Navigate

• Top
• Additions
• Removals

Overlay Privacy (high)

Additions

This overlay adds the following controls.

Control	Description
AC-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] access control policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the access control policy and the associated access controls; b: Designate an [an official to manage the access control policy and procedures is defined;] to manage the development, documentation, and dissemination of the access control policy and procedures; and c: Review and update the current access control: 1: Policy [the frequency at which the current access control policy is reviewed and updated is defined;] and following [events that would require the current access control policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current access control procedures are reviewed and updated is defined;] and following [events that would require procedures to be reviewed and updated are defined;].
AC-2	a: Define and document the types of accounts allowed and specifically prohibited for use within the system; b: Assign account managers; c: Require [prerequisites and criteria for group and role membership are defined;] for group and role membership; d: Specify: 1: Authorized users of the system; 2: Group and role membership; and 3: Access authorizations (i.e., privileges) and [attributes (as required) for each account are defined;] for each account; e: Require approvals by [personnel or roles required to approve requests to create accounts is/are defined;] for requests to create accounts; f: Create, enable, modify, disable, and remove accounts in accordance with [policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined;]; g: Monitor the use of accounts; h: Notify account managers and [personnel or roles to be notified is/are defined;] within: 1: [time period within which to notify account managers when accounts are no longer required is defined;] when accounts are no longer required; 2: [time period within which to notify account managers when users are terminated or transferred is defined; ] when users are terminated or transferred; and 3: [time period within which to notify account managers when system usage or the need to know changes for an individual is defined;] when system usage or need-to-know changes for an individual; i: Authorize access to the system based on: 1: A valid access authorization; 2: Intended system usage; and 3: [attributes needed to authorize system access (as required) are defined;]; j: Review accounts for compliance with account management requirements [the frequency of account review is defined;]; k: Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l: Align account management processes with personnel termination and transfer processes.
AC-2(1)	Support the management of system accounts using [automated mechanisms used to support the management of system accounts are defined; ].
AC-2(2)	Automatically [one of "remove"/"disable"] temporary and emergency accounts after [the time period after which to automatically remove or disable temporary or emergency accounts is defined;].
AC-2(3)	Disable accounts within [time period within which to disable accounts is defined;] when the accounts: (a): Have expired; (b): Are no longer associated with a user or individual; (c): Are in violation of organizational policy; or (d): Have been inactive for [time period for account inactivity before disabling is defined;].
AC-2(4)	Automatically audit account creation, modification, enabling, disabling, and removal actions.
AC-2(5)	Require that users log out when [the time period of expected inactivity or description of when to log out is defined;].
AC-2(7)	(a): Establish and administer privileged user accounts in accordance with [one of "a role-based access scheme"/"an attribute-based access scheme"]; (b): Monitor privileged role or attribute assignments; (c): Monitor changes to roles or attributes; and (d): Revoke access when privileged role or attribute assignments are no longer appropriate.
AC-2(9)	Only permit the use of shared and group accounts that meet [conditions for establishing shared and group accounts are defined;].
AC-2(12)	(a): Monitor system accounts for [atypical usage for which to monitor system accounts is defined;] ; and (b): Report atypical usage of system accounts to [personnel or roles to report atypical usage is/are defined;].
AC-2(13)	Disable accounts of individuals within [time period within which to disable accounts of individuals who are discovered to pose significant risk is defined;] of discovery of [significant risks leading to disabling accounts are defined;].
AC-3	Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-3(9)	Release information outside of the system only if: (a): The receiving [the outside system or system component to which to release information is defined;] provides [controls to be provided by the outside system or system component (defined in AC-03(09)_ODP[01]) are defined;] ; and (b): [controls used to validate appropriateness of information to be released are defined;] are used to validate the appropriateness of the information designated for release.
AC-3(14)	Provide [mechanisms enabling individuals to have access to elements of their personally identifiable information are defined;] to enable individuals to have access to the following elements of their personally identifiable information: [elements of personally identifiable information to which individuals have access are defined;].
AC-4	Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [information flow control policies within the system and between connected systems are defined;].
AC-5	a: Identify and document [duties of individuals requiring separation are defined;] ; and b: Define system access authorizations to support separation of duties.
AC-6	Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
AC-6(1)	Authorize access for [individuals and roles with authorized access to security functions and security-relevant information are defined;] to: (a): [one of ] ; and (b): [security-relevant information for authorized access is defined;].
AC-6(2)	Require that users of system accounts (or roles) with access to [security functions or security-relevant information, the access to which requires users to use non-privileged accounts to access non-security functions, are defined;] use non-privileged accounts or roles, when accessing nonsecurity functions.
AC-6(5)	Restrict privileged accounts on the system to [personnel or roles to which privileged accounts on the system are to be restricted is/are defined;].
AC-6(7)	(a): Review [the frequency at which to review the privileges assigned to roles or classes of users is defined;] the privileges assigned to [roles or classes of users to which privileges are assigned are defined;] to validate the need for such privileges; and (b): Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
AC-6(8)	Prevent the following software from executing at higher privilege levels than users executing the software: [software to be prevented from executing at higher privilege levels than users executing the software is defined;].
AC-6(9)	Log the execution of privileged functions.
AC-6(10)	Prevent non-privileged users from executing privileged functions.
AC-8	a: Display [system use notification message or banner to be displayed by the system to users before granting access to the system is defined;] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that: 1: Users are accessing a U.S. Government system; 2: System usage may be monitored, recorded, and subject to audit; 3: Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and 4: Use of the system indicates consent to monitoring and recording; b: Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and c: For publicly accessible systems: 1: Display system use information [conditions for system use to be displayed by the system before granting further access are defined;] , before granting further access to the publicly accessible system; 2: Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and 3: Include a description of the authorized uses of the system.
AC-11	a: Prevent further access to the system by [one or more of "initiating a device lock after {{ insert: param, ac-11_odp.02 }} of inactivity"/"requiring the user to initiate a device lock before leaving the system unattended"] ; and b: Retain the device lock until the user reestablishes access using established identification and authentication procedures.
AC-16	a: Provide the means to associate [one of ] with [one of ] for information in storage, in process, and/or in transmission; b: Ensure that the attribute associations are made and retained with the information; c: Establish the following permitted security and privacy attributes from the attributes defined in [AC-16a](#ac-16_smt.a) for [one of ]: [one of ]; d: Determine the following permitted attribute values or ranges for each of the established attributes: [attribute values or ranges for established attributes are defined;]; e: Audit changes to attributes; and f: Review [one of ] for applicability [one of ].
AC-16(3)	Maintain the association and integrity of [one of ] to [one of ].
AC-17	a: Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b: Authorize each type of remote access to the system prior to allowing such connections.
AC-17(1)	Employ automated mechanisms to monitor and control remote access methods.
AC-17(2)	Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
AC-18(1)	Protect wireless access to the system using authentication of [one or more of "users"/"devices"] and encryption.
AC-19	a: Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and b: Authorize the connection of mobile devices to organizational systems.
AC-19(5)	Employ [one of "full-device encryption"/"container-based encryption"] to protect the confidentiality and integrity of information on [mobile devices on which to employ encryption are defined;].
AC-20	a: [one or more of "establish {{ insert: param, ac-20_odp.02 }} "/"identify {{ insert: param, ac-20_odp.03 }} "] , consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to: 1: Access the system from external systems; and 2: Process, store, or transmit organization-controlled information using external systems; or b: Prohibit the use of [types of external systems prohibited from use are defined;].
AC-20(1)	Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after: (a): Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or (b): Retention of approved system connection or processing agreements with the organizational entity hosting the external system.
AC-20(3)	Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [restrictions on the use of non-organizationally owned systems or system components to process, store, or transmit organizational information are defined;].
AC-21	a: Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [information-sharing circumstances where user discretion is required to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions are defined;] ; and b: Employ [automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions are defined;] to assist users in making information sharing and collaboration decisions.
AC-22	a: Designate individuals authorized to make information publicly accessible; b: Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c: Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and d: Review the content on the publicly accessible system for nonpublic information [the frequency at which to review the content on the publicly accessible system for non-public information is defined;] and remove such information, if discovered.
AT-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] awareness and training policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls; b: Designate an [an official to manage the awareness and training policy and procedures is defined;] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and c: Review and update the current awareness and training: 1: Policy [the frequency at which the current awareness and training policy is reviewed and updated is defined;] and following [events that would require the current awareness and training policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current awareness and training procedures are reviewed and updated is defined;] and following [events that would require procedures to be reviewed and updated are defined;].
AT-2	a: Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1: As part of initial training for new users and [one of ] thereafter; and 2: When required by system changes or following [one of ]; b: Employ the following techniques to increase the security and privacy awareness of system users [techniques to be employed to increase the security and privacy awareness of system users are defined;]; c: Update literacy training and awareness content [the frequency at which to update literacy training and awareness content is defined;] and following [events that would require literacy training and awareness content to be updated are defined;] ; and d: Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.
AT-2(2)	Provide literacy training on recognizing and reporting potential indicators of insider threat.
AT-2(3)	Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.
AT-2(4)	Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [indicators of malicious code are defined;].
AT-2(5)	Provide literacy training on the advanced persistent threat.
AT-3	a: Provide role-based security and privacy training to personnel with the following roles and responsibilities: [one of ]: 1: Before authorizing access to the system, information, or performing assigned duties, and [the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined;] thereafter; and 2: When required by system changes; b: Update role-based training content [the frequency at which to update role-based training content is defined;] and following [events that require role-based training content to be updated are defined;] ; and c: Incorporate lessons learned from internal or external security incidents or breaches into role-based training.
AT-3(5)	Provide [personnel or roles to be provided with initial and refresher training in the employment and operation of personally identifiable information processing and transparency controls is/are defined;] with initial and [the frequency at which to provide refresher training in the employment and operation of personally identifiable information processing and transparency controls is defined;] training in the employment and operation of personally identifiable information processing and transparency controls.
AT-4	a: Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and b: Retain individual training records for [time period for retaining individual training records is defined;].
AT-6	Provide feedback on organizational training results to the following personnel [frequency at which to provide feedback on organizational training results is defined;]: [personnel to whom feedback on organizational training results will be provided is/are assigned;].
AU-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] audit and accountability policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls; b: Designate an [an official to manage the audit and accountability policy and procedures is defined;] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and c: Review and update the current audit and accountability: 1: Policy [the frequency at which the current audit and accountability policy is reviewed and updated is defined;] and following [events that would require the current audit and accountability policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current audit and accountability procedures are reviewed and updated is defined;] and following [events that would require audit and accountability procedures to be reviewed and updated are defined;].
AU-2	a: Identify the types of events that the system is capable of logging in support of the audit function: [the event types that the system is capable of logging in support of the audit function are defined;]; b: Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged; c: Specify the following event types for logging within the system: [one of ]; d: Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and e: Review and update the event types selected for logging [the frequency of event types selected for logging are reviewed and updated;].
AU-3	Ensure that audit records contain information that establishes the following: a: What type of event occurred; b: When the event occurred; c: Where the event occurred; d: Source of the event; e: Outcome of the event; and f: Identity of any individuals, subjects, or objects/entities associated with the event.
AU-3(1)	Generate audit records containing the following additional information: [additional information to be included in audit records is defined;].
AU-3(3)	Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [elements identified in the privacy risk assessment are defined;].
AU-4	Allocate audit log storage capacity to accommodate [audit log retention requirements are defined;].
AU-4(1)	Transfer audit logs [the frequency of audit logs transferred to a different system, system component, or media other than the system or system component conducting the logging is defined;] to a different system, system component, or media other than the system or system component conducting the logging.
AU-5	a: Alert [personnel or roles receiving audit logging process failure alerts are defined;] within [time period for personnel or roles receiving audit logging process failure alerts is defined;] in the event of an audit logging process failure; and b: Take the following additional actions: [additional actions to be taken in the event of an audit logging process failure are defined;].
AU-6	a: Review and analyze system audit records [frequency at which system audit records are reviewed and analyzed is defined;] for indications of [inappropriate or unusual activity is defined;] and the potential impact of the inappropriate or unusual activity; b: Report findings to [personnel or roles to receive findings from reviews and analyses of system records is/are defined;] ; and c: Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
AU-6(3)	Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
AU-7	Provide and implement an audit record reduction and report generation capability that: a: Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and b: Does not alter the original content or time ordering of audit records.
AU-7(1)	Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [fields within audit records that can be processed, sorted, or searched are defined;].
AU-9	a: Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b: Alert [personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information is/are defined;] upon detection of unauthorized access, modification, or deletion of audit information.
AU-9(3)	Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.
AU-9(4)	Authorize access to management of audit logging functionality to only [a subset of privileged users or roles authorized to access management of audit logging functionality is defined;].
AU-10	Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [actions to be covered by non-repudiation are defined;].
AU-11	Retain audit records for [a time period to retain audit records that is consistent with the records retention policy is defined;] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
AU-11(1)	Employ [measures to be employed to ensure that long-term audit records generated by the system can be retrieved are defined;] to ensure that long-term audit records generated by the system can be retrieved.
AU-12	a: Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [system components that provide an audit record generation capability for the events types (defined in AU-02_ODP[02]) are defined;]; b: Allow [personnel or roles allowed to select the event types that are to be logged by specific components of the system is/are defined;] to select the event types that are to be logged by specific components of the system; and c: Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).
AU-12(3)	Provide and implement the capability for [individuals or roles authorized to change the logging on system components are defined;] to change the logging to be performed on [system components on which logging is to be performed are defined;] based on [selectable event criteria with which change logging is to be performed are defined;] within [time thresholds in which logging actions are to change is defined;].
AU-14	a: Provide and implement the capability for [users or roles who can audit the content of a user session are defined;] to [one or more of "record"/"view"/"hear"/"log"] the content of a user session under [circumstances under which the content of a user session can be audited are defined;] ; and b: Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
AU-14(3)	Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.
CA-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] assessment, authorization, and monitoring policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls; b: Designate an [an official to manage the assessment, authorization, and monitoring policy and procedures is defined;] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and c: Review and update the current assessment, authorization, and monitoring: 1: Policy [the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined;] and following [events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined;] and following [events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined;].
