{ "catalog": { "uuid": "76996c98-965d-4202-bd74-e8baf65c99f5", "metadata": { "title": "Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 PRIVACY BASELINE", "last-modified": "2026-05-13T05:08:47.708155Z", "version": "5.2.0", "oscal-version": "1.2.2", "props": [ { "name": "resolution-tool", "value": "OSCAL Profile Resolver XSLT Pipeline OPRXP" } ], "links": [ { "href": "NIST_SP-800-53_rev5_PRIVACY-baseline_profile.xml", "rel": "source-profile" } ], "roles": [ { "id": "creator", "title": "OSCAL Version Creator" }, { "id": "contact-creator", "title": "Contact" }, { "id": "publisher", "title": "SP 800-53 Publisher" }, { "id": "contact-publisher", "title": "Contact" } ], "parties": [ { "uuid": "41a93829-b76b-43ec-b9e7-250553511549", "type": "organization", "name": "Joint Task Force, Interagency Working Group", "email-addresses": [ "sec-cert@nist.gov" ], "addresses": [ { "addr-lines": [ "National Institute of Standards and Technology", "Attn: Computer Security Division", "Information Technology Laboratory", "100 Bureau Drive (Mail Stop 8930)" ], "city": "Gaithersburg", "state": "MD", "postal-code": "20899-8930" } ] }, { "uuid": "98c78f9b-5d50-4b01-b47f-d16801e8d0ab", "type": "organization", "name": "OSCAL Program", "short-name": "NIST", "email-addresses": [ "oscal@nist.gov" ], "addresses": [ { "addr-lines": [ "National Institute of Standards and Technology", "Attn: Computer Security Division", "Information Technology Laboratory", "100 Bureau Drive (Mail Stop 2000)" ], "city": "Gaithersburg", "state": "MD", "postal-code": "20899-2000" } ] } ], "responsible-parties": [ { "role-id": "publisher", "party-uuids": [ "41a93829-b76b-43ec-b9e7-250553511549" ] }, { "role-id": "contact-publisher", "party-uuids": [ "41a93829-b76b-43ec-b9e7-250553511549" ] }, { "role-id": "creator", "party-uuids": [ "98c78f9b-5d50-4b01-b47f-d16801e8d0ab" ] }, { "role-id": "contact-creator", "party-uuids": [ "98c78f9b-5d50-4b01-b47f-d16801e8d0ab" ] } ] }, "groups": [ { "id": "ac", "class": "family", "title": "Access Control", "props": [ { "name": "label", "value": "AC" } ], "controls": [ { "id": "ac-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "ac-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ac-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ac-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "ac-01_odp.01", "props": [ { "name": "label", "value": "AC-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the access control policy is to be disseminated is/are defined;" } ] }, { "id": "ac-01_odp.02", "props": [ { "name": "label", "value": "AC-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the access control procedures are to be disseminated is/are defined;" } ] }, { "id": "ac-01_odp.03", "props": [ { "name": "alt-identifier", "value": "ac-1_prm_2" }, { "name": "label", "value": "AC-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "ac-01_odp.04", "props": [ { "name": "alt-identifier", "value": "ac-1_prm_3" }, { "name": "label", "value": "AC-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the access control policy and procedures is defined;" } ] }, { "id": "ac-01_odp.05", "props": [ { "name": "alt-identifier", "value": "ac-1_prm_4" }, { "name": "label", "value": "AC-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current access control policy is reviewed and updated is defined;" } ] }, { "id": "ac-01_odp.06", "props": [ { "name": "alt-identifier", "value": "ac-1_prm_5" }, { "name": "label", "value": "AC-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current access control policy to be reviewed and updated are defined;" } ] }, { "id": "ac-01_odp.07", "props": [ { "name": "alt-identifier", "value": "ac-1_prm_6" }, { "name": "label", "value": "AC-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current access control procedures are reviewed and updated is defined;" } ] }, { "id": "ac-01_odp.08", "props": [ { "name": "alt-identifier", "value": "ac-1_prm_7" }, { "name": "label", "value": "AC-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "AC-01", "class": "zero-padded" }, { "name": "label", "value": "AC-1" }, { "name": "label", "value": "AC-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "ac-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#7f473f21-fdbf-4a6c-81a1-0ab95919609d", "rel": "reference" }, { "href": "#ia-1", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-24", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "ac-1_smt", "name": "statement", "parts": [ { "id": "ac-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, ac-1_prm_1 }}:", "parts": [ { "id": "ac-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, ac-01_odp.03 }} access control policy that:", "parts": [ { "id": "ac-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "ac-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "ac-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the access control policy and the associated access controls;" } ] }, { "id": "ac-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, ac-01_odp.04 }} to manage the development, documentation, and dissemination of the access control policy and procedures; and" }, { "id": "ac-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current access control:", "parts": [ { "id": "ac-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, ac-01_odp.05 }} and following {{ insert: param, ac-01_odp.06 }} ; and" }, { "id": "ac-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, ac-01_odp.07 }} and following {{ insert: param, ac-01_odp.08 }}." } ] } ] }, { "id": "ac-1_gdn", "name": "guidance", "prose": "Access control policy and procedures address the controls in the AC family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of access control policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies reflecting the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to access control policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "ac-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01", "class": "sp800-53a" } ], "parts": [ { "id": "ac-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "ac-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.[01]", "class": "sp800-53a" } ], "prose": "an access control policy is developed and documented;", "links": [ { "href": "#ac-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.[02]", "class": "sp800-53a" } ], "prose": "the access control policy is disseminated to {{ insert: param, ac-01_odp.01 }};", "links": [ { "href": "#ac-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.[03]", "class": "sp800-53a" } ], "prose": "access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented;", "links": [ { "href": "#ac-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.[04]", "class": "sp800-53a" } ], "prose": "the access control procedures are disseminated to {{ insert: param, ac-01_odp.02 }};", "links": [ { "href": "#ac-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "ac-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "ac-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ac-01_odp.03 }} access control policy addresses purpose;", "links": [ { "href": "#ac-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ac-01_odp.03 }} access control policy addresses scope;", "links": [ { "href": "#ac-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ac-01_odp.03 }} access control policy addresses roles;", "links": [ { "href": "#ac-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ac-01_odp.03 }} access control policy addresses responsibilities;", "links": [ { "href": "#ac-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ac-01_odp.03 }} access control policy addresses management commitment;", "links": [ { "href": "#ac-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ac-01_odp.03 }} access control policy addresses coordination among organizational entities;", "links": [ { "href": "#ac-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ac-01_odp.03 }} access control policy addresses compliance;", "links": [ { "href": "#ac-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ac-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ac-01_odp.03 }} access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#ac-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ac-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ac-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ac-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the access control policy and procedures;", "links": [ { "href": "#ac-1_smt.b", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "ac-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "ac-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current access control policy is reviewed and updated {{ insert: param, ac-01_odp.05 }};", "links": [ { "href": "#ac-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current access control policy is reviewed and updated following {{ insert: param, ac-01_odp.06 }};", "links": [ { "href": "#ac-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ac-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "ac-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current access control procedures are reviewed and updated {{ insert: param, ac-01_odp.07 }};", "links": [ { "href": "#ac-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "ac-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current access control procedures are reviewed and updated following {{ insert: param, ac-01_odp.08 }}.", "links": [ { "href": "#ac-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ac-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ac-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ac-1_smt", "rel": "assessment-for" } ] }, { "id": "ac-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AC-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Access control policy and procedures\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ac-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AC-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with access control responsibilities\n\norganizational personnel with information security with information security and privacy responsibilities" } ] } ] }, { "id": "ac-3.14", "class": "SP800-53-enhancement", "title": "Individual Access", "params": [ { "id": "ac-03.14_odp.01", "props": [ { "name": "alt-identifier", "value": "ac-3.14_prm_1" }, { "name": "label", "value": "AC-03(14)_ODP[01]", "class": "sp800-53a" } ], "label": "mechanisms", "guidelines": [ { "prose": "mechanisms enabling individuals to have access to elements of their personally identifiable information are defined;" } ] }, { "id": "ac-03.14_odp.02", "props": [ { "name": "alt-identifier", "value": "ac-3.14_prm_2" }, { "name": "label", "value": "AC-03(14)_ODP[02]", "class": "sp800-53a" } ], "label": "elements", "guidelines": [ { "prose": "elements of personally identifiable information to which individuals have access are defined;" } ] } ], "props": [ { "name": "label", "value": "AC-03(14)", "class": "zero-padded" }, { "name": "label", "value": "AC-3(14)" }, { "name": "label", "value": "AC-03(14)", "class": "sp800-53a" }, { "name": "sort-id", "value": "ac-03.14" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "system" } ], "links": [ { "href": "#ac-3", "rel": "required" }, { "href": "#ia-8", "rel": "related" }, { "href": "#pm-22", "rel": "related" }, { "href": "#pm-20", "rel": "related" }, { "href": "#pm-21", "rel": "related" }, { "href": "#pt-6", "rel": "related" } ], "parts": [ { "id": "ac-3.14_smt", "name": "statement", "prose": "Provide {{ insert: param, ac-03.14_odp.01 }} to enable individuals to have access to the following elements of their personally identifiable information: {{ insert: param, ac-03.14_odp.02 }}." }, { "id": "ac-3.14_gdn", "name": "guidance", "prose": "Individual access affords individuals the ability to review personally identifiable information about them held within organizational records, regardless of format. Access helps individuals to develop an understanding about how their personally identifiable information is being processed. It can also help individuals ensure that their data is accurate. Access mechanisms can include request forms and application interfaces. For federal agencies, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) processes can be located in systems of record notices and on agency websites. Access to certain types of records may not be appropriate (e.g., for federal agencies, law enforcement records within a system of records may be exempt from disclosure under the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) ) or may require certain levels of authentication assurance. Organizational personnel consult with the senior agency official for privacy and legal counsel to determine appropriate mechanisms and access rights or limitations." }, { "id": "ac-3.14_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AC-03(14)", "class": "sp800-53a" } ], "prose": " {{ insert: param, ac-03.14_odp.01 }} are provided to enable individuals to have access to {{ insert: param, ac-03.14_odp.02 }} of their personally identifiable information.", "links": [ { "href": "#ac-3.14_smt", "rel": "assessment-for" } ] }, { "id": "ac-3.14_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AC-03(14)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Access mechanisms (e.g., request forms and application interfaces)\n\naccess control policy\n\nprocedures addressing access enforcement\n\nsystem design documentation\n\nsystem configuration settings and associated documentation\n\ndocumentation regarding access to an individual’s personally identifiable information\n\nsystem audit records\n\nsystem security plan\n\nprivacy plan\n\nprivacy impact assessment\n\nprivacy assessment findings and/or reports\n\nother relevant documents or records" } ] }, { "id": "ac-3.14_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AC-03(14)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with access enforcement responsibilities\n\nsystem/network administrators\n\norganizational personnel with information security and privacy responsibilities\n\nlegal counsel" } ] }, { "id": "ac-3.14_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AC-03(14)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms implementing access enforcement functions\n\nmechanisms enabling individual access to personally identifiable information" } ] } ] } ] }, { "id": "at", "class": "family", "title": "Awareness and Training", "props": [ { "name": "label", "value": "AT" } ], "controls": [ { "id": "at-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "at-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "at-01_odp.01", "props": [ { "name": "label", "value": "AT-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the awareness and training policy is to be disseminated is/are defined;" } ] }, { "id": "at-01_odp.02", "props": [ { "name": "label", "value": "AT-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the awareness and training procedures are to be disseminated is/are defined;" } ] }, { "id": "at-01_odp.03", "props": [ { "name": "alt-identifier", "value": "at-1_prm_2" }, { "name": "label", "value": "AT-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "at-01_odp.04", "props": [ { "name": "alt-identifier", "value": "at-1_prm_3" }, { "name": "label", "value": "AT-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the awareness and training policy and procedures is defined;" } ] }, { "id": "at-01_odp.05", "props": [ { "name": "alt-identifier", "value": "at-1_prm_4" }, { "name": "label", "value": "AT-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current awareness and training policy is reviewed and updated is defined;" } ] }, { "id": "at-01_odp.06", "props": [ { "name": "alt-identifier", "value": "at-1_prm_5" }, { "name": "label", "value": "AT-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current awareness and training policy to be reviewed and updated are defined;" } ] }, { "id": "at-01_odp.07", "props": [ { "name": "alt-identifier", "value": "at-1_prm_6" }, { "name": "label", "value": "AT-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current awareness and training procedures are reviewed and updated is defined;" } ] }, { "id": "at-01_odp.08", "props": [ { "name": "alt-identifier", "value": "at-1_prm_7" }, { "name": "label", "value": "AT-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "AT-01", "class": "zero-padded" }, { "name": "label", "value": "AT-1" }, { "name": "label", "value": "AT-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#511f6832-23ca-49a3-8c0f-ce493373cab8", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "at-1_smt", "name": "statement", "parts": [ { "id": "at-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, at-1_prm_1 }}:", "parts": [ { "id": "at-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, at-01_odp.03 }} awareness and training policy that:", "parts": [ { "id": "at-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "at-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "at-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;" } ] }, { "id": "at-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, at-01_odp.04 }} to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and" }, { "id": "at-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current awareness and training:", "parts": [ { "id": "at-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, at-01_odp.05 }} and following {{ insert: param, at-01_odp.06 }} ; and" }, { "id": "at-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, at-01_odp.07 }} and following {{ insert: param, at-01_odp.08 }}." } ] } ] }, { "id": "at-1_gdn", "name": "guidance", "prose": "Awareness and training policy and procedures address the controls in the AT family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of awareness and training policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to awareness and training policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "at-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.[01]", "class": "sp800-53a" } ], "prose": "an awareness and training policy is developed and documented; ", "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.[02]", "class": "sp800-53a" } ], "prose": "the awareness and training policy is disseminated to {{ insert: param, at-01_odp.01 }};", "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.[03]", "class": "sp800-53a" } ], "prose": "awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented;", "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.[04]", "class": "sp800-53a" } ], "prose": "the awareness and training procedures are disseminated to {{ insert: param, at-01_odp.02 }}.", "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses purpose;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses scope;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses roles;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses responsibilities;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses management commitment;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses coordination among organizational entities;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses compliance; and", