to organizational information systems.
AC-19(5)	The organization employs [one of "full-device encryption"/"container encryption"] to protect the confidentiality and integrity of information on [one of ].
AC-20	The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to: a: Access the information system from external information systems; and b: Process, store, or transmit organization-controlled information using external information systems.
AC-20(1)	The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization: (a): Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or (b): Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.
AC-20(3)	The organization [one of "restricts"/"prohibits"] the use of non-organizationally owned information systems, system components, or devices to process, store, or transmit organizational information.
AC-21	The organization: a: Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for [one of ]; and b: Employs [one of ] to assist users in making information sharing/collaboration decisions.
AC-22	The organization: a: Designates individuals authorized to post information onto a publicly accessible information system; b: Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c: Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and d: Reviews the content on the publicly accessible information system for nonpublic information [one of ] and removes such information, if discovered.
AP-1	The organization determines and documents the legal authority that permits the collection, use, maintenance, and sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need.
AP-2	The organization describes the purpose(s) for which personally identifiable information (PII) is collected, used, maintained, and shared in its privacy notices.
AR-1	The organization: a. Appoints a Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) accountable for developing, implementing, and maintaining an organization-wide governance and privacy program to ensure compliance with all applicable laws and regulations regarding the collection, use, maintenance, sharing, and disposal of personally identifiable information (PII) by programs and information systems; b. Monitors federal privacy laws and policy for changes that affect the privacy program; c. Allocates [Assignment: organization-defined allocation of budget and staffing] sufficient resources to implement and operate the organization-wide privacy program; d. Develops a strategic organizational privacy plan for implementing applicable privacy controls, policies, and procedures; e. Develops, disseminates, and implements operational privacy policies and procedures that govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII; and f. Updates privacy plan, policies, and procedures [Assignment: organization-defined frequency, at least biennially].
AR-2	The organization: a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.
AR-3	The organization: a. Establishes privacy roles, responsibilities, and access requirements for contractors and service providers; and b. Includes privacy requirements in contracts and other acquisition-related documents
AR-4	The organization monitors and audits privacy controls and internal privacy policy [Assignment: organization-defined frequency] to ensure effective implementation
AR-5	The organization: a. Develops, implements, and updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures; b. Administers basic privacy training [Assignment: organization-defined frequency, at least annually] and targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII [Assignment: organization-defined frequency, at least annually]; and c. Ensures that personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements [Assignment: organization-defined frequency, at least annually].
AR-6	The organization develops, disseminates, and updates reports to the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates, and to senior management and other personnel with responsibility for monitoring privacy program progress and compliance.
AR-7	The organization designs information systems to support privacy by automating privacy controls.
AR-8	The organization: a. Keeps an accurate accounting of disclosures of information held in each system of records under its control, including: (1) Date, nature, and purpose of each disclosure of a record; and (2) Name and address of the person or agency to which the disclosure was made; b. Retains the accounting of disclosures for the life of the record or five years after the disclosure is made, whichever is longer; and c. Makes the accounting of disclosures available to the person named in the record upon request.
AT-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and b: Reviews and updates the current: 1: Security awareness and training policy [one of ]; and 2: Security awareness and training procedures [one of ].
AT-2	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): a: As part of initial training for new users; b: When required by information system changes; and c: [one of ] thereafter.
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: a: Before authorizing access to the information system or performing assigned duties; b: When required by information system changes; and c: [one of ] thereafter.
AT-4	The organization: a: Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and b: Retains individual training records for [one of ].
AU-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls; and b: Reviews and updates the current: 1: Audit and accountability policy [one of ]; and 2: Audit and accountability procedures [one of ].
AU-2	The organization: a: Determines that the information system is capable of auditing the following events: [one of ]; b: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; c: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and d: Determines that the following events are to be audited within the information system: [one of ].
AU-3	The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.
AU-4	The organization allocates audit record storage capacity in accordance with [one of ].
AU-6	The organization: a: Reviews and analyzes information system audit records [one of ] for indications of [one of ]; and b: Reports findings to [one of ].
AU-6(3)	The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
AU-6(10)	The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
AU-7	The information system provides an audit reduction and report generation capability that: a: Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and b: Does not alter the original content or time ordering of audit records.
AU-7(1)	The information system provides the capability to process audit records for events of interest based on [one of ].
AU-7(2)	The information system provides the capability to sort and search audit records for events of interest based on the content of [one of ].
AU-9	The information system protects audit information and audit tools from unauthorized access, modification, and deletion.
AU-9(3)	The information system implements cryptographic mechanisms to protect the integrity of audit information and audit tools.
AU-10	The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed [one of ].
AU-10(1)	The information system: (a): Binds the identity of the information producer with the information to [one of ]; and (b): Provides the means for authorized individuals to determine the identity of the producer of the information.
AU-12	The information system: a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [one of ]; b: Allows [one of ] to select which auditable events are to be audited by specific components of the information system; and c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
AU-12(3)	The information system provides the capability for [one of ] to change the auditing to be performed on [one of ] based on [one of ] within [one of ].
CA-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls; and b: Reviews and updates the current: 1: Security assessment and authorization policy [one of ]; and 2: Security assessment and authorization procedures [one of ].
CA-2	The organization: a: Develops a security assessment plan that describes the scope of the assessment including: 1: Security controls and control enhancements under assessment; 2: Assessment procedures to be used to determine security control effectiveness; and 3: Assessment environment, assessment team, and assessment roles and responsibilities; b: Assesses the security controls in the information system and its environment of operation [one of ] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; c: Produces a security assessment report that documents the results of the assessment; and d: Provides the results of the security control assessment to [one of ].
CA-3	The organization: a: Authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements; b: Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and c: Reviews and updates Interconnection Security Agreements [one of ].
CA-3(3)	The organization prohibits the direct connection of an [one of ] to an external network without the use of [one of ].
CA-3(5)	The organization employs [one of "allow-all, deny-by-exception"/"deny-all, permit-by-exception"] policy for allowing [one of ] to connect to external information systems.
CA-6	The organization: a: Assigns a senior-level executive or manager as the authorizing official for the information system; b: Ensures that the authorizing official authorizes the information system for processing before commencing operations; and c: Updates the security authorization [one of ].
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a: Establishment of [one of ] to be monitored; b: Establishment of [one of ] for monitoring and [one of ] for assessments supporting such monitoring; c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; e: Correlation and analysis of security-related information generated by assessments and monitoring; f: Response actions to address results of the analysis of security-related information; and g: Reporting the security status of organization and the information system to [one of ] [one of ].
CA-9	The organization: a: Authorizes internal connections of [one of ] to the information system; and b: Documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.
CA-9(1)	The information system performs security compliance checks on constituent system components prior to the establishment of the internal connection.
CM-3(6)	The organization ensures that cryptographic mechanisms used to provide [one of ] are under configuration management.
CM-4	The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
CM-4(1)	The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.
CM-4(2)	The organization, after the information system is changed, checks the security functions to verify that the functions are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security requirements for the system.
CP-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls; and b: Reviews and updates the current: 1: Contingency planning policy [one of ]; and 2: Contingency planning procedures [one of ].
CP-2	The organization: a: Develops a contingency plan for the information system that: 1: Identifies essential missions and business functions and associated contingency requirements; 2: Provides recovery objectives, restoration priorities, and metrics; 3: Addresses contingency roles, responsibilities, assigned individuals with contact information; 4: Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure; 5: Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and 6: Is reviewed and approved by [one of ]; b: Distributes copies of the contingency plan to [one of ]; c: Coordinates contingency planning activities with incident handling activities; d: Reviews the contingency plan for the information system [one of ]; e: Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f: Communicates contingency plan changes to [one of ]; and g: Protects the contingency plan from unauthorized disclosure and modification.
