Control Identifiers

• AC-1
  Policy and Procedures
• AC-2
  Account Management
• AC-2(1)
  Account Management | Automated...
• AC-2(2)
  Account Management | Automated...
• AC-2(3)
  Account Management | Disable Accounts
• AC-2(4)
  Account Management | Automated Audit Actions
• AC-2(5)
  Account Management | Inactivity Logout
• AC-2(6)
  Account Management | Dynamic...
• AC-2(7)
  Account Management | Privileged User Accounts
• AC-2(8)
  Account Management | Dynamic Account...
• AC-2(9)
  Account Management | Restrictions on...
• AC-13
  Supervision and Review — Access Control
• AC-2(11)
  Account Management | Usage Conditions
• AC-2(12)
  Account Management | Account...
• AC-2(13)
  Account Management | Disable...
• AC-3
  Access Enforcement
• AC-14(1)
  Permitted Actions Without...
• AC-3(2)
  Access Enforcement | Dual Authorization
• AC-3(3)
  Access Enforcement | Mandatory Access Control
• AC-3(4)
  Access Enforcement | Discretionary...
• AC-3(5)
  Access Enforcement |...
• AC-15
  Automated Marking
• AC-3(7)
  Access Enforcement | Role-based...
• AC-3(8)
  Access Enforcement | Revocation of...
• AC-3(9)
  Access Enforcement | Controlled Release
• AC-3(10)
  Access Enforcement | Audited...
• AC-3(11)
  Access Enforcement | Restrict Access...
• AC-3(12)
  Access Enforcement | Assert and...
• AC-3(13)
  Access Enforcement | Attribute-based...
• AC-3(14)
  Access Enforcement | Individual Access
• AC-3(15)
  Access Enforcement | Discretionary...
• AC-4
  Information Flow Enforcement
• AC-4(1)
  Information Flow Enforcement |...
• AC-4(2)
  Information Flow Enforcement |...
• AC-4(3)
  Information Flow Enforcement |...
• AC-4(4)
  Information Flow Enforcement | Flow...
• AC-4(5)
  Information Flow Enforcement |...
• AC-4(6)
  Information Flow Enforcement | Metadata
• AC-4(7)
  Information Flow Enforcement |...
• AC-4(8)
  Information Flow Enforcement |...
• AC-4(9)
  Information Flow Enforcement | Human Reviews
• AC-4(10)
  Information Flow Enforcement |...
• AC-4(11)
  Information Flow Enforcement |...
• AC-4(12)
  Information Flow Enforcement | Data...
• AC-4(13)
  Information Flow Enforcement |...
• AC-4(14)
  Information Flow Enforcement |...
• AC-4(15)
  Information Flow Enforcement |...
• AC-17(5)
  Remote Access | Monitoring for...
• AC-4(17)
  Information Flow Enforcement |...
• AC-17(7)
  Remote Access | Additional...
• AC-4(19)
  Information Flow Enforcement |...
• AC-4(20)
  Information Flow Enforcement |...
• AC-4(21)
  Information Flow Enforcement |...
• AC-4(22)
  Information Flow Enforcement | Access Only
• AC-4(23)
  Information Flow Enforcement |...
• AC-4(24)
  Information Flow Enforcement |...
• AC-4(25)
  Information Flow Enforcement | Data...
• AC-4(26)
  Information Flow Enforcement | Audit...
• AC-4(27)
  Information Flow Enforcement |...
• AC-4(28)
  Information Flow Enforcement |...
• AC-4(29)
  Information Flow Enforcement |...
• AC-4(30)
  Information Flow Enforcement |...
• AC-4(31)
  Information Flow Enforcement |...
• AC-4(32)
  Information Flow Enforcement |...
• AC-5
  Separation of Duties
• AC-6
  Least Privilege
• AC-6(1)
  Least Privilege | Authorize Access...
• AC-6(2)
  Least Privilege | Non-privileged...
• AC-6(3)
  Least Privilege | Network Access to...
• AC-6(4)
  Least Privilege | Separate Processing Domains
• AC-6(5)
  Least Privilege | Privileged Accounts
• AC-6(6)
  Least Privilege | Privileged Access...
• AC-6(7)
  Least Privilege | Review of User Privileges
• AC-6(8)
  Least Privilege | Privilege Levels...
• AC-6(9)
  Least Privilege | Log Use of...
• AC-6(10)
  Least Privilege | Prohibit...
• AC-7
  Unsuccessful Logon Attempts
• AC-17(8)
  Remote Access | Disable Nonsecure...
• AC-7(2)
  Unsuccessful Logon Attempts | Purge...
• AC-7(3)
  Unsuccessful Logon Attempts |...
• AC-7(4)
  Unsuccessful Logon Attempts | Use of...
• AC-8
  System Use Notification
• AC-9
  Previous Logon Notification
• AC-9(1)
  Previous Logon Notification |...
• AC-9(2)
  Previous Logon Notification |...
• AC-9(3)
  Previous Logon Notification |...
• AC-9(4)
  Previous Logon Notification |...
• AC-10
  Concurrent Session Control
• AC-11
  Device Lock
• AC-11(1)
  Device Lock | Pattern-hiding Displays
• AC-12
  Session Termination
• AC-12(1)
  Session Termination | User-initiated Logouts
• AC-12(2)
  Session Termination | Termination Message
• AC-12(3)
  Session Termination | Timeout Warning Message
• AC-18(2)
  Wireless Access | Monitoring...
• AC-14
  Permitted Actions Without...
• AC-19(1)
  Access Control for Mobile Devices |...
• AC-19(2)
  Access Control for Mobile Devices |...
• AC-16
  Security and Privacy Attributes
• AC-16(1)
  Security and Privacy Attributes |...
• AC-16(2)
  Security and Privacy Attributes |...
• AC-16(3)
  Security and Privacy Attributes |...
• AC-16(4)
  Security and Privacy Attributes |...
• AC-16(5)
  Security and Privacy Attributes |...
• AC-16(6)
  Security and Privacy Attributes |...
• AC-16(7)
  Security and Privacy Attributes |...
• AC-16(8)
  Security and Privacy Attributes |...
• AC-16(9)
  Security and Privacy Attributes |...
• AC-16(10)
  Security and Privacy Attributes |...
• AC-17
  Remote Access
• AC-17(1)
  Remote Access | Monitoring and Control
• AC-17(2)
  Remote Access | Protection of...
• AC-17(3)
  Remote Access | Managed Access Control Points
• AC-17(4)
  Remote Access | Privileged Commands...
• AC-19(3)
  Access Control for Mobile Devices |...
• AC-17(6)
  Remote Access | Protection of...
• AC-2(10)
  Account Management | Shared and...
• AC-3(1)
  Access Enforcement | Restricted...
• AC-17(9)
  Remote Access | Disconnect or Disable Access
• AC-17(10)
  Remote Access | Authenticate Remote Commands
• AC-18
  Wireless Access
• AC-18(1)
  Wireless Access | Authentication and...
• AC-3(6)
  Access Enforcement | Protection of...
• AC-18(3)
  Wireless Access | Disable Wireless Networking
• AC-18(4)
  Wireless Access | Restrict...
• AC-18(5)
  Wireless Access | Antennas and...
• AC-19
  Access Control for Mobile Devices
• AC-4(16)
  Information Flow Enforcement |...
• AC-4(18)
  Information Flow Enforcement |...
• AC-7(1)
  Unsuccessful Logon Attempts |...
• AC-19(4)
  Access Control for Mobile Devices |...
• AC-19(5)
  Access Control for Mobile Devices |...
• AC-20
  Use of External Systems
• AC-20(1)
  Use of External Systems | Limits on...
• AC-20(2)
  Use of External Systems | Portable...
• AC-20(3)
  Use of External Systems |...
• AC-20(4)
  Use of External Systems | Network...
• AC-20(5)
  Use of External Systems | Portable...
• AC-21
  Information Sharing
• AC-21(1)
  Information Sharing | Automated...
• AC-21(2)
  Information Sharing | Information...