CA-3	a: Approve and manage the exchange of information between the system and other systems using [one or more of "interconnection security agreements"/"information exchange security agreements"/"memoranda of understanding or agreement"/"service level agreements"/"user agreements"/"non-disclosure agreements"/"{{ insert: param, ca-03_odp.02 }} "]; b: Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and c: Review and update the agreements [the frequency at which to review and update agreements is defined;].
CA-3(6)	Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
CA-5	a: Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and b: Update existing plan of action and milestones [the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities is defined;] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
CA-6	a: Assign a senior official as the authorizing official for the system; b: Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems; c: Ensure that the authorizing official for the system, before commencing operations: 1: Accepts the use of common controls inherited by the system; and 2: Authorizes the system to operate; d: Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems; e: Update the authorizations [frequency at which to update the authorizations is defined;].
CA-7	Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a: Establishing the following system-level metrics to be monitored: [system-level metrics to be monitored are defined;]; b: Establishing [frequencies at which to monitor control effectiveness are defined;] for monitoring and [frequencies at which to assess control effectiveness are defined;] for assessment of control effectiveness; c: Ongoing control assessments in accordance with the continuous monitoring strategy; d: Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; e: Correlation and analysis of information generated by control assessments and monitoring; f: Response actions to address results of the analysis of control assessment and monitoring information; and g: Reporting the security and privacy status of the system to [one of ] [one of ].
CA-7(4)	Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a): Effectiveness monitoring; (b): Compliance monitoring; and (c): Change monitoring.
CA-8	Conduct penetration testing [frequency at which to conduct penetration testing on systems or system components is defined;] on [systems or system components on which penetration testing is to be conducted are defined;].
CA-9	a: Authorize internal connections of [system components or classes of components requiring internal connections to the system are defined;] to the system; b: Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated; c: Terminate internal system connections after [conditions requiring termination of internal connections are defined;] ; and d: Review [frequency at which to review the continued need for each internal connection is defined;] the continued need for each internal connection.
CM-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] configuration management policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the configuration management policy and the associated configuration management controls; b: Designate an [an official to manage the configuration management policy and procedures is defined;] to manage the development, documentation, and dissemination of the configuration management policy and procedures; and c: Review and update the current configuration management: 1: Policy [the frequency at which the current configuration management policy is reviewed and updated is defined;] and following [events that would require the current configuration management policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current configuration management procedures are reviewed and updated is defined;] and following [events that would require configuration management procedures to be reviewed and updated are defined;].
CM-2	a: Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b: Review and update the baseline configuration of the system: 1: [the frequency of baseline configuration review and update is defined;]; 2: When required due to [the circumstances requiring baseline configuration review and update are defined;] ; and 3: When system components are installed or upgraded.
CM-3	a: Determine and document the types of changes to the system that are configuration-controlled; b: Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; c: Document configuration change decisions associated with the system; d: Implement approved configuration-controlled changes to the system; e: Retain records of configuration-controlled changes to the system for [the time period to retain records of configuration-controlled changes is defined;]; f: Monitor and review activities associated with configuration-controlled changes to the system; and g: Coordinate and provide oversight for configuration change control activities through [the configuration change control element responsible for coordinating and overseeing change control activities is defined;] that convenes [one or more of "{{ insert: param, cm-03_odp.04 }} "/"when {{ insert: param, cm-03_odp.05 }} "].
CM-3(1)	Use [mechanisms used to automate configuration change control are defined;] to: (a): Document proposed changes to the system; (b): Notify [approval authorities to be notified of and request approval for proposed changes to the system are defined;] of proposed changes to the system and request change approval; (c): Highlight proposed changes to the system that have not been approved or disapproved within [the time period after which to highlight changes that have not been approved or disapproved is defined;]; (d): Prohibit changes to the system until designated approvals are received; (e): Document all changes to the system; and (f): Notify [personnel to be notified when approved changes are complete is/are defined;] when approved changes to the system are completed.
CM-3(4)	Require [one of ] to be members of the [the configuration change control element of which the security and privacy representatives are to be members is defined;].
CM-3(6)	Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [controls provided by cryptographic mechanisms that are to be under configuration management are defined;].
CM-4	Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.
CM-4(1)	Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.
CM-4(2)	After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system.
CP-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] contingency planning policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls; b: Designate an [an official to manage the contingency planning policy and procedures is defined;] to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and c: Review and update the current contingency planning: 1: Policy [the frequency at which the current contingency planning policy is reviewed and updated is defined;] and following [events that would require the current contingency planning policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current contingency planning procedures are reviewed and updated is defined;] and following [events that would require procedures to be reviewed and updated are defined;].
CP-2	a: Develop a contingency plan for the system that: 1: Identifies essential mission and business functions and associated contingency requirements; 2: Provides recovery objectives, restoration priorities, and metrics; 3: Addresses contingency roles, responsibilities, assigned individuals with contact information; 4: Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5: Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6: Addresses the sharing of contingency information; and 7: Is reviewed and approved by [one of ]; b: Distribute copies of the contingency plan to [one of ]; c: Coordinate contingency planning activities with incident handling activities; d: Review the contingency plan for the system [frequency of contingency plan review is defined;]; e: Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f: Communicate contingency plan changes to [one of ]; g: Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and h: Protect the contingency plan from unauthorized disclosure and modification.
CP-9	a: Conduct backups of user-level information contained in [system components for which to conduct backups of user-level information is defined;] [frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives is defined;]; b: Conduct backups of system-level information contained in the system [frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives is defined;]; c: Conduct backups of system documentation, including security- and privacy-related documentation [frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined;] ; and d: Protect the confidentiality, integrity, and availability of backup information.
CP-9(8)	Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [backup information to protect against unauthorized disclosure and modification is defined;].
CP-10	Provide for the recovery and reconstitution of the system to a known state within [one of ] after a disruption, compromise, or failure.
IA-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] identification and authentication policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the identification and authentication policy and the associated identification and authentication controls; b: Designate an [an official to manage the identification and authentication policy and procedures is defined;] to manage the development, documentation, and dissemination of the identification and authentication policy and procedures; and c: Review and update the current identification and authentication: 1: Policy [the frequency at which the current identification and authentication policy is reviewed and updated is defined;] and following [events that would require the current identification and authentication policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current identification and authentication procedures are reviewed and updated is defined;] and following [events that would require identification and authentication procedures to be reviewed and updated are defined;].
IA-2	Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
IA-2(1)	Implement multi-factor authentication for access to privileged accounts.
IA-2(5)	When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.
IA-2(6)	Implement multi-factor authentication for [one or more of "local"/"network"/"remote"] access to [one or more of "privileged accounts"/"non-privileged accounts"] such that: (a): One of the factors is provided by a device separate from the system gaining access; and (b): The device meets [the strength of mechanism requirements to be enforced by a device separate from the system gaining access to accounts is defined;].
IA-4	Manage system identifiers by: a: Receiving authorization from [personnel or roles from whom authorization must be received to assign an identifier are defined;] to assign an individual, group, role, service, or device identifier; b: Selecting an identifier that identifies an individual, group, role, service, or device; c: Assigning the identifier to the intended individual, group, role, service, or device; and d: Preventing reuse of identifiers for [a time period for preventing reuse of identifiers is defined;].
IA-5	Manage system authenticators by: a: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator; b: Establishing initial authenticator content for any authenticators issued by the organization; c: Ensuring that authenticators have sufficient strength of mechanism for their intended use; d: Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators; e: Changing default authenticators prior to first use; f: Changing or refreshing authenticators [a time period for changing or refreshing authenticators by authenticator type is defined;] or when [events that trigger the change or refreshment of authenticators are defined;] occur; g: Protecting authenticator content from unauthorized disclosure and modification; h: Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and i: Changing authenticators for group or role accounts when membership to those accounts changes.
IA-7	Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
IA-8	Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
IA-12	a: Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b: Resolve user identities to a unique individual; and c: Collect, validate, and verify identity evidence.
IR-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] incident response policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the incident response policy and the associated incident response controls; b: Designate an [an official to manage the incident response policy and procedures is defined;] to manage the development, documentation, and dissemination of the incident response policy and procedures; and c: Review and update the current incident response: 1: Policy [the frequency at which the current incident response policy is reviewed and updated is defined;] and following [events that would require the current incident response policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current incident response procedures are reviewed and updated is defined;] and following [events that would require the incident response procedures to be reviewed and updated are defined;].
IR-2	a: Provide incident response training to system users consistent with assigned roles and responsibilities: 1: Within [a time period within which incident response training is to be provided to system users assuming an incident response role or responsibility is defined;] of assuming an incident response role or responsibility or acquiring system access; 2: When required by system changes; and 3: [frequency at which to provide incident response training to users is defined;] thereafter; and b: Review and update incident response training content [frequency at which to review and update incident response training content is defined;] and following [events that initiate a review of the incident response training content are defined;].
IR-2(1)	Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.
IR-2(3)	Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.
IR-3	Test the effectiveness of the incident response capability for the system [frequency at which to test the effectiveness of the incident response capability for the system is defined;] using the following tests: [tests used to test the effectiveness of the incident response capability for the system are defined;].
IR-4	a: Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b: Coordinate incident handling activities with contingency planning activities; c: Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d: Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.
IR-4(4)	Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
IR-4(7)	Coordinate an incident handling capability for insider threats that includes the following organizational entities [entities that require coordination for an incident handling capability for insider threats are defined;].
IR-5	Track and document incidents.
IR-6	a: Require personnel to report suspected incidents to the organizational incident response capability within [time period for personnel to report suspected incidents to the organizational incident response capability is defined;] ; and b: Report incident information to [authorities to whom incident information is to be reported are defined;].
IR-7	Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.
IR-8	a: Develop an incident response plan that: 1: Provides the organization with a roadmap for implementing its incident response capability; 2: Describes the structure and organization of the incident response capability; 3: Provides a high-level approach for how the incident response capability fits into the overall organization; 4: Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; 5: Defines reportable incidents; 6: Provides metrics for measuring the incident response capability within the organization; 7: Defines the resources and management support needed to effectively maintain and mature an incident response capability; 8: Addresses the sharing of incident information; 9: Is reviewed and approved by [personnel or roles that review and approve the incident response plan is/are identified;] [the frequency at which to review and approve the incident response plan is defined;] ; and 10: Explicitly designates responsibility for incident response to [entities, personnel, or roles with designated responsibility for incident response are defined;]. b: Distribute copies of the incident response plan to [incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed is/are defined;]; c: Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing; d: Communicate incident response plan changes to [one of ] ; and e: Protect the incident response plan from unauthorized disclosure and modification.
IR-8(1)	Include the following in the Incident Response Plan for breaches involving personally identifiable information: (a): A process to determine if notice to individuals or other organizations, including oversight organizations, is needed; (b): An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and (c): Identification of applicable privacy requirements.
MA-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] maintenance policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls; b: Designate an [an official to manage the maintenance policy and procedures is defined;] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and c: Review and update the current maintenance: 1: Policy [the frequency with which the current maintenance policy is reviewed and updated is defined;] and following [events that would require the current maintenance policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency with which the current maintenance procedures are reviewed and updated is defined;] and following [events that would require the maintenance procedures to be reviewed and updated are defined;].
MA-2	a: Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b: Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location; c: Require that [personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs is/are defined;] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement; d: Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement is defined;]; e: Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and f: Include the following information in organizational maintenance records: [information to be included in organizational maintenance records is defined;].
MA-3(4)	Restrict the use of maintenance tools to authorized personnel only.
MA-3(5)	Monitor the use of maintenance tools that execute with increased privilege.
MA-4(6)	Implement the following cryptographic mechanisms to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications: [cryptographic mechanisms to be implemented to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications are defined;].
MA-5	a: Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel; b: Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and c: Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
MP-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] media protection policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the media protection policy and the associated media protection controls; b: Designate an [an official to manage the media protection policy and procedures is defined;] to manage the development, documentation, and dissemination of the media protection policy and procedures; and c: Review and update the current media protection: 1: Policy [the frequency with which the current media protection policy is reviewed and updated is defined;] and following [events that would require the current media protection policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency with which the current media protection procedures are reviewed and updated is defined;] and following [events that would require media protection procedures to be reviewed and updated are defined;].
MP-2	Restrict access to [one of ] to [one of ].
MP-3	a: Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and b: Exempt [types of system media exempt from marking when remaining in controlled areas are defined;] from marking if the media remain within [controlled areas where media is exempt from marking are defined;].
MP-4	a: Physically control and securely store [one of ] within [one of ] ; and b: Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-5	a: Protect and control [types of system media to protect and control during transport outside of controlled areas are defined;] during transport outside of controlled areas using [one of ]; b: Maintain accountability for system media during transport outside of controlled areas; c: Document activities associated with the transport of system media; and d: Restrict the activities associated with the transport of system media to authorized personnel.
MP-6	a: Sanitize [one of ] prior to disposal, release out of organizational control, or release for reuse using [one of ] ; and b: Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
MP-6(8)	Provide the capability to purge or wipe information from [systems or system components to purge or wipe information either remotely or under specific conditions are defined;] [one of "remotely"/"under {{ insert: param, mp-06.08_odp.03 }} "].
MP-7	a: [one of "restrict"/"prohibit"] the use of [types of system media to be restricted or prohibited from use on systems or system components are defined;] on [systems or system components on which the use of specific types of system media to be restricted or prohibited are defined;] using [controls to restrict or prohibit the use of specific types of system media on systems or system components are defined;] ; and b: Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.
PE-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] physical and environmental protection policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls; b: Designate an [an official to manage the physical and environmental protection policy and procedures is defined;] to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; and c: Review and update the current physical and environmental protection: 1: Policy [the frequency at which the current physical and environmental protection policy is reviewed and updated is defined;] and following [events that would require the current physical and environmental protection policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current physical and environmental protection procedures are reviewed and updated is defined;] and following [events that would require the physical and environmental protection procedures to be reviewed and updated are defined;].
PE-2	a: Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; b: Issue authorization credentials for facility access; c: Review the access list detailing authorized facility access by individuals [frequency at which to review the access list detailing authorized facility access by individuals is defined;] ; and d: Remove individuals from the facility access list when access is no longer required.
PE-3	a: Enforce physical access authorizations at [entry and exit points to the facility in which the system resides are defined;] by: 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress and egress to the facility using [one or more of "{{ insert: param, pe-03_odp.03 }} "/"guards"]; b: Maintain physical access audit logs for [entry or exit points for which physical access logs are maintained are defined;]; c: Control access to areas within the facility designated as publicly accessible by implementing the following controls: [physical access controls to control access to areas within the facility designated as publicly accessible are defined;]; d: Escort visitors and control visitor activity [circumstances requiring visitor escorts and control of visitor activity are defined;]; e: Secure keys, combinations, and other physical access devices; f: Inventory [physical access devices to be inventoried are defined;] every [frequency at which to inventory physical access devices is defined;] ; and g: Change combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
PE-5	Control physical access to output from [output devices that require physical access control to output are defined;] to prevent unauthorized individuals from obtaining the output.
PE-8	a: Maintain visitor access records to the facility where the system resides for [time period for which to maintain visitor access records for the facility where the system resides is defined;]; b: Review visitor access records [the frequency at which to review visitor access records is defined;] ; and c: Report anomalies in visitor access records to [personnel to whom visitor access records anomalies are reported to is/are defined;].
PE-8(3)	Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [elements identified in the privacy risk assessment to limit personally identifiable information contained in visitor access logs are defined;].
PE-17	a: Determine and document the [alternate work sites allowed for use by employees are defined;] allowed for use by employees; b: Employ the following controls at alternate work sites: [controls to be employed at alternate work sites are defined;]; c: Assess the effectiveness of controls at alternate work sites; and d: Provide a means for employees to communicate with information security and privacy personnel in case of incidents.
PE-18	Position system components within the facility to minimize potential damage from [physical and environmental hazards that could result in potential damage to system components within the facility are defined;] and to minimize the opportunity for unauthorized access.
PL-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] planning policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the planning policy and the associated planning controls; b: Designate an [an official to manage the planning policy and procedures is defined;] to manage the development, documentation, and dissemination of the planning policy and procedures; and c: Review and update the current planning: 1: Policy [the frequency with which the current planning policy is reviewed and updated is defined;] and following [events that would require the current planning policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency with which the current planning procedures are reviewed and updated is defined;] and following [events that would require procedures to be reviewed and updated are defined;].
PL-2	a: Develop security and privacy plans for the system that: 1: Are consistent with the organization’s enterprise architecture; 2: Explicitly define the constituent system components; 3: Describe the operational context of the system in terms of mission and business processes; 4: Identify the individuals that fulfill system roles and responsibilities; 5: Identify the information types processed, stored, and transmitted by the system; 6: Provide the security categorization of the system, including supporting rationale; 7: Describe any specific threats to the system that are of concern to the organization; 8: Provide the results of a privacy risk assessment for systems processing personally identifiable information; 9: Describe the operational environment for the system and any dependencies on or connections to other systems or system components; 10: Provide an overview of the security and privacy requirements for the system; 11: Identify any relevant control baselines or overlays, if applicable; 12: Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions; 13: Include risk determinations for security and privacy architecture and design decisions; 14: Include security- and privacy-related activities affecting the system that require planning and coordination with [individuals or groups with whom security and privacy-related activities affecting the system that require planning and coordination is/are assigned;] ; and 15: Are reviewed and approved by the authorizing official or designated representative prior to plan implementation. b: Distribute copies of the plans and communicate subsequent changes to the plans to [personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned;]; c: Review the plans [frequency to review system security and privacy plans is defined;]; d: Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments; and e: Protect the plans from unauthorized disclosure and modification.
PL-4	a: Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy; b: Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system; c: Review and update the rules of behavior [frequency for reviewing and updating the rules of behavior is defined;] ; and d: Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [one or more of "{{ insert: param, pl-04_odp.03 }} "/"when the rules are revised or updated"].
PL-4(1)	Include in the rules of behavior, restrictions on: (a): Use of social media, social networking sites, and external sites/applications; (b): Posting organizational information on public websites; and (c): Use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
PL-8	a: Develop security and privacy architectures for the system that: 1: Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information; 2: Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals; 3: Describe how the architectures are integrated into and support the enterprise architecture; and 4: Describe any assumptions about, and dependencies on, external systems and services; b: Review and update the architectures [frequency for review and update to reflect changes in the enterprise architecture;] to reflect changes in the enterprise architecture; and c: Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.
PL-8(1)	Design the security and privacy architectures for the system using a defense-in-depth approach that: (a): Allocates [controls to be allocated are defined;] to [locations and architectural layers are defined;] ; and (b): Ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.
PL-9	Centrally manage [security and privacy controls and related processes to be centrally managed are defined;].
PL-10	Select a control baseline for the system.
PL-11	Tailor the selected control baseline by applying specified tailoring actions.
PM-1	a: Develop and disseminate an organization-wide information security program plan that: 1: Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements; 2: Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance; 3: Reflects the coordination among organizational entities responsible for information security; and 4: Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; b: Review and update the organization-wide information security program plan [the frequency at which to review and update the organization-wide information security program plan is defined;] and following [events that trigger the review and update of the organization-wide information security program plan are defined;] ; and c: Protect the information security program plan from unauthorized disclosure and modification.
PM-3	a: Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; b: Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and c: Make available for expenditure, the planned information security and privacy resources.
PM-4	a: Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems: 1: Are developed and maintained; 2: Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and 3: Are reported in accordance with established reporting requirements. b: Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
PM-5	Develop and update [the frequency at which to update the inventory of organizational systems is defined;] an inventory of organizational systems.
PM-5(1)	Establish, maintain, and update [the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined;] an inventory of all systems, applications, and projects that process personally identifiable information.
PM-6	Develop, monitor, and report on the results of information security and privacy measures of performance.
PM-7	Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.
PM-8	Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.
PM-9	a: Develops a comprehensive strategy to manage: 1: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and 2: Privacy risk to individuals resulting from the authorized processing of personally identifiable information; b: Implement the risk management strategy consistently across the organization; and c: Review and update the risk management strategy [the frequency at which to review and update the risk management strategy is defined;] or as required, to address organizational changes.
PM-10	a: Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes; b: Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and c: Integrate the authorization processes into an organization-wide risk management program.
PM-11	a: Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and b: Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and c: Review and revise the mission and business processes [the frequency at which to review and revise the mission and business processes is defined;].
PM-12	Implement an insider threat program that includes a cross-discipline insider threat incident handling team.
PM-13	Establish a security and privacy workforce development and improvement program.
PM-14	a: Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: 1: Are developed and maintained; and 2: Continue to be executed; and b: Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
PM-17	a: Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and b: Review and update the policy and procedures [one of ].
PM-18	a: Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and: 1: Includes a description of the structure of the privacy program and the resources dedicated to the privacy program; 2: Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements; 3: Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities; 4: Describes management commitment, compliance, and the strategic goals and objectives of the privacy program; 5: Reflects coordination among organizational entities responsible for the different aspects of privacy; and 6: Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and b: Update the plan [the frequency of updates to the privacy program plan is defined;] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.
PM-19	Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.
PM-20	Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that: a: Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy; b: Ensures that organizational privacy practices and reports are publicly available; and c: Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.
PM-20(1)	Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that: (a): Are written in plain language and organized in a way that is easy to understand and navigate; (b): Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and (c): Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.
PM-21	a: Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: 1: Date, nature, and purpose of each disclosure; and 2: Name and address, or other contact information of the individual or organization to which the disclosure was made; b: Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and c: Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.
PM-22	Develop and document organization-wide policies and procedures for: a: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; b: Correcting or deleting inaccurate or outdated personally identifiable information; c: Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and d: Appeals of adverse decisions on correction or deletion requests.
PM-23	Establish a Data Governance Body consisting of [the roles of a Data Governance Body are defined;] with [the responsibilities of a Data Governance Body are defined;].
PM-24	Establish a Data Integrity Board to: a: Review proposals to conduct or participate in a matching program; and b: Conduct an annual review of all matching programs in which the agency has participated.
PM-25	a: Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research; b: Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes; c: Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and d: Review and update policies and procedures [one of ].
PM-26	Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes: a: Mechanisms that are easy to use and readily accessible by the public; b: All information necessary for successfully filing complaints; c: Tracking mechanisms to ensure all complaints received are reviewed and addressed within [one of ]; d: Acknowledgement of receipt of complaints, concerns, or questions from individuals within [the time period for acknowledging the receipt of complaints is defined;] ; and e: Response to complaints, concerns, or questions from individuals within [the time period for responding to complaints is defined;].
PM-27	a: Develop [privacy reports are defined;] and disseminate to: 1: [privacy oversight bodies are defined;] to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and 2: [officials responsible for monitoring privacy program compliance are defined;] and other personnel with responsibility for monitoring privacy program compliance; and b: Review and update privacy reports [the frequency for reviewing and updating privacy reports is defined;].
PM-28	a: Identify and document: 1: Assumptions affecting risk assessments, risk responses, and risk monitoring; 2: Constraints affecting risk assessments, risk responses, and risk monitoring; 3: Priorities and trade-offs considered by the organization for managing risk; and 4: Organizational risk tolerance; b: Distribute the results of risk framing activities to [the personnel to receive the results of risk framing activities is/are defined;] ; and c: Review and update risk framing considerations [the frequency for reviewing and updating risk framing considerations is defined;].
PM-29	a: Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and b: Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.
PM-30	a: Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; b: Implement the supply chain risk management strategy consistently across the organization; and c: Review and update the supply chain risk management strategy on [the frequency for reviewing and updating the supply chain risk management strategy is defined;] or as required, to address organizational changes.
PM-31	Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a: Establishing the following organization-wide metrics to be monitored: [the metrics for organization-wide continuous monitoring are defined;]; b: Establishing [the frequencies for monitoring are defined;] and [the frequencies for assessing control effectiveness are defined;] for control effectiveness; c: Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy; d: Correlation and analysis of information generated by control assessments and monitoring; e: Response actions to address results of the analysis of control assessment and monitoring information; and f: Reporting the security and privacy status of organizational systems to [one of ] [one of ].
PS-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] personnel security policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the personnel security policy and the associated personnel security controls; b: Designate an [an official to manage the personnel security policy and procedures is defined;] to manage the development, documentation, and dissemination of the personnel security policy and procedures; and c: Review and update the current personnel security: 1: Policy [the frequency at which the current personnel security policy is reviewed and updated is defined;] and following [events that would require the current personnel security policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current personnel security procedures are reviewed and updated is defined;] and following [events that would require the personnel security procedures to be reviewed and updated are defined;].
PS-2	a: Assign a risk designation to all organizational positions; b: Establish screening criteria for individuals filling those positions; and c: Review and update position risk designations [the frequency at which to review and update position risk designations is defined;].
PS-3	a: Screen individuals prior to authorizing access to the system; and b: Rescreen individuals in accordance with [one of ].
PS-4	Upon termination of individual employment: a: Disable system access within [a time period within which to disable system access is defined;]; b: Terminate or revoke any authenticators and credentials associated with the individual; c: Conduct exit interviews that include a discussion of [information security topics to be discussed when conducting exit interviews are defined;]; d: Retrieve all security-related organizational system-related property; and e: Retain access to organizational information and systems formerly controlled by terminated individual.
PS-5	a: Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization; b: Initiate [transfer or reassignment actions to be initiated following transfer or reassignment are defined;] within [the time period within which transfer or reassignment actions must occur following transfer or reassignment is defined;]; c: Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and d: Notify [personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization is/are defined;] within [time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization is defined;].
PS-6	a: Develop and document access agreements for organizational systems; b: Review and update the access agreements [the frequency at which to review and update access agreements is defined;] ; and c: Verify that individuals requiring access to organizational information and systems: 1: Sign appropriate access agreements prior to being granted access; and 2: Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [the frequency at which to re-sign access agreements to maintain access to organizational information is defined;].
PS-7	a: Establish personnel security requirements, including security roles and responsibilities for external providers; b: Require external providers to comply with personnel security policies and procedures established by the organization; c: Document personnel security requirements; d: Require external providers to notify [personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is/are defined;] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within [time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is defined;] ; and e: Monitor provider compliance with personnel security requirements.
PS-8	a: Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and b: Notify [personnel or roles to be notified when a formal employee sanctions process is initiated is/are defined;] within [the time period within which organization-defined personnel or roles must be notified when a formal employee sanctions process is initiated is defined;] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
PS-9	Incorporate security and privacy roles and responsibilities into organizational position descriptions.
PT-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] personally identifiable information processing and transparency policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls; b: Designate an [an official to manage the personally identifiable information processing and transparency policy and procedures is defined;] to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and c: Review and update the current personally identifiable information processing and transparency: 1: Policy [the frequency at which the current personally identifiable information processing and transparency policy is reviewed and updated is defined;] and following [events that would require the current personally identifiable information processing and transparency policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current personally identifiable information processing and transparency procedures are reviewed and updated is defined;] and following [events that would require the personally identifiable information processing and transparency procedures to be reviewed and updated are defined;].
PT-2	a: Determine and document the [the authority to permit the processing (defined in PT-02_ODP[02]) of personally identifiable information is defined;] that permits the [the type of processing of personally identifiable information is defined;] of personally identifiable information; and b: Restrict the [the type of processing of personally identifiable information to be restricted is defined;] of personally identifiable information to only that which is authorized.
PT-2(1)	Attach data tags containing [the authorized processing of personally identifiable information is defined;] to [elements of personally identifiable information to be tagged are defined;].
PT-3	a: Identify and document the [the purpose(s) for processing personally identifiable information is/are defined;] for processing personally identifiable information; b: Describe the purpose(s) in the public privacy notices and policies of the organization; c: Restrict the [the processing of personally identifiable information to be restricted is defined;] of personally identifiable information to only that which is compatible with the identified purpose(s); and d: Monitor changes in processing personally identifiable information and implement [mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements are defined;] to ensure that any changes are made in accordance with [requirements for changing the processing of personally identifiable information are defined;].
PT-3(1)	Attach data tags containing the following purposes to [elements of personally identifiable information to be tagged are defined;]: [processing purposes to be contained in data tags are defined;].
PT-4	Implement [the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information are defined;] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
PT-5	Provide notice to individuals about the processing of personally identifiable information that: a: Is available to individuals upon first interacting with an organization, and subsequently at [the frequency at which a notice is provided to individuals after initial interaction with an organization is defined;]; b: Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language; c: Identifies the authority that authorizes the processing of personally identifiable information; d: Identifies the purposes for which personally identifiable information is to be processed; and e: Includes [information to be included with the notice about the processing of personally identifiable information is defined;].
PT-5(1)	Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action, or [the frequency at which to present a notice of personally identifiable information processing is defined;].
PT-5(2)	Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.
PT-6	For systems that process information that will be maintained in a Privacy Act system of records: a: Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the OMB and appropriate congressional committees for advance review; b: Publish system of records notices in the Federal Register; and c: Keep system of records notices accurate, up-to-date, and scoped in accordance with policy.
PT-6(1)	Review all routine uses published in the system of records notice at [the frequency at which to review all routine uses published in the system of records notice is defined;] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.
PT-6(2)	Review all Privacy Act exemptions claimed for the system of records at [the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined;] to ensure they remain appropriate and necessary in accordance with law, that they have been promulgated as regulations, and that they are accurately described in the system of records notice.
PT-7	Apply [processing conditions to be applied for specific categories of personally identifiable information are defined;] for specific categories of personally identifiable information.
PT-7(1)	When a system processes Social Security numbers: (a): Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier; (b): Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and (c): Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.
PT-7(2)	Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.
PT-8	When a system or organization processes information for the purpose of conducting a matching program: a: Obtain approval from the Data Integrity Board to conduct the matching program; b: Develop and enter into a computer matching agreement; c: Publish a matching notice in the Federal Register; d: Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and e: Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.
RA-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] risk assessment policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls; b: Designate an [an official to manage the risk assessment policy and procedures is defined;] to manage the development, documentation, and dissemination of the risk assessment policy and procedures; and c: Review and update the current risk assessment: 1: Policy [the frequency at which the current risk assessment policy is reviewed and updated is defined;] and following [events that would require the current risk assessment policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current risk assessment procedures are reviewed and updated is defined;] and following [events that would require risk assessment procedures to be reviewed and updated are defined;].
RA-2	a: Categorize the system and information it processes, stores, and transmits; b: Document the security categorization results, including supporting rationale, in the security plan for the system; and c: Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
RA-3	a: Conduct a risk assessment, including: 1: Identifying threats to and vulnerabilities in the system; 2: Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and 3: Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information; b: Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments; c: Document risk assessment results in [one of "security and privacy plans"/"risk assessment report"/"{{ insert: param, ra-03_odp.02 }} "]; d: Review risk assessment results [the frequency to review risk assessment results is defined;]; e: Disseminate risk assessment results to [personnel or roles to whom risk assessment results are to be disseminated is/are defined;] ; and f: Update the risk assessment [the frequency to update the risk assessment is defined;] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.
RA-7	Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.
RA-8	Conduct privacy impact assessments for systems, programs, or other activities before: a: Developing or procuring information technology that processes personally identifiable information; and b: Initiating a new collection of personally identifiable information that: 1: Will be processed using information technology; and 2: Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.
SA-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] system and services acquisition policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the system and services acquisition policy and the associated system and services acquisition controls; b: Designate an [an official to manage the system and services acquisition policy and procedures is defined;] to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; and c: Review and update the current system and services acquisition: 1: Policy [the frequency at which the current system and services acquisition policy is reviewed and updated is defined;] and following [events that would require the current system and services acquisition policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current system and services acquisition procedures are reviewed and updated is defined;] and following [events that would require the system and services acquisition procedures to be reviewed and updated are defined;].
SA-2	a: Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; b: Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and c: Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.
SA-3	a: Acquire, develop, and manage the system using [system development life cycle is defined;] that incorporates information security and privacy considerations; b: Define and document information security and privacy roles and responsibilities throughout the system development life cycle; c: Identify individuals having information security and privacy roles and responsibilities; and d: Integrate the organizational information security and privacy risk management process into system development life cycle activities.
SA-3(2)	(a): Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service; and (b): Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments.
SA-4	Include the following requirements, descriptions, and criteria, explicitly or by reference, using [one or more of "standardized contract language"/"{{ insert: param, sa-04_odp.02 }} "] in the acquisition contract for the system, system component, or system service: a: Security and privacy functional requirements; b: Strength of mechanism requirements; c: Security and privacy assurance requirements; d: Controls needed to satisfy the security and privacy requirements. e: Security and privacy documentation requirements; f: Requirements for protecting security and privacy documentation; g: Description of the system development environment and environment in which the system is intended to operate; h: Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and i: Acceptance criteria.
SA-4(11)	Include [Privacy Act requirements for the operation of a system of records are defined;] in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.
SA-4(12)	(a): Include organizational data ownership requirements in the acquisition contract; and (b): Require all data to be removed from the contractor’s system and returned to the organization within [time frame to remove data from a contractor system and return it to the organization is defined;].
SA-8	Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [one of ].
SA-8(14)	Implement the security design principle of least privilege in [systems or system components that implement the security design principle of least privilege are defined;].
SA-8(19)	Implement the security design principle of continuous protection in [systems or system components that implement the security design principle of continuous protection are defined;].
SA-8(22)	Implement the security design principle of accountability and traceability in [one of ].
SA-8(28)	Implement the security design principle of acceptable security in [systems or system components that implement the security design principle of acceptable security are defined;].
SA-8(33)	Implement the privacy principle of minimization using [processes that implement the privacy principle of minimization are defined;].
SA-9	a: Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [controls to be employed by external system service providers are defined;]; b: Define and document organizational oversight and user roles and responsibilities with regard to external system services; and c: Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [processes, methods, and techniques employed to monitor control compliance by external service providers are defined;].
SA-9(1)	(a): Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and (b): Verify that the acquisition or outsourcing of dedicated information security services is approved by [personnel or roles that approve the acquisition or outsourcing of dedicated information security services is/are defined;].
SA-9(2)	Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [external system services that require the identification of functions, ports, protocols, and other services are defined;].
SA-9(5)	Restrict the location of [one or more of "information processing"/"information or data"/"system services"] to [locations where {{ insert: param, sa-09.05_odp.01 }} is/are to be restricted are defined;] based on [requirements or conditions for restricting the location of {{ insert: param, sa-09.05_odp.01 }} are defined;].
SA-9(6)	Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.
SA-9(7)	Provide the capability to check the integrity of information while it resides in the external system.
SA-9(8)	Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States.
SA-10	Require the developer of the system, system component, or system service to: a: Perform configuration management during system, component, or service [one or more of "design"/"development"/"implementation"/"operation"/"disposal"]; b: Document, manage, and control the integrity of changes to [configuration items under configuration management are defined;]; c: Implement only organization-approved changes to the system, component, or service; d: Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and e: Track security flaws and flaw resolution within the system, component, or service and report findings to [personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined;].
SA-10(7)	Require [one of ] to be included in the [one of ].
SA-11	Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to: a: Develop and implement a plan for ongoing security and privacy control assessments; b: Perform [one or more of "unit"/"integration"/"system"/"regression"] testing/evaluation [frequency at which to conduct {{ insert: param, sa-11_odp.01 }} testing/evaluation is defined;] at [depth and coverage of {{ insert: param, sa-11_odp.01 }} testing/evaluation is defined;]; c: Produce evidence of the execution of the assessment plan and the results of the testing and evaluation; d: Implement a verifiable flaw remediation process; and e: Correct flaws identified during testing and evaluation.
SA-11(5)	Require the developer of the system, system component, or system service to perform penetration testing: (a): At the following level of rigor: [one of ] ; and (b): Under the following constraints: [constraints of penetration testing are defined;].
SA-15	a: Require the developer of the system, system component, or system service to follow a documented development process that: 1: Explicitly addresses security and privacy requirements; 2: Identifies the standards and tools used in the development process; 3: Documents the specific tool options and tool configurations used in the development process; and 4: Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and b: Review the development process, standards, tools, tool options, and tool configurations [frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined;] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [one of ].
SA-15(12)	Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.
SA-17	Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: a: Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture; b: Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and c: Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.
SA-21	Require that the developer of [the system, systems component, or system service that the developer has access to is/are defined;]: a: Has appropriate access authorizations as determined by assigned [official government duties assigned to the developer are defined;] ; and b: Satisfies the following additional personnel screening criteria: [additional personnel screening criteria for the developer are defined;].
SC-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business-process-level"/"system-level"] system and communications protection policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls; b: Designate an [an official to manage the system and communications protection policy and procedures is defined;] to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; and c: Review and update the current system and communications protection: 1: Policy [the frequency at which the current system and communications protection policy is reviewed and updated is defined;] and following [events that would require the current system and communications protection policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current system and communications protection procedures are reviewed and updated is defined;] and following [events that would require the system and communications protection procedures to be reviewed and updated are defined;].
SC-7	a: Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b: Implement subnetworks for publicly accessible system components that are [one of "physically"/"logically"] separated from internal organizational networks; and c: Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
SC-7(8)	Route [internal communications traffic to be routed to external networks is defined;] to [external networks to which internal communications traffic is to be routed are defined;] through authenticated proxy servers at managed interfaces.
SC-7(10)	(a): Prevent the exfiltration of information; and (b): Conduct exfiltration tests [the frequency for conducting exfiltration tests is defined;].
SC-7(24)	For systems that process personally identifiable information: (a): Apply the following processing rules to data elements of personally identifiable information: [processing rules for systems that process personally identifiable information are defined;]; (b): Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system; (c): Document each processing exception; and (d): Review and remove exceptions that are no longer supported.
SC-8	Protect the [one or more of "confidentiality"/"integrity"] of transmitted information.
SC-12	Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [requirements for key generation, distribution, storage, access, and destruction are defined;].
SC-13	a: Determine the [cryptographic uses are defined;] ; and b: Implement the following types of cryptography required for each specified cryptographic use: [types of cryptography for each specified cryptographic use are defined;].
SC-16	Associate [one of ] with information exchanged between systems and between system components.
SC-16(1)	Verify the integrity of transmitted security and privacy attributes.
SC-28	Protect the [one or more of "confidentiality"/"integrity"] of the following information at rest: [information at rest requiring protection is defined;].
SC-28(1)	Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [system components or media requiring cryptographic protection is/are defined;]: [information requiring cryptographic protection is defined;].
SC-28(3)	Provide protected storage for cryptographic keys [one of "{{ insert: param, sc-28.03_odp.02 }} "/"hardware-protected key store"].
SI-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] system and information integrity policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls; b: Designate an [an official to manage the system and information integrity policy and procedures is defined;] to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and c: Review and update the current system and information integrity: 1: Policy [the frequency at which the current system and information integrity policy is reviewed and updated is defined;] and following [events that would require the current system and information integrity policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current system and information integrity procedures are reviewed and updated is defined;] and following [events that would require the system and information integrity procedures to be reviewed and updated are defined;].
SI-4	a: Monitor the system to detect: 1: Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [monitoring objectives to detect attacks and indicators of potential attacks on the system are defined;] ; and 2: Unauthorized local, network, and remote connections; b: Identify unauthorized use of the system through the following techniques and methods: [techniques and methods used to identify unauthorized use of the system are defined;]; c: Invoke internal monitoring capabilities or deploy monitoring devices: 1: Strategically within the system to collect organization-determined essential information; and 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization; d: Analyze detected events and anomalies; e: Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; f: Obtain legal opinion regarding system monitoring activities; and g: Provide [system monitoring information to be provided to personnel or roles is defined;] to [personnel or roles to whom system monitoring information is to be provided is/are defined;] [one or more of "as needed"/"{{ insert: param, si-04_odp.06 }} "].
SI-7	a: Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [one of ] ; and b: Take the following actions when unauthorized changes to the software, firmware, and information are detected: [one of ].
SI-10	Check the validity of the following information inputs: [information inputs to the system requiring validity checks are defined;].
SI-11	a: Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and b: Reveal error messages only to [personnel or roles to whom error messages are to be revealed is/are defined;].
SI-12	Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.
SI-12(1)	Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [elements of personally identifiable information being processed in the information life cycle are defined;].
SI-12(2)	Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: [one of ].
SI-12(3)	Use the following techniques to dispose of, destroy, or erase information following the retention period: [one of ].
SI-18	a: Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [one of ] ; and b: Correct or delete inaccurate or outdated personally identifiable information.
SI-18(1)	Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using [automated mechanisms used to correct or delete personally identifiable information that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-identified are defined;].
SI-18(3)	Collect personally identifiable information directly from the individual.
SI-18(4)	Correct or delete personally identifiable information upon request by individuals or their designated representatives.
SI-18(5)	Notify [recipients of personally identifiable information to be notified when the personally identifiable information has been corrected or deleted are defined;] and individuals that the personally identifiable information has been corrected or deleted.
SI-19	a: Remove the following elements of personally identifiable information from datasets: [elements of personally identifiable information to be removed from datasets are defined;] ; and b: Evaluate [the frequency at which to evaluate the effectiveness of de-identification is defined;] for effectiveness of de-identification.
SR-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] supply chain risk management policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls; b: Designate an [an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures is defined;] to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures; and c: Review and update the current supply chain risk management: 1: Policy [the frequency at which the current supply chain risk management policy is reviewed and updated is defined;] and following [events that require the current supply chain risk management policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current supply chain risk management procedure is reviewed and updated is defined;] and following [events that require the supply chain risk management procedures to be reviewed and updated are defined;].
SR-4	Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [systems, system components, and associated data that require valid provenance are defined;].

Removals

This overlay removes the following controls.

Control	Description
AC-2(8)	Create, activate, manage, and deactivate [system accounts that are dynamically created, activated, managed, and deactivated are defined;] dynamically.