CP-9	The organization: a: Conducts backups of user-level information contained in the information system [one of ]; b: Conducts backups of system-level information contained in the information system [one of ]; c: Conducts backups of information system documentation including security-related documentation [one of ]; and d: Protects the confidentiality, integrity, and availability of backup information at storage locations.
CP-10	The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.
DI-1	The organization: a. Confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the accuracy, relevance, timeliness, and completeness of that information; b. Collects PII directly from the individual to the greatest extent practicable; c. Checks for, and corrects as necessary, any inaccurate or outdated PII used by its programs or systems [Assignment: organization-defined frequency]; and d. Issues guidelines ensuring and maximizing the quality, utility, objectivity, and integrity of disseminated information.
DI-1(1)	The organization requests that the individual or individual’s authorized representative validate PII during the collection process.
DI-1(2)	The organization requests that the individual or individual’s authorized representative revalidate that PII collected is still accurate [Assignment: organization-defined frequency].
DM-1	The organization: a. Identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection; b. Limits the collection and retention of PII to the minimum elements identified for the purposes described in the notice and for which the individual has provided consent; and c. Conducts an initial evaluation of PII holdings and establishes and follows a schedule for regularly reviewing those holdings [Assignment: organization-defined frequency, at least annually] to ensure that only PII identified in the notice is collected and retained, and that the PII continues to be necessary to accomplish the legally authorized purpose.
DM-2	The organization: a. Retains each collection of personally identifiable information (PII) for [Assignment: organization-defined time period] to fulfill the purpose(s) identified in the notice or as required by law; b. Disposes of, destroys, erases, and/or anonymizes the PII, regardless of the method of storage, in accordance with a NARA-approved record retention schedule and in a manner that prevents loss, theft, misuse, or unauthorized access; and c. Uses [Assignment: organization-defined techniques or methods] to ensure secure deletion or destruction of PII (including originals, copies, and archived records).
DM-3	The organization: a. Develops policies and procedures that minimize the use of personally identifiable information (PII) for testing, training, and research; and b. Implements controls to protect PII used for testing, training, and research.
IA-2	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
IA-2(6)	The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [one of ].
IA-2(7)	The information system implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [one of ].
IA-2(11)	The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [one of ].
IA-4	The organization manages information system identifiers by: a: Receiving authorization from [one of ] to assign an individual, group, role, or device identifier; b: Selecting an identifier that identifies an individual, group, role, or device; c: Assigning the identifier to the intended individual, group, role, or device; d: Preventing reuse of identifiers for [one of ]; and e: Disabling the identifier after [one of ].
IA-4(3)	The organization requires multiple forms of certification of individual identification be presented to the registration authority.
IA-5	The organization manages information system authenticators by: a: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator; b: Establishing initial authenticator content for authenticators defined by the organization; c: Ensuring that authenticators have sufficient strength of mechanism for their intended use; d: Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators; e: Changing default content of authenticators prior to information system installation; f: Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators; g: Changing/refreshing authenticators [one of ]; h: Protecting authenticator content from unauthorized disclosure and modification; i: Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and j: Changing authenticators for group/role accounts when membership to those accounts changes.
IA-7	The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
IA-8	The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).
IP-1	The organization: a. Provides means, where feasible and appropriate, for individuals to authorize the collection, use, maintaining, and sharing of personally identifiable information (PII) prior to its collection; b. Provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection, use, dissemination, and retention of PII; c. Obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected PII; and d. Ensures that individuals are aware of and, where feasible, consent to all uses of PII not initially described in the public notice that was in effect at the time the organization collected the PII.
IP-2	The organization: a. Provides individuals the ability to have access to their personally identifiable information (PII) maintained in its system(s) of records; b. Publishes rules and regulations governing how individuals may request access to records maintained in a Privacy Act system of records; c. Publishes access procedures in System of Records Notices (SORNs); and d. Adheres to Privacy Act requirements and OMB policies and guidance for the proper processing of Privacy Act requests.
IP-3	The organization: a. Provides a process for individuals to have inaccurate personally identifiable information (PII) maintained by the organization corrected or amended, as appropriate; and b. Establishes a process for disseminating corrections or amendments of the PII to other authorized users of the PII, such as external information-sharing partners and, where feasible and appropriate, notifies affected individuals that their information has been corrected or amended
IP-4	The organization implements a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational privacy practices.
IR-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: An incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the incident response policy and associated incident response controls; and b: Reviews and updates the current: 1: Incident response policy [one of ]; and 2: Incident response procedures [one of ].
IR-2	The organization provides incident response training to information system users consistent with assigned roles and responsibilities: a: Within [one of ] of assuming an incident response role or responsibility; b: When required by information system changes; and c: [one of ] thereafter.
IR-4	The organization: a: Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery; b: Coordinates incident handling activities with contingency planning activities; and c: Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.
IR-5	The organization tracks and documents information system security incidents.
IR-6	The organization: a: Requires personnel to report suspected security incidents to the organizational incident response capability within [one of ]; and b: Reports security incident information to [one of ].
IR-7	The organization provides an incident response support resource, integral to the organizational incident response capability that offers advice and assistance to users of the information system for the handling and reporting of security incidents.
IR-8	The organization: a: Develops an incident response plan that: 1: Provides the organization with a roadmap for implementing its incident response capability; 2: Describes the structure and organization of the incident response capability; 3: Provides a high-level approach for how the incident response capability fits into the overall organization; 4: Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; 5: Defines reportable incidents; 6: Provides metrics for measuring the incident response capability within the organization; 7: Defines the resources and management support needed to effectively maintain and mature an incident response capability; and 8: Is reviewed and approved by [one of ]; b: Distributes copies of the incident response plan to [one of ]; c: Reviews the incident response plan [one of ]; d: Updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing; e: Communicates incident response plan changes to [one of ]; and f: Protects the incident response plan from unauthorized disclosure and modification.
IR-10	The organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.
MA-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls; and b: Reviews and updates the current: 1: System maintenance policy [one of ]; and 2: System maintenance procedures [one of ].
MA-4(6)	The information system implements cryptographic mechanisms to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications.
MA-5	The organization: a: Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel; b: Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and c: Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
MP-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the media protection policy and associated media protection controls; and b: Reviews and updates the current: 1: Media protection policy [one of ]; and 2: Media protection procedures [one of ].
MP-2	The organization restricts access to [one of ] to [one of ].
MP-3	The organization: a: Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and b: Exempts [one of ] from marking as long as the media remain within [one of ].
MP-4	The organization: a: Physically controls and securely stores [one of ] within [one of ]; and b: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-5	The organization: a: Protects and controls [one of ] during transport outside of controlled areas using [one of ]; b: Maintains accountability for information system media during transport outside of controlled areas; c: Documents activities associated with the transport of information system media; and d: Restricts the activities associated with the transport of information system media to authorized personnel.
MP-5(4)	The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.
MP-6	The organization: a: Sanitizes [one of ] prior to disposal, release out of organizational control, or release for reuse using [one of ] in accordance with applicable federal and organizational standards and policies; and b: Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
MP-6(1)	The organization reviews, approves, tracks, documents, and verifies media sanitization and disposal actions.
MP-6(8)	The organization provides the capability to purge/wipe information from [one of ] either remotely or under the following conditions: [one of ].
MP-7	The organization [one of "restricts"/"prohibits"] the use of [one of ] on [one of ] using [one of ].
MP-7(1)	The organization prohibits the use of portable storage devices in organizational information systems when such devices have no identifiable owner.
MP-8(3)	The organization downgrades information system media containing [one of ] prior to public release in accordance with applicable federal and organizational standards and policies.
PE-2	The organization: a: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; b: Issues authorization credentials for facility access; c: Reviews the access list detailing authorized facility access by individuals [one of ]; and d: Removes individuals from the facility access list when access is no longer required.