• AC-22
  Publicly Accessible Content
• AC-23
  Data Mining Protection
• AC-24
  Access Control Decisions
• AC-24(1)
  Access Control Decisions | Transmit...
• AC-24(2)
  Access Control Decisions | No User...
• AC-25
  Reference Monitor
• AT-1
  Policy and Procedures
• AT-2
  Literacy Training and Awareness
• AT-2(1)
  Literacy Training and Awareness |...
• AT-2(2)
  Literacy Training and Awareness |...
• AT-2(3)
  Literacy Training and Awareness |...
• AT-2(4)
  Literacy Training and Awareness |...
• AT-2(5)
  Literacy Training and Awareness |...
• AT-2(6)
  Literacy Training and Awareness |...
• AT-3
  Role-based Training
• AT-3(1)
  Role-based Training | Environmental Controls
• AT-3(2)
  Role-based Training | Physical...
• AT-3(3)
  Role-based Training | Practical Exercises
• AT-3(4)
  Role-based Training | Suspicious...
• AT-3(5)
  Role-based Training | Processing...
• AT-4
  Training Records
• AT-5
  Contacts with Security Groups and...
• AT-6
  Training Feedback
• AU-1
  Policy and Procedures
• AU-2
  Event Logging
• AU-10(5)
  Non-repudiation | Digital Signatures
• AU-14(2)
  Session Audit | Capture and Record Content
• AU-15
  Alternate Audit Logging Capability
• AU-2(1)
  Event Logging | Compilation of Audit...
• AU-3
  Content of Audit Records
• AU-3(1)
  Content of Audit Records |...
• AU-2(2)
  Event Logging | Selection of Audit...
• AU-3(3)
  Content of Audit Records | Limit...
• AU-4
  Audit Log Storage Capacity
• AU-4(1)
  Audit Log Storage Capacity |...
• AU-5
  Response to Audit Logging Process Failures
• AU-5(1)
  Response to Audit Logging Process...
• AU-5(2)
  Response to Audit Logging Process...
• AU-5(3)
  Response to Audit Logging Process...
• AU-5(4)
  Response to Audit Logging Process...
• AU-5(5)
  Response to Audit Logging Process...
• AU-6
  Audit Record Review, Analysis, and Reporting
• AU-6(1)
  Audit Record Review, Analysis, and...
• AU-2(3)
  Event Logging | Reviews and Updates
• AU-6(3)
  Audit Record Review, Analysis, and...
• AU-6(4)
  Audit Record Review, Analysis, and...
• AU-6(5)
  Audit Record Review, Analysis, and...
• AU-6(6)
  Audit Record Review, Analysis, and...
• AU-6(7)
  Audit Record Review, Analysis, and...
• AU-6(8)
  Audit Record Review, Analysis, and...
• AU-6(9)
  Audit Record Review, Analysis, and...
• AU-2(4)
  Event Logging | Privileged Functions
• AU-7
  Audit Record Reduction and Report Generation
• AU-7(1)
  Audit Record Reduction and Report...
• AU-3(2)
  Content of Audit Records |...
• AU-8
  Time Stamps
• AU-6(10)
  Audit Record Review, Analysis, and...
• AU-6(2)
  Audit Record Review, Analysis, and...
• AU-9
  Protection of Audit Information
• AU-9(1)
  Protection of Audit Information |...
• AU-9(2)
  Protection of Audit Information |...
• AU-9(3)
  Protection of Audit Information |...
• AU-9(4)
  Protection of Audit Information |...
• AU-9(5)
  Protection of Audit Information |...
• AU-9(6)
  Protection of Audit Information |...
• AU-9(7)
  Protection of Audit Information |...
• AU-10
  Non-repudiation
• AU-10(1)
  Non-repudiation | Association of Identities
• AU-10(2)
  Non-repudiation | Validate Binding...
• AU-10(3)
  Non-repudiation | Chain of Custody
• AU-10(4)
  Non-repudiation | Validate Binding...
• AU-7(2)
  Audit Record Reduction and Report...
• AU-11
  Audit Record Retention
• AU-11(1)
  Audit Record Retention | Long-term...
• AU-12
  Audit Record Generation
• AU-12(1)
  Audit Record Generation |...
• AU-12(2)
  Audit Record Generation |...
• AU-12(3)
  Audit Record Generation | Changes by...
• AU-12(4)
  Audit Record Generation | Query...
• AU-13
  Monitoring for Information Disclosure
• AU-13(1)
  Monitoring for Information...
• AU-13(2)
  Monitoring for Information...
• AU-13(3)
  Monitoring for Information...
• AU-14
  Session Audit
• AU-14(1)
  Session Audit | System Start-up
• AU-8(1)
  Time Stamps | Synchronization with...
• AU-14(3)
  Session Audit | Remote Viewing and Listening
• AU-8(2)
  Time Stamps | Secondary...
• AU-16
  Cross-organizational Audit Logging
• AU-16(1)
  Cross-organizational Audit Logging |...
• AU-16(2)
  Cross-organizational Audit Logging |...
• AU-16(3)
  Cross-organizational Audit Logging |...
• CA-1
  Policy and Procedures
• CA-2
  Control Assessments
• CA-2(1)
  Control Assessments | Independent Assessors
• CA-2(2)
  Control Assessments | Specialized Assessments
• CA-2(3)
  Control Assessments | Leveraging...
• CA-3
  Information Exchange
• CA-3(1)
  Information Exchange | Unclassified...
• CA-3(2)
  Information Exchange | Classified...
• CA-3(3)
  Information Exchange | Unclassified...
• CA-3(4)
  Information Exchange | Connections...
• CA-3(5)
  Information Exchange | Restrictions...
• CA-3(6)
  Information Exchange | Transfer...
• CA-3(7)
  Information Exchange | Transitive...
• CA-4
  Security Certification
• CA-5
  Plan of Action and Milestones
• CA-5(1)
  Plan of Action and Milestones |...
• CA-6
  Authorization
• CA-6(1)
  Authorization | Joint Authorization...
• CA-6(2)
  Authorization | Joint Authorization...
• CA-7
  Continuous Monitoring
• CA-7(1)
  Continuous Monitoring | Independent...
• CA-7(2)
  Continuous Monitoring | Types of Assessments
• CA-7(3)
  Continuous Monitoring | Trend Analyses
• CA-7(4)
  Continuous Monitoring | Risk Monitoring
• CA-7(5)
  Continuous Monitoring | Consistency Analysis
• CA-7(6)
  Continuous Monitoring | Automation...
• CA-8
  Penetration Testing
• CA-8(1)
  Penetration Testing | Independent...
• CA-8(2)
  Penetration Testing | Red Team Exercises
• CA-8(3)
  Penetration Testing | Facility...
• CA-9
  Internal System Connections
• CA-9(1)
  Internal System Connections |...
• CM-1
  Policy and Procedures
• CM-2
  Baseline Configuration
• CM-11(1)
  User-installed Software | Alerts for...
• CM-2(2)
  Baseline Configuration | Automation...
• CM-2(3)
  Baseline Configuration | Retention...
• CM-2(1)
  Baseline Configuration | Reviews and Updates
• CM-2(4)
  Baseline Configuration |...
• CM-2(6)
  Baseline Configuration | Development...
• CM-2(7)
  Baseline Configuration | Configure...
• CM-3
  Configuration Change Control
• CM-3(1)
  Configuration Change Control |...
• CM-3(2)
  Configuration Change Control |...
• CM-3(3)
  Configuration Change Control |...
• CM-3(4)
  Configuration Change Control |...
• CM-3(5)
  Configuration Change Control |...
• CM-3(6)
  Configuration Change Control |...
• CM-3(7)
  Configuration Change Control |...
• CM-3(8)
  Configuration Change Control |...
• CM-4
  Impact Analyses
• CM-4(1)
  Impact Analyses | Separate Test Environments
• CM-4(2)
  Impact Analyses | Verification of Controls
• CM-5
  Access Restrictions for Change
• CM-5(1)
  Access Restrictions for Change |...
• CM-2(5)
  Baseline Configuration | Authorized Software
• CM-5(2)
  Access Restrictions for Change |...
• CM-5(4)
  Access Restrictions for Change |...
• CM-5(5)
  Access Restrictions for Change |...
• CM-5(6)
  Access Restrictions for Change |...
• CM-5(3)
  Access Restrictions for Change |...
• CM-6
  Configuration Settings
• CM-6(1)
  Configuration Settings | Automated...
• CM-6(2)
  Configuration Settings | Respond to...
• CM-5(7)
  Access Restrictions for Change |...
• CM-6(3)
  Configuration Settings |...
• CM-7
  Least Functionality
• CM-7(1)
  Least Functionality | Periodic Review
• CM-7(2)
  Least Functionality | Prevent...
• CM-7(3)
  Least Functionality | Registration Compliance
• CM-7(4)
  Least Functionality | Unauthorized...
• CM-7(5)
  Least Functionality | Authorized...
• CM-7(6)
  Least Functionality | Confined...
• CM-7(7)
  Least Functionality | Code Execution...
• CM-7(8)
  Least Functionality | Binary or...
• CM-7(9)
  Least Functionality | Prohibiting...
• CM-8
  System Component Inventory
• CM-8(1)
  System Component Inventory | Updates...
• CM-8(2)
  System Component Inventory |...
• CM-8(3)
  System Component Inventory |...
• CM-8(4)
  System Component Inventory |...
• CM-6(4)
  Configuration Settings | Conformance...
• CM-8(6)
  System Component Inventory |...
• CM-8(7)
  System Component Inventory |...
• CM-8(8)
  System Component Inventory |...
• CM-8(9)
  System Component Inventory |...
• CM-9
  Configuration Management Plan
• CM-9(1)
  Configuration Management Plan |...
• CM-10
  Software Usage Restrictions
• CM-10(1)
  Software Usage Restrictions |...
• CM-11
  User-installed Software
• CM-8(5)
  System Component Inventory | No...
• CM-11(2)
  User-installed Software | Software...
• CM-11(3)
  User-installed Software | Automated...
• CM-12
  Information Location
• CM-12(1)
  Information Location | Automated...
• CM-13
  Data Action Mapping
• CM-14
  Signed Components
• CP-1
  Policy and Procedures
• CP-2
  Contingency Plan
• CP-2(1)
  Contingency Plan | Coordinate with...
• CP-2(2)
  Contingency Plan | Capacity Planning
• CP-2(3)
  Contingency Plan | Resume Mission...
• CP-10(1)
  System Recovery and Reconstitution |...
• CP-2(5)
  Contingency Plan | Continue Mission...
• CP-2(6)
  Contingency Plan | Alternate...
• CP-2(7)
  Contingency Plan | Coordinate with...
• CP-2(8)
  Contingency Plan | Identify Critical Assets
• CP-3
  Contingency Training
• CP-3(1)
  Contingency Training | Simulated Events
• CP-3(2)
  Contingency Training | Mechanisms...
• CP-4
  Contingency Plan Testing
• CP-4(1)
  Contingency Plan Testing |...
• CP-4(2)
  Contingency Plan Testing | Alternate...
• CP-4(3)
  Contingency Plan Testing | Automated Testing
• CP-4(4)
  Contingency Plan Testing | Full...
• CP-4(5)
  Contingency Plan Testing | Self-challenge
• CP-10(3)
  System Recovery and Reconstitution |...
• CP-6
  Alternate Storage Site
• CP-6(1)
  Alternate Storage Site | Separation...
• CP-6(2)
  Alternate Storage Site | Recovery...
• CP-6(3)
  Alternate Storage Site | Accessibility
• CP-7
  Alternate Processing Site
• CP-7(1)
  Alternate Processing Site |...
• CP-7(2)
  Alternate Processing Site | Accessibility
• CP-7(3)
  Alternate Processing Site | Priority...
• CP-7(4)
  Alternate Processing Site |...
• CP-10(5)
  System Recovery and Reconstitution |...
• CP-7(6)
  Alternate Processing Site |...
• CP-8
  Telecommunications Services
• CP-8(1)
  Telecommunications Services |...
• CP-8(2)
  Telecommunications Services | Single...
• CP-8(3)
  Telecommunications Services |...
• CP-8(4)
  Telecommunications Services |...
• CP-8(5)
  Telecommunications Services |...
• CP-9
  System Backup
• CP-9(1)
  System Backup | Testing for...
• CP-9(2)
  System Backup | Test Restoration...
• CP-9(3)
  System Backup | Separate Storage for...
• CP-2(4)
  Contingency Plan | Resume All...
• CP-9(5)
  System Backup | Transfer to...
• CP-9(6)
  System Backup | Redundant Secondary System
• CP-9(7)
  System Backup | Dual Authorization...
• CP-9(8)
  System Backup | Cryptographic Protection
• CP-10
  System Recovery and Reconstitution
• CP-5
  Contingency Plan Update
• CP-10(2)
  System Recovery and Reconstitution |...
• CP-7(5)
  Alternate Processing Site |...
• CP-10(4)
  System Recovery and Reconstitution |...
• CP-9(4)
  System Backup | Protection from...
• CP-10(6)
  System Recovery and Reconstitution |...
• CP-11
  Alternate Communications Protocols
• CP-12
  Safe Mode
• CP-13
  Alternative Security Mechanisms
• IA-1
  Policy and Procedures
• IA-2
  Identification and Authentication...
• IA-2(1)
  Identification and Authentication...
• IA-2(2)
  Identification and Authentication...
• IA-2(11)
  Identification and Authentication...
• IA-2(3)
  Identification and Authentication...
• IA-2(5)
  Identification and Authentication...
• IA-2(6)
  Identification and Authentication...
• IA-2(4)
  Identification and Authentication...
• IA-2(8)
  Identification and Authentication...
• IA-2(7)
  Identification and Authentication...
• IA-2(10)
  Identification and Authentication...
• IA-2(9)
  Identification and Authentication...
• IA-2(12)
  Identification and Authentication...
• IA-2(13)
  Identification and Authentication...
• IA-3
  Device Identification and Authentication
• IA-3(1)
  Device Identification and...
• IA-3(2)
  Device Identification and...
• IA-3(3)
  Device Identification and...
• IA-3(4)
  Device Identification and...
• IA-4
  Identifier Management
• IA-4(1)
  Identifier Management | Prohibit...
• IA-4(2)
  Identifier Management | Supervisor...
• IA-4(3)
  Identifier Management | Multiple...
• IA-4(4)
  Identifier Management | Identify User Status
• IA-4(5)
  Identifier Management | Dynamic Management
• IA-4(6)
  Identifier Management |...
• IA-4(7)
  Identifier Management | In-person...
• IA-4(8)
  Identifier Management | Pairwise...
• IA-4(9)
  Identifier Management | Attribute...
• IA-5
  Authenticator Management
• IA-5(1)
  Authenticator Management |...
• IA-5(2)
  Authenticator Management | Public...
• IA-5(11)
  Authenticator Management | Hardware...
• IA-5(3)
  Authenticator Management | In-person...
• IA-5(5)
  Authenticator Management | Change...
• IA-5(6)
  Authenticator Management |...
• IA-5(7)
  Authenticator Management | No...
• IA-5(8)
  Authenticator Management | Multiple...
• IA-5(9)
  Authenticator Management | Federated...
• IA-5(10)
  Authenticator Management | Dynamic...
• IA-5(4)
  Authenticator Management | Automated...
• IA-5(12)
  Authenticator Management | Biometric...
• IA-5(13)
  Authenticator Management |...
• IA-5(14)
  Authenticator Management | Managing...
• IA-5(15)
  Authenticator Management |...
• IA-5(16)
  Authenticator Management | In-person...
• IA-5(17)
  Authenticator Management |...
• IA-5(18)
  Authenticator Management | Password Managers
• IA-6
  Authentication Feedback
• IA-7
  Cryptographic Module Authentication
• IA-8
  Identification and Authentication...
• IA-8(1)
  Identification and Authentication...
• IA-8(2)
  Identification and Authentication...
• IA-8(3)
  Identification and Authentication...
• IA-8(4)
  Identification and Authentication...
• IA-8(5)
  Identification and Authentication...
• IA-8(6)
  Identification and Authentication...
• IA-9
  Service Identification and Authentication
• IA-9(1)
  Service Identification and...
• IA-9(2)
  Service Identification and...
• IA-10
  Adaptive Authentication
• IA-11
  Re-authentication
• IA-12
  Identity Proofing
• IA-12(1)
  Identity Proofing | Supervisor Authorization
• IA-12(2)
  Identity Proofing | Identity Evidence
• IA-12(3)
  Identity Proofing | Identity...
• IA-12(4)
  Identity Proofing | In-person...
• IA-12(5)
  Identity Proofing | Address Confirmation
• IA-12(6)
  Identity Proofing | Accept...
• IR-1
  Policy and Procedures
• IR-2
  Incident Response Training
• IR-2(1)
  Incident Response Training | Simulated Events
• IR-2(2)
  Incident Response Training |...
• IR-2(3)
  Incident Response Training | Breach
• IR-3
  Incident Response Testing
• IR-3(1)
  Incident Response Testing | Automated Testing
• IR-3(2)
  Incident Response Testing |...
• IR-3(3)
  Incident Response Testing |...
• IR-4
  Incident Handling
• IR-4(1)
  Incident Handling | Automated...
• IR-4(2)
  Incident Handling | Dynamic Reconfiguration
• IR-4(3)
  Incident Handling | Continuity of Operations
• IR-4(4)
  Incident Handling | Information Correlation
• IR-4(5)
  Incident Handling | Automatic...
• IR-4(6)
  Incident Handling | Insider Threats
• IR-4(7)
  Incident Handling | Insider Threats...
• IR-4(8)
  Incident Handling | Correlation with...
• IR-4(9)
  Incident Handling | Dynamic Response...
• IR-4(10)
  Incident Handling | Supply Chain Coordination
• IR-4(11)
  Incident Handling | Integrated...
• IR-4(12)
  Incident Handling | Malicious Code...
• IR-4(13)
  Incident Handling | Behavior Analysis
• IR-4(14)
  Incident Handling | Security...
• IR-4(15)
  Incident Handling | Public Relations...
• IR-5
  Incident Monitoring
• IR-5(1)
  Incident Monitoring | Automated...
• IR-6
  Incident Reporting
• IR-6(1)
  Incident Reporting | Automated Reporting
• IR-6(2)
  Incident Reporting | Vulnerabilities...
• IR-6(3)
  Incident Reporting | Supply Chain...
• IR-7
  Incident Response Assistance
• IR-7(1)
  Incident Response Assistance |...
• IR-7(2)
  Incident Response Assistance |...
• IR-8
  Incident Response Plan
• IR-8(1)
  Incident Response Plan | Breaches
• IR-9
  Information Spillage Response
• IR-10
  Integrated Information Security Analysis Team
• IR-9(2)
  Information Spillage Response | Training
• IR-9(3)
  Information Spillage Response |...
• IR-9(4)
  Information Spillage Response |...
• IR-9(1)
  Information Spillage Response |...
• MA-1
  Policy and Procedures
• MA-2
  Controlled Maintenance
• MA-2(1)
  Controlled Maintenance | Record Content
• MA-2(2)
  Controlled Maintenance | Automated...
• MA-3
  Maintenance Tools
• MA-3(1)
  Maintenance Tools | Inspect Tools
• MA-3(2)
  Maintenance Tools | Inspect Media
• MA-3(3)
  Maintenance Tools | Prevent...
• MA-3(4)
  Maintenance Tools | Restricted Tool Use
• MA-3(5)
  Maintenance Tools | Execution with Privilege
• MA-3(6)
  Maintenance Tools | Software Updates...
• MA-4
  Nonlocal Maintenance
• MA-4(1)
  Nonlocal Maintenance | Logging and Review
• MA-4(2)
  Nonlocal Maintenance | Document...
• MA-4(3)
  Nonlocal Maintenance | Comparable...
• MA-4(4)
  Nonlocal Maintenance |...
• MA-4(5)
  Nonlocal Maintenance | Approvals and...
• MA-4(6)
  Nonlocal Maintenance | Cryptographic...
• MA-4(7)
  Nonlocal Maintenance | Disconnect...
• MA-5
  Maintenance Personnel
• MA-5(1)
  Maintenance Personnel | Individuals...
• MA-5(2)
  Maintenance Personnel | Security...
• MA-5(3)
  Maintenance Personnel | Citizenship...
• MA-5(4)
  Maintenance Personnel | Foreign Nationals
• MA-5(5)
  Maintenance Personnel | Non-system...
• MA-6
  Timely Maintenance
• MA-6(1)
  Timely Maintenance | Preventive Maintenance
• MA-6(2)
  Timely Maintenance | Predictive Maintenance
• MA-6(3)
  Timely Maintenance | Automated...
• MA-7
  Field Maintenance
• MP-1
  Policy and Procedures
• MP-2
  Media Access
• MP-2(1)
  Media Access | Automated Restricted Access
• MP-2(2)
  Media Access | Cryptographic Protection
• MP-3
  Media Marking
• MP-4
  Media Storage
• MP-4(1)
  Media Storage | Cryptographic Protection
• MP-4(2)
  Media Storage | Automated Restricted Access
• MP-5
  Media Transport
• MP-5(1)
  Media Transport | Protection Outside...
• MP-5(2)
  Media Transport | Documentation of Activities
• MP-5(3)
  Media Transport | Custodians
• MP-5(4)
  Media Transport | Cryptographic Protection
• MP-6
  Media Sanitization
• MP-6(1)
  Media Sanitization | Review,...
• MP-6(2)
  Media Sanitization | Equipment Testing
• MP-6(3)
  Media Sanitization | Nondestructive...
• MP-6(4)
  Media Sanitization | Controlled...
• MP-6(5)
  Media Sanitization | Classified Information
• MP-6(6)
  Media Sanitization | Media Destruction
• MP-6(7)
  Media Sanitization | Dual Authorization
• MP-6(8)
  Media Sanitization | Remote Purging...
• MP-7
  Media Use
• MP-7(1)
  Media Use | Prohibit Use Without Owner
• MP-7(2)
  Media Use | Prohibit Use of...
• MP-8
  Media Downgrading
• MP-8(1)
  Media Downgrading | Documentation of Process
• MP-8(2)
  Media Downgrading | Equipment Testing
• MP-8(3)
  Media Downgrading | Controlled...
• MP-8(4)
  Media Downgrading | Classified Information
• PE-1
  Policy and Procedures
• PE-2
  Physical Access Authorizations
• PE-2(1)
  Physical Access Authorizations |...
• PE-2(2)
  Physical Access Authorizations | Two...
• PE-2(3)
  Physical Access Authorizations |...
• PE-3
  Physical Access Control
• PE-3(1)
  Physical Access Control | System Access
• PE-3(2)
  Physical Access Control | Facility...
• PE-3(3)
  Physical Access Control | Continuous Guards
• PE-3(4)
  Physical Access Control | Lockable Casings
• PE-3(5)
  Physical Access Control | Tamper Protection
• PE-10(1)
  Emergency Shutoff | Accidental and...
• PE-3(7)
  Physical Access Control | Physical Barriers
• PE-3(8)
  Physical Access Control | Access...
• PE-4
  Access Control for Transmission
• PE-5
  Access Control for Output Devices
• PE-13(3)
  Fire Protection | Automatic Fire Suppression
• PE-5(2)
  Access Control for Output Devices |...
• PE-18(1)
  Location of System Components | Facility Site
• PE-6
  Monitoring Physical Access
• PE-6(1)
  Monitoring Physical Access |...
• PE-6(2)
  Monitoring Physical Access |...
• PE-6(3)
  Monitoring Physical Access | Video...
• PE-6(4)
  Monitoring Physical Access |...
• PE-3(6)
  Physical Access Control | Facility...
• PE-8
  Visitor Access Records
• PE-8(1)
  Visitor Access Records | Automated...
• PE-5(1)
  Access Control for Output Devices |...
• PE-8(3)
  Visitor Access Records | Limit...
• PE-9
  Power Equipment and Cabling
• PE-9(1)
  Power Equipment and Cabling |...
• PE-9(2)
  Power Equipment and Cabling |...
• PE-10
  Emergency Shutoff
• PE-5(3)
  Access Control for Output Devices |...
• PE-11
  Emergency Power
• PE-11(1)
  Emergency Power | Alternate Power...
• PE-11(2)
  Emergency Power | Alternate Power...
• PE-12
  Emergency Lighting
• PE-12(1)
  Emergency Lighting | Essential...
• PE-13
  Fire Protection
• PE-13(1)
  Fire Protection | Detection Systems...
• PE-13(2)
  Fire Protection | Suppression...
• PE-7
  Visitor Control
• PE-13(4)
  Fire Protection | Inspections
• PE-14
  Environmental Controls
• PE-14(1)
  Environmental Controls | Automatic Controls
• PE-14(2)
  Environmental Controls | Monitoring...
• PE-15
  Water Damage Protection
• PE-15(1)
  Water Damage Protection | Automation Support
• PE-16
  Delivery and Removal
• PE-17
  Alternate Work Site
• PE-18
  Location of System Components
• PE-8(2)
  Visitor Access Records | Physical...
• PE-19
  Information Leakage
• PE-19(1)
  Information Leakage | National...
• PE-20
  Asset Monitoring and Tracking
• PE-21
  Electromagnetic Pulse Protection
• PE-22
  Component Marking
• PE-23
  Facility Location
• PL-1
  Policy and Procedures
• PL-2
  System Security and Privacy Plans
• PL-2(1)
  System Security and Privacy Plans |...
• PL-2(2)
  System Security and Privacy Plans |...
• PL-2(3)
  System Security and Privacy Plans |...
• PL-3
  System Security Plan Update
• PL-4
  Rules of Behavior
• PL-4(1)
  Rules of Behavior | Social Media and...
• PL-5
  Privacy Impact Assessment
• PL-6
  Security-related Activity Planning
• PL-7
  Concept of Operations
• PL-8
  Security and Privacy Architectures
• PL-8(1)
  Security and Privacy Architectures |...
• PL-8(2)
  Security and Privacy Architectures |...
• PL-9
  Central Management
• PL-10
  Baseline Selection
• PL-11
  Baseline Tailoring
• PM-1
  Information Security Program Plan
• PM-2
  Information Security Program Leadership Role
• PM-3
  Information Security and Privacy Resources
• PM-4
  Plan of Action and Milestones Process
• PM-5
  System Inventory
• PM-5(1)
  System Inventory | Inventory of...
• PM-6
  Measures of Performance
• PM-7
  Enterprise Architecture
• PM-7(1)
  Enterprise Architecture | Offloading
• PM-8
  Critical Infrastructure Plan
• PM-9
  Risk Management Strategy
• PM-10
  Authorization Process
• PM-11
  Mission and Business Process Definition
• PM-12
  Insider Threat Program
• PM-13
  Security and Privacy Workforce
• PM-14
  Testing, Training, and Monitoring
• PM-15
  Security and Privacy Groups and Associations
• PM-16
  Threat Awareness Program
• PM-16(1)
  Threat Awareness Program | Automated...
• PM-17
  Protecting Controlled Unclassified...
• PM-18
  Privacy Program Plan
• PM-19
  Privacy Program Leadership Role
• PM-20
  Dissemination of Privacy Program Information
• PM-20(1)
  Dissemination of Privacy Program...
• PM-21
  Accounting of Disclosures
• PM-22
  Personally Identifiable Information...
• PM-23
  Data Governance Body
• PM-24
  Data Integrity Board
• PM-25
  Minimization of Personally...
• PM-26
  Complaint Management
• PM-27
  Privacy Reporting
• PM-28
  Risk Framing
• PM-29
  Risk Management Program Leadership Roles
• PM-30
  Supply Chain Risk Management Strategy
• PM-30(1)
  Supply Chain Risk Management...
• PM-31
  Continuous Monitoring Strategy
• PM-32
  Purposing
• PS-1
  Policy and Procedures
• PS-2
  Position Risk Designation
• PS-3
  Personnel Screening
• PS-3(1)
  Personnel Screening | Classified Information
• PS-3(2)
  Personnel Screening | Formal Indoctrination
• PS-3(3)
  Personnel Screening | Information...
• PS-3(4)
  Personnel Screening | Citizenship...
• PS-4
  Personnel Termination
• PS-4(1)
  Personnel Termination |...
• PS-4(2)
  Personnel Termination | Automated Actions
• PS-5
  Personnel Transfer
• PS-6
  Access Agreements
• PS-6(1)
  Access Agreements | Information...
• PS-6(2)
  Access Agreements | Classified...
• PS-6(3)
  Access Agreements | Post-employment...
• PS-7
  External Personnel Security
• PS-8
  Personnel Sanctions
• PS-9
  Position Descriptions
• PT-1
  Policy and Procedures
• PT-2
  Authority to Process Personally...
• PT-2(1)
  Authority to Process Personally...
• PT-2(2)
  Authority to Process Personally...
• PT-3
  Personally Identifiable Information...
• PT-3(1)
  Personally Identifiable Information...
• PT-3(2)
  Personally Identifiable Information...
• PT-4
  Consent
• PT-4(1)
  Consent | Tailored Consent
• PT-4(2)
  Consent | Just-in-time Consent
• PT-4(3)
  Consent | Revocation
• PT-5
  Privacy Notice
• PT-5(1)
  Privacy Notice | Just-in-time Notice
• PT-5(2)
  Privacy Notice | Privacy Act Statements
• PT-6
  System of Records Notice
• PT-6(1)
  System of Records Notice | Routine Uses
• PT-6(2)
  System of Records Notice | Exemption Rules
• PT-7
  Specific Categories of Personally...
• PT-7(1)
  Specific Categories of Personally...
• PT-7(2)
  Specific Categories of Personally...
• PT-8
  Computer Matching Requirements
• RA-1
  Policy and Procedures
• RA-2
  Security Categorization
• RA-2(1)
  Security Categorization |...
• RA-3
  Risk Assessment
• RA-3(1)
  Risk Assessment | Supply Chain Risk...
• RA-3(2)
  Risk Assessment | Use of All-source...
• RA-3(3)
  Risk Assessment | Dynamic Threat Awareness
• RA-3(4)
  Risk Assessment | Predictive Cyber Analytics
• RA-4
  Risk Assessment Update
• RA-5
  Vulnerability Monitoring and Scanning
• RA-5(1)
  Vulnerability Monitoring and...
• RA-5(2)
  Vulnerability Monitoring and...
• RA-5(3)
  Vulnerability Monitoring and...
• RA-5(4)
  Vulnerability Monitoring and...
• RA-5(5)
  Vulnerability Monitoring and...
• RA-5(6)
  Vulnerability Monitoring and...
• RA-5(7)
  Vulnerability Monitoring and...
• RA-5(8)
  Vulnerability Monitoring and...
• RA-5(9)
  Vulnerability Monitoring and...
• RA-5(10)
  Vulnerability Monitoring and...
• RA-5(11)
  Vulnerability Monitoring and...
• RA-6
  Technical Surveillance Countermeasures Survey
• RA-7
  Risk Response
• RA-8
  Privacy Impact Assessments
• RA-9
  Criticality Analysis
• RA-10
  Threat Hunting
• SA-1
  Policy and Procedures
• SA-2
  Allocation of Resources
• SA-3
  System Development Life Cycle
• SA-3(1)
  System Development Life Cycle |...
• SA-3(2)
  System Development Life Cycle | Use...
• SA-3(3)
  System Development Life Cycle |...
• SA-4
  Acquisition Process
• SA-4(1)
  Acquisition Process | Functional...
• SA-4(2)
  Acquisition Process | Design and...
• SA-4(3)
  Acquisition Process | Development...
• SA-12
  Supply Chain Protection
• SA-4(5)
  Acquisition Process | System,...
• SA-4(6)
  Acquisition Process | Use of...
• SA-4(7)
  Acquisition Process | NIAP-approved...
• SA-4(8)
  Acquisition Process | Continuous...
• SA-4(9)
  Acquisition Process | Functions,...
• SA-4(10)
  Acquisition Process | Use of...
• SA-4(11)
  Acquisition Process | System of Records
• SA-4(12)
  Acquisition Process | Data Ownership
• SA-5
  System Documentation
• SA-12(1)
  Supply Chain Protection |...
• SA-12(10)
  Supply Chain Protection | Validate...
• SA-12(11)
  Supply Chain Protection |...
• SA-12(12)
  Supply Chain Protection |...
• SA-12(13)
  Supply Chain Protection | Critical...
• SA-12(14)
  Supply Chain Protection | Identity...
• SA-12(15)
  Supply Chain Protection | Processes...
• SA-8
  Security and Privacy Engineering Principles
• SA-8(1)
  Security and Privacy Engineering...
• SA-8(2)
  Security and Privacy Engineering...
• SA-8(3)
  Security and Privacy Engineering...
• SA-8(4)
  Security and Privacy Engineering...
• SA-8(5)
  Security and Privacy Engineering...
• SA-8(6)
  Security and Privacy Engineering...
• SA-8(7)
  Security and Privacy Engineering...
• SA-8(8)
  Security and Privacy Engineering...
• SA-8(9)
  Security and Privacy Engineering...
• SA-8(10)
  Security and Privacy Engineering...
• SA-8(11)
  Security and Privacy Engineering...
• SA-8(12)
  Security and Privacy Engineering...
• SA-8(13)
  Security and Privacy Engineering...
• SA-8(14)
  Security and Privacy Engineering...
• SA-8(15)
  Security and Privacy Engineering...
• SA-8(16)
  Security and Privacy Engineering...
• SA-8(17)
  Security and Privacy Engineering...
• SA-8(18)
  Security and Privacy Engineering...
• SA-8(19)
  Security and Privacy Engineering...
• SA-8(20)
  Security and Privacy Engineering...
• SA-8(21)
  Security and Privacy Engineering...
• SA-8(22)
  Security and Privacy Engineering...
• SA-8(23)
  Security and Privacy Engineering...
• SA-8(24)
  Security and Privacy Engineering...
• SA-8(25)
  Security and Privacy Engineering...
• SA-8(26)
  Security and Privacy Engineering...
• SA-8(27)
  Security and Privacy Engineering...
• SA-8(28)
  Security and Privacy Engineering...
• SA-8(29)
  Security and Privacy Engineering...
• SA-8(30)
  Security and Privacy Engineering...
• SA-8(31)
  Security and Privacy Engineering...
• SA-8(32)
  Security and Privacy Engineering...
• SA-8(33)
  Security and Privacy Engineering...
• SA-9
  External System Services
• SA-9(1)
  External System Services | Risk...
• SA-9(2)
  External System Services |...
• SA-9(3)
  External System Services | Establish...
• SA-9(4)
  External System Services |...
• SA-9(5)
  External System Services |...
• SA-9(6)
  External System Services |...
• SA-9(7)
  External System Services |...
• SA-9(8)
  External System Services |...
• SA-10
  Developer Configuration Management
• SA-10(1)
  Developer Configuration Management |...
• SA-10(2)
  Developer Configuration Management |...
• SA-10(3)
  Developer Configuration Management |...
• SA-10(4)
  Developer Configuration Management |...
• SA-10(5)
  Developer Configuration Management |...
• SA-10(6)
  Developer Configuration Management |...
• SA-10(7)
  Developer Configuration Management |...
• SA-11
  Developer Testing and Evaluation
• SA-11(1)
  Developer Testing and Evaluation |...
• SA-11(2)
  Developer Testing and Evaluation |...
• SA-11(3)
  Developer Testing and Evaluation |...
• SA-11(4)
  Developer Testing and Evaluation |...
• SA-11(5)
  Developer Testing and Evaluation |...
• SA-11(6)
  Developer Testing and Evaluation |...
• SA-11(7)
  Developer Testing and Evaluation |...
• SA-11(8)
  Developer Testing and Evaluation |...
• SA-11(9)
  Developer Testing and Evaluation |...
• SA-12(2)
  Supply Chain Protection | Supplier Reviews
• SA-12(3)
  Supply Chain Protection | Trusted...
• SA-12(4)
  Supply Chain Protection | Diversity...
• SA-12(5)
  Supply Chain Protection | Limitation of Harm
• SA-12(6)
  Supply Chain Protection | Minimizing...
• SA-12(7)
  Supply Chain Protection |...
• SA-12(8)
  Supply Chain Protection | Use of...
• SA-12(9)
  Supply Chain Protection | Operations Security
• SA-13
  Trustworthiness
• SA-14
  Criticality Analysis
• SA-14(1)
  Criticality Analysis | Critical...
• SA-15(4)
  Development Process, Standards, and...
• SA-15(9)
  Development Process, Standards, and...
• SA-18
  Tamper Resistance and Detection
• SA-18(1)
  Tamper Resistance and Detection |...
• SA-18(2)
  Tamper Resistance and Detection |...
• SA-19
  Component Authenticity
• SA-19(1)
  Component Authenticity |...
• SA-19(2)
  Component Authenticity |...
• SA-15
  Development Process, Standards, and Tools
• SA-15(1)
  Development Process, Standards, and...
• SA-15(2)
  Development Process, Standards, and...
• SA-15(3)
  Development Process, Standards, and...
• SA-19(3)
  Component Authenticity | Component Disposal
• SA-15(5)
  Development Process, Standards, and...
• SA-15(6)
  Development Process, Standards, and...
• SA-15(7)
  Development Process, Standards, and...
• SA-15(8)
  Development Process, Standards, and...
• SA-19(4)
  Component Authenticity |...
• SA-15(10)
  Development Process, Standards, and...
• SA-15(11)
  Development Process, Standards, and...
• SA-15(12)
  Development Process, Standards, and...
• SA-16
  Developer-provided Training
• SA-17
  Developer Security and Privacy...
• SA-17(1)
  Developer Security and Privacy...
• SA-17(2)
  Developer Security and Privacy...
• SA-17(3)
  Developer Security and Privacy...
• SA-17(4)
  Developer Security and Privacy...
• SA-17(5)
  Developer Security and Privacy...
• SA-17(6)
  Developer Security and Privacy...
• SA-17(7)
  Developer Security and Privacy...
• SA-17(8)
  Developer Security and Privacy...
• SA-17(9)
  Developer Security and Privacy...
• SA-21(1)
  Developer Screening | Validation of Screening
• SA-22(1)
  Unsupported System Components |...
• SA-4(4)
  Acquisition Process | Assignment of...
• SA-5(1)
  System Documentation | Functional...
• SA-5(2)
  System Documentation |...
• SA-5(3)
  System Documentation | High-level Design
• SA-5(4)
  System Documentation | Low-level Design
• SA-5(5)
  System Documentation | Source Code
• SA-20
  Customized Development of Critical Components
• SA-21
  Developer Screening
• SA-6
  Software Usage Restrictions
• SA-22
  Unsupported System Components
• SA-7
  User-installed Software
• SA-23
  Specialization
• SC-1
  Policy and Procedures
• SC-2
  Separation of System and User Functionality
• SC-2(1)
  Separation of System and User...
• SC-2(2)
  Separation of System and User...
• SC-3
  Security Function Isolation
• SC-3(1)
  Security Function Isolation |...
• SC-3(2)
  Security Function Isolation | Access...
• SC-3(3)
  Security Function Isolation |...
• SC-3(4)
  Security Function Isolation | Module...
• SC-3(5)
  Security Function Isolation |...
• SC-4
  Information in Shared System Resources
• SC-12(4)
  Cryptographic Key Establishment and...
• SC-4(2)
  Information in Shared System...
• SC-5
  Denial-of-service Protection
• SC-5(1)
  Denial-of-service Protection |...
• SC-5(2)
  Denial-of-service Protection |...
• SC-5(3)
  Denial-of-service Protection |...
• SC-6
  Resource Availability
• SC-7
  Boundary Protection
• SC-12(5)
  Cryptographic Key Establishment and...
• SC-13(1)
  Cryptographic Protection |...
• SC-7(3)
  Boundary Protection | Access Points
• SC-7(4)
  Boundary Protection | External...
• SC-7(5)
  Boundary Protection | Deny by...
• SC-13(2)
  Cryptographic Protection |...
• SC-7(7)
  Boundary Protection | Split...
• SC-7(8)
  Boundary Protection | Route Traffic...
• SC-7(9)
  Boundary Protection | Restrict...
• SC-7(10)
  Boundary Protection | Prevent Exfiltration
• SC-7(11)
  Boundary Protection | Restrict...
• SC-7(12)
  Boundary Protection | Host-based Protection
• SC-7(13)
  Boundary Protection | Isolation of...
• SC-7(14)
  Boundary Protection | Protect...
• SC-7(15)
  Boundary Protection | Networked...
• SC-7(16)
  Boundary Protection | Prevent...
• SC-7(17)
  Boundary Protection | Automated...
• SC-7(18)
  Boundary Protection | Fail Secure
• SC-7(19)
  Boundary Protection | Block...
• SC-7(20)
  Boundary Protection | Dynamic...
• SC-7(21)
  Boundary Protection | Isolation of...
• SC-7(22)
  Boundary Protection | Separate...
• SC-7(23)
  Boundary Protection | Disable Sender...
• SC-7(24)
  Boundary Protection | Personally...
• SC-7(25)
  Boundary Protection | Unclassified...
• SC-7(26)
  Boundary Protection | Classified...
• SC-7(27)
  Boundary Protection | Unclassified...
• SC-7(28)
  Boundary Protection | Connections to...
• SC-7(29)
  Boundary Protection | Separate...
• SC-8
  Transmission Confidentiality and Integrity
• SC-8(1)
  Transmission Confidentiality and...
• SC-8(2)
  Transmission Confidentiality and...
• SC-8(3)
  Transmission Confidentiality and...
• SC-8(4)
  Transmission Confidentiality and...
• SC-8(5)
  Transmission Confidentiality and...
• SC-13(3)
  Cryptographic Protection |...
• SC-10
  Network Disconnect
• SC-11
  Trusted Path
• SC-11(1)
  Trusted Path | Irrefutable...
• SC-12
  Cryptographic Key Establishment and...
• SC-12(1)
  Cryptographic Key Establishment and...
• SC-12(2)
  Cryptographic Key Establishment and...
• SC-12(3)
  Cryptographic Key Establishment and...
• SC-13(4)
  Cryptographic Protection | Digital Signatures
• SC-14
  Public Access Protections
• SC-12(6)
  Cryptographic Key Establishment and...
• SC-13
  Cryptographic Protection
• SC-15(2)
  Collaborative Computing Devices and...
• SC-19
  Voice Over Internet Protocol
• SC-20(1)
  Secure Name/address Resolution...
• SC-21(1)
  Secure Name/address Resolution...
• SC-23(2)
  Session Authenticity |...
• SC-15
  Collaborative Computing Devices and...
• SC-15(1)
  Collaborative Computing Devices and...
• SC-23(4)
  Session Authenticity | Unique...
• SC-15(3)
  Collaborative Computing Devices and...
• SC-15(4)
  Collaborative Computing Devices and...
• SC-16
  Transmission of Security and Privacy...
• SC-16(1)
  Transmission of Security and Privacy...
• SC-16(2)
  Transmission of Security and Privacy...
• SC-16(3)
  Transmission of Security and Privacy...
• SC-17
  Public Key Infrastructure Certificates
• SC-18
  Mobile Code
• SC-18(1)
  Mobile Code | Identify Unacceptable...
• SC-18(2)
  Mobile Code | Acquisition,...
• SC-18(3)
  Mobile Code | Prevent Downloading...
• SC-18(4)
  Mobile Code | Prevent Automatic Execution
• SC-18(5)
  Mobile Code | Allow Execution Only...
• SC-26(1)
  Decoys | Detection of Malicious Code
• SC-20
  Secure Name/address Resolution...
• SC-30(1)
  Concealment and Misdirection |...
• SC-20(2)
  Secure Name/address Resolution...
• SC-21
  Secure Name/address Resolution...
• SC-33
  Transmission Preparation Integrity
• SC-22
  Architecture and Provisioning for...
• SC-23
  Session Authenticity
• SC-23(1)
  Session Authenticity | Invalidate...
• SC-34(3)
  Non-modifiable Executable Programs |...
• SC-23(3)
  Session Authenticity | Unique...
• SC-4(1)
  Information in Shared System...
• SC-23(5)
  Session Authenticity | Allowed...
• SC-24
  Fail in Known State
• SC-25
  Thin Nodes
• SC-26
  Decoys
• SC-42(3)
  Sensor Capability and Data |...
• SC-27
  Platform-independent Applications
• SC-28
  Protection of Information at Rest
• SC-28(1)
  Protection of Information at Rest |...
• SC-28(2)
  Protection of Information at Rest |...
• SC-28(3)
  Protection of Information at Rest |...
• SC-29
  Heterogeneity
• SC-29(1)
  Heterogeneity | Virtualization Techniques
• SC-30
  Concealment and Misdirection
• SC-7(1)
  Boundary Protection | Physically...
• SC-30(2)
  Concealment and Misdirection | Randomness
• SC-30(3)
  Concealment and Misdirection |...
• SC-30(4)
  Concealment and Misdirection |...
• SC-30(5)
  Concealment and Misdirection |...
• SC-31
  Covert Channel Analysis
• SC-31(1)
  Covert Channel Analysis | Test...
• SC-31(2)
  Covert Channel Analysis | Maximum Bandwidth
• SC-31(3)
  Covert Channel Analysis | Measure...
• SC-32
  System Partitioning
• SC-32(1)
  System Partitioning | Separate...
• SC-7(2)
  Boundary Protection | Public Access
• SC-34
  Non-modifiable Executable Programs
• SC-34(1)
  Non-modifiable Executable Programs |...
• SC-34(2)
  Non-modifiable Executable Programs |...
• SC-7(6)
  Boundary Protection | Response to...
• SC-35
  External Malicious Code Identification
• SC-36
  Distributed Processing and Storage
• SC-36(1)
  Distributed Processing and Storage |...
• SC-36(2)
  Distributed Processing and Storage |...
• SC-37
  Out-of-band Channels
• SC-37(1)
  Out-of-band Channels | Ensure...
• SC-38
  Operations Security
• SC-39
  Process Isolation
• SC-39(1)
  Process Isolation | Hardware Separation
• SC-39(2)
  Process Isolation | Separate...
• SC-40
  Wireless Link Protection
• SC-40(1)
  Wireless Link Protection |...
• SC-40(2)
  Wireless Link Protection | Reduce...
• SC-40(3)
  Wireless Link Protection | Imitative...
• SC-40(4)
  Wireless Link Protection | Signal...
• SC-41
  Port and I/O Device Access
• SC-42
  Sensor Capability and Data
• SC-42(1)
  Sensor Capability and Data |...
• SC-42(2)
  Sensor Capability and Data | Authorized Use
• SC-9
  Transmission Confidentiality
• SC-42(4)
  Sensor Capability and Data | Notice...
• SC-42(5)
  Sensor Capability and Data |...
• SC-43
  Usage Restrictions
• SC-44
  Detonation Chambers
• SC-45
  System Time Synchronization
• SC-45(1)
  System Time Synchronization |...
• SC-45(2)
  System Time Synchronization |...
• SC-46
  Cross Domain Policy Enforcement
• SC-47
  Alternate Communications Paths
• SC-48
  Sensor Relocation
• SC-48(1)
  Sensor Relocation | Dynamic...