PE-3	The organization: a: Enforces physical access authorizations at [one of ] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of " {{ insert: param, pe-3_prm_3 }} "/"guards"]; b: Maintains physical access audit logs for [one of ]; c: Provides [one of ] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [one of ]; e: Secures keys, combinations, and other physical access devices; f: Inventories [one of ] every [one of ]; and g: Changes combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-5	The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.
PE-17	The organization: a: Employs [one of ] at alternate work sites; b: Assesses as feasible, the effectiveness of security controls at alternate work sites; and c: Provides a means for employees to communicate with information security personnel in case of security incidents or problems.
PL-2	The organization: a: Develops a security plan for the information system that: 1: Is consistent with the organization’s enterprise architecture; 2: Explicitly defines the authorization boundary for the system; 3: Describes the operational context of the information system in terms of missions and business processes; 4: Provides the security categorization of the information system including supporting rationale; 5: Describes the operational environment for the information system and relationships with or connections to other information systems; 6: Provides an overview of the security requirements for the system; 7: Identifies any relevant overlays, if applicable; 8: Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and 9: Is reviewed and approved by the authorizing official or designated representative prior to plan implementation; b: Distributes copies of the security plan and communicates subsequent changes to the plan to [one of ]; c: Reviews the security plan for the information system [one of ]; d: Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and e: Protects the security plan from unauthorized disclosure and modification.
PL-4	The organization: a: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; b: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system; c: Reviews and updates the rules of behavior [one of ]; and d: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.
PL-8	The organization: a: Develops an information security architecture for the information system that: 1: Describes the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information; 2: Describes how the information security architecture is integrated into and supports the enterprise architecture; and 3: Describes any information security assumptions about, and dependencies on, external services; b: Reviews and updates the information security architecture [one of ] to reflect updates in the enterprise architecture; and c: Ensures that planned information security architecture changes are reflected in the security plan, the security Concept of Operations (CONOPS), and organizational procurements/acquisitions.
PM-1	The organization: a: Develops and disseminates an organization-wide information security program plan that: 1: Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements; 2: Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance; 3: Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and 4: Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; b: Reviews the organization-wide information security program plan [one of ]; c: Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and d: Protects the information security program plan from unauthorized disclosure and modification.
PM-3	The organization: a: Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement; b: Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and c: Ensures that information security resources are available for expenditure as planned.
PM-5	The organization develops and maintains an inventory of its information systems.
PM-7	The organization develops an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
PM-9	The organization: a: Develops a comprehensive strategy to manage risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems; b: Implements the risk management strategy consistently across the organization; and c: Reviews and updates the risk management strategy [one of ] or as required, to address organizational changes.
PM-10	The organization: a: Manages (i.e., documents, tracks, and reports) the security state of organizational information systems and the environments in which those systems operate through security authorization processes; b: Designates individuals to fulfill specific roles and responsibilities within the organizational risk management process; and c: Fully integrates the security authorization processes into an organization-wide risk management program.
PM-11	The organization: a: Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and b: Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained.
PM-12	The organization implements an insider threat program that includes a cross-discipline insider threat incident handling team.
PM-14	The organization: a: Implements a process for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational information systems: 1: Are developed and maintained; and 2: Continue to be executed in a timely manner; b: Reviews testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
PM-15	The organization establishes and institutionalizes contact with selected groups and associations within the security community: a: To facilitate ongoing security education and training for organizational personnel; b: To maintain currency with recommended security practices, techniques, and technologies; and c: To share current security-related information including threats, vulnerabilities, and incidents.
PS-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the personnel security policy and associated personnel security controls; and b: Reviews and updates the current: 1: Personnel security policy [one of ]; and 2: Personnel security procedures [one of ].
PS-2	The organization: a: Assigns a risk designation to all organizational positions; b: Establishes screening criteria for individuals filling those positions; and c: Reviews and updates position risk designations [one of ].
PS-3	The organization: a: Screens individuals prior to authorizing access to the information system; and b: Rescreens individuals according to [one of ].
PS-3(3)	The organization ensures that individuals accessing an information system processing, storing, or transmitting information requiring special protection: (a): Have valid access authorizations that are demonstrated by assigned official government duties; and (b): Satisfy [one of ].
PS-4	The organization, upon termination of individual employment: a: Disables information system access within [one of ]; b: Terminates/revokes any authenticators/credentials associated with the individual; c: Conducts exit interviews that include a discussion of [one of ]; d: Retrieves all security-related organizational information system-related property; e: Retains access to organizational information and information systems formerly controlled by terminated individual; and f: Notifies [one of ] within [one of ].
PS-5	The organization: a: Reviews and confirms ongoing operational need for current logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization; b: Initiates [one of ] within [one of ]; c: Modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and d: Notifies [one of ] within [one of ].
PS-6	The organization: a: Develops and documents access agreements for organizational information systems; b: Reviews and updates the access agreements [one of ]; and c: Ensures that individuals requiring access to organizational information and information systems: 1: Sign appropriate access agreements prior to being granted access; and 2: Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [one of ].
PS-7	The organization: a: Establishes personnel security requirements including security roles and responsibilities for third-party providers; b: Requires third-party providers to comply with personnel security policies and procedures established by the organization; c: Documents personnel security requirements; d: Requires third-party providers to notify [one of ] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [one of ]; and e: Monitors provider compliance.
PS-8	The organization: a: Employs a formal sanctions process for individuals failing to comply with established information security policies and procedures; and b: Notifies [one of ] within [one of ] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
RA-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls; and b: Reviews and updates the current: 1: Risk assessment policy [one of ]; and 2: Risk assessment procedures [one of ].
RA-2	The organization: a: Categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance; b: Documents the security categorization results (including supporting rationale) in the security plan for the information system; and c: Ensures that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
RA-3	The organization: a: Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits; b: Documents risk assessment results in [one of "security plan"/"risk assessment report"/" {{ insert: param, ra-3_prm_2 }} "]; c: Reviews risk assessment results [one of ]; d: Disseminates risk assessment results to [one of ]; and e: Updates the risk assessment [one of ] or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.
SA-2	The organization: a: Determines information security requirements for the information system or information system service in mission/business process planning; b: Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and c: Establishes a discrete line item for information security in organizational programming and budgeting documentation.
SA-3	The organization: a: Manages the information system using [one of ] that incorporates information security considerations; b: Defines and documents information security roles and responsibilities throughout the system development life cycle; c: Identifies individuals having information security roles and responsibilities; and d: Integrates the organizational information security risk management process into system development life cycle activities.
SA-4	The organization includes the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs: a: Security functional requirements; b: Security strength requirements; c: Security assurance requirements; d: Security-related documentation requirements; e: Requirements for protecting security-related documentation; f: Description of the information system development environment and environment in which the system is intended to operate; and g: Acceptance criteria.
SA-8	The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system.
SA-9(5)	The organization restricts the location of [one or more of "information processing"/"information/data"/"information system services"] to [one of ] based on [one of ].
SA-11	The organization requires the developer of the information system, system component, or information system service to: a: Create and implement a security assessment plan; b: Perform [one or more of "unit"/"integration"/"system"/"regression"] testing/evaluation at [one of ]; c: Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation; d: Implement a verifiable flaw remediation process; and e: Correct flaws identified during security testing/evaluation.
SA-15(9)	The organization approves, documents, and controls the use of live data in development and test environments for the information system, system component, or information system service.
SA-17	The organization requires the developer of the information system, system component, or information system service to produce a design specification and security architecture that: a: Is consistent with and supportive of the organization’s security architecture which is established within and is an integrated part of the organization’s enterprise architecture; b: Accurately and completely describes the required security functionality, and the allocation of security controls among physical and logical components; and c: Expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.
SA-21	The organization requires that the developer of [one of ]: a: Have appropriate access authorizations as determined by assigned [one of ]; and b: Satisfy [one of ].
SC-2	The information system separates user functionality (including user interface services) from information system management functionality.
SC-4	The information system prevents unauthorized and unintended information transfer via shared system resources.
SC-8	The information system protects the [one or more of "confidentiality"/"integrity"] of transmitted information.
SC-8(1)	The information system implements cryptographic mechanisms to [one or more of "prevent unauthorized disclosure of information"/"detect changes to information"] during transmission unless otherwise protected by [one of ].
SC-8(2)	The information system maintains the [one or more of "confidentiality"/"integrity"] of information during preparation for transmission and during reception.
SC-12	The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [one of ].
SC-13	The information system implements [one of ] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
SC-28	The information system protects the [one or more of "confidentiality"/"integrity"] of [one of ].
SC-28(1)	The information system implements cryptographic mechanisms to prevent unauthorized disclosure and modification of [one of ] on [one of ].
SE-1	The organization: a. Establishes, maintains, and updates [Assignment: organization-defined frequency] an inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII); and b. Provides each update of the PII inventory to the CIO or information security official [Assignment: organization-defined frequency] to support the establishment of information security requirements for all new or modified information systems containing PII.
SE-2	The organization: a. Develops and implements a Privacy Incident Response Plan; and b. Provides an organized and effective response to privacy incidents in accordance with the organizational Privacy Incident Response Plan.
SI-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls; and b: Reviews and updates the current: 1: System and information integrity policy [one of ]; and 2: System and information integrity procedures [one of ].
SI-4	The organization: a: Monitors the information system to detect: 1: Attacks and indicators of potential attacks in accordance with [one of ]; and 2: Unauthorized local, network, and remote connections; b: Identifies unauthorized use of the information system through [one of ]; c: Deploys monitoring devices: 1: Strategically within the information system to collect organization-determined essential information; and 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization; d: Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; e: Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; f: Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and g: Provides [one of ] to [one of ] [one or more of "as needed"/" {{ insert: param, si-4_prm_6 }} "].
SI-7	The organization employs integrity verification tools to detect unauthorized changes to [one of ].
SI-7(6)	The information system implements cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
SI-10	The information system checks the validity of [one of ].
SI-11	The information system: a: Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries; and b: Reveals error messages only to [one of ].
SI-12	The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.
TR-1	The organization: a. Provides effective notice to the public and to individuals regarding: (i) its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII); (ii) authority for collecting PII; (iii) the choices, if any, individuals may have regarding how the organization uses PII and the consequences of exercising or not exercising those choices; and (iv) the ability to access and have PII amended or corrected if necessary; b. Describes: (i) the PII the organization collects and the purpose(s) for which it collects that information; (ii) how the organization uses PII internally; (iii) whether the organization shares PII with external entities, the categories of those entities, and the purposes for such sharing; (iv) whether individuals have the ability to consent to specific uses or sharing of PII and how to exercise any such consent; (v) how individuals may obtain access to PII; and (vi) how the PII will be protected; and c. Revises its public notices to reflect changes in practice or policy that affect PII or changes in its activities that impact privacy, before or as soon as practicable after the change.
TR-2	The organization: a. Publishes System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII); b. Keeps SORNs current; and c. Includes Privacy Act Statements on its forms that collect PII, or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected.
TR-2(1)	The organization publishes SORNs on its public website.
TR-3	The organization: a. Ensures that the public has access to information about its privacy activities and is able to communicate with its Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO); and b. Ensures that its privacy practices are publicly available through organizational websites or otherwise.
UL-1	The organization uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices.
UL-2	The organization: a. Shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes; b. Where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the PII covered and specifically enumerate the purposes for which the PII may be used; c. Monitors, audits, and trains its staff on the authorized sharing of PII with third parties and on the consequences of unauthorized use or sharing of PII; and d. Evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required.

Removals

This overlay removes the following controls.

Control	Description
AC-2(8)	The information system creates [one of ] dynamically.