• SC-49
  Hardware-enforced Separation and...
• SC-50
  Software-enforced Separation and...
• SC-51
  Hardware-based Protection
• SI-1
  Policy and Procedures
• SI-2
  Flaw Remediation
• SI-13(2)
  Predictable Failure Prevention |...
• SI-2(2)
  Flaw Remediation | Automated Flaw...
• SI-2(3)
  Flaw Remediation | Time to Remediate...
• SI-2(4)
  Flaw Remediation | Automated Patch...
• SI-2(5)
  Flaw Remediation | Automatic...
• SI-2(6)
  Flaw Remediation | Removal of...
• SI-3
  Malicious Code Protection
• SI-2(1)
  Flaw Remediation | Central Management
• SI-3(1)
  Malicious Code Protection | Central...
• SI-3(2)
  Malicious Code Protection | Automatic Updates
• SI-3(4)
  Malicious Code Protection | Updates...
• SI-3(3)
  Malicious Code Protection |...
• SI-3(6)
  Malicious Code Protection | Testing...
• SI-3(5)
  Malicious Code Protection | Portable...
• SI-3(8)
  Malicious Code Protection | Detect...
• SI-3(7)
  Malicious Code Protection |...
• SI-3(10)
  Malicious Code Protection |...
• SI-4
  System Monitoring
• SI-4(1)
  System Monitoring | System-wide...
• SI-4(2)
  System Monitoring | Automated Tools...
• SI-4(3)
  System Monitoring | Automated Tool...
• SI-4(4)
  System Monitoring | Inbound and...
• SI-4(5)
  System Monitoring | System-generated Alerts
• SI-3(9)
  Malicious Code Protection |...
• SI-4(7)
  System Monitoring | Automated...
• SI-4(6)
  System Monitoring | Restrict...
• SI-4(9)
  System Monitoring | Testing of...
• SI-4(10)
  System Monitoring | Visibility of...
• SI-4(11)
  System Monitoring | Analyze...
• SI-4(12)
  System Monitoring | Automated...
• SI-4(13)
  System Monitoring | Analyze Traffic...
• SI-4(14)
  System Monitoring | Wireless...
• SI-4(15)
  System Monitoring | Wireless to...
• SI-4(16)
  System Monitoring | Correlate...
• SI-4(17)
  System Monitoring | Integrated...
• SI-4(18)
  System Monitoring | Analyze Traffic...
• SI-4(19)
  System Monitoring | Risk for Individuals
• SI-4(20)
  System Monitoring | Privileged Users
• SI-4(21)
  System Monitoring | Probationary Periods
• SI-4(22)
  System Monitoring | Unauthorized...
• SI-4(23)
  System Monitoring | Host-based Devices
• SI-4(24)
  System Monitoring | Indicators of Compromise
• SI-4(25)
  System Monitoring | Optimize Network...
• SI-5
  Security Alerts, Advisories, and Directives
• SI-5(1)
  Security Alerts, Advisories, and...
• SI-6
  Security and Privacy Function Verification
• SI-4(8)
  System Monitoring | Protection of...
• SI-6(2)
  Security and Privacy Function...
• SI-6(3)
  Security and Privacy Function...
• SI-7
  Software, Firmware, and Information Integrity
• SI-7(1)
  Software, Firmware, and Information...
• SI-7(2)
  Software, Firmware, and Information...
• SI-7(3)
  Software, Firmware, and Information...
• SI-6(1)
  Security and Privacy Function...
• SI-7(5)
  Software, Firmware, and Information...
• SI-7(6)
  Software, Firmware, and Information...
• SI-7(7)
  Software, Firmware, and Information...
• SI-7(8)
  Software, Firmware, and Information...
• SI-7(9)
  Software, Firmware, and Information...
• SI-7(10)
  Software, Firmware, and Information...
• SI-7(11)
  Software, Firmware, and Information...
• SI-7(12)
  Software, Firmware, and Information...
• SI-7(13)
  Software, Firmware, and Information...
• SI-7(14)
  Software, Firmware, and Information...
• SI-7(15)
  Software, Firmware, and Information...
• SI-7(16)
  Software, Firmware, and Information...
• SI-7(17)
  Software, Firmware, and Information...
• SI-8
  Spam Protection
• SI-7(4)
  Software, Firmware, and Information...
• SI-8(2)
  Spam Protection | Automatic Updates
• SI-8(3)
  Spam Protection | Continuous...
• SI-8(1)
  Spam Protection | Central Management
• SI-10
  Information Input Validation
• SI-10(1)
  Information Input Validation |...
• SI-10(2)
  Information Input Validation |...
• SI-10(3)
  Information Input Validation |...
• SI-10(4)
  Information Input Validation |...
• SI-10(5)
  Information Input Validation |...
• SI-10(6)
  Information Input Validation |...
• SI-11
  Error Handling
• SI-12
  Information Management and Retention
• SI-12(1)
  Information Management and Retention...
• SI-12(2)
  Information Management and Retention...
• SI-12(3)
  Information Management and Retention...
• SI-13
  Predictable Failure Prevention
• SI-13(1)
  Predictable Failure Prevention |...
• SI-9
  Information Input Restrictions
• SI-13(3)
  Predictable Failure Prevention |...
• SI-13(4)
  Predictable Failure Prevention |...
• SI-13(5)
  Predictable Failure Prevention |...
• SI-14
  Non-persistence
• SI-14(1)
  Non-persistence | Refresh from...
• SI-14(2)
  Non-persistence | Non-persistent Information
• SI-14(3)
  Non-persistence | Non-persistent Connectivity
• SI-15
  Information Output Filtering
• SI-16
  Memory Protection
• SI-17
  Fail-safe Procedures
• SI-18
  Personally Identifiable Information...
• SI-18(1)
  Personally Identifiable Information...
• SI-18(2)
  Personally Identifiable Information...
• SI-18(3)
  Personally Identifiable Information...
• SI-18(4)
  Personally Identifiable Information...
• SI-18(5)
  Personally Identifiable Information...
• SI-19
  De-identification
• SI-19(1)
  De-identification | Collection
• SI-19(2)
  De-identification | Archiving
• SI-19(3)
  De-identification | Release
• SI-19(4)
  De-identification | Removal,...
• SI-19(5)
  De-identification | Statistical...
• SI-19(6)
  De-identification | Differential Privacy
• SI-19(7)
  De-identification | Validated...
• SI-19(8)
  De-identification | Motivated Intruder
• SI-20
  Tainting
• SI-21
  Information Refresh
• SI-22
  Information Diversity
• SI-23
  Information Fragmentation
• SR-1
  Policy and Procedures
• SR-2
  Supply Chain Risk Management Plan
• SR-2(1)
  Supply Chain Risk Management Plan |...
• SR-3
  Supply Chain Controls and Processes
• SR-3(1)
  Supply Chain Controls and Processes...
• SR-3(2)
  Supply Chain Controls and Processes...
• SR-3(3)
  Supply Chain Controls and Processes...
• SR-4
  Provenance
• SR-4(1)
  Provenance | Identity
• SR-4(2)
  Provenance | Track and Trace
• SR-4(3)
  Provenance | Validate as Genuine and...
• SR-4(4)
  Provenance | Supply Chain Integrity...
• SR-5
  Acquisition Strategies, Tools, and Methods
• SR-5(1)
  Acquisition Strategies, Tools, and...
• SR-5(2)
  Acquisition Strategies, Tools, and...
• SR-6
  Supplier Assessments and Reviews
• SR-6(1)
  Supplier Assessments and Reviews |...
• SR-7
  Supply Chain Operations Security
• SR-8
  Notification Agreements
• SR-9
  Tamper Resistance and Detection
• SR-9(1)
  Tamper Resistance and Detection |...
• SR-10
  Inspection of Systems or Components
• SR-11
  Component Authenticity
• SR-11(1)
  Component Authenticity |...
• SR-11(2)
  Component Authenticity |...
• SR-11(3)
  Component Authenticity |...
• SR-12
  Component Disposal

Control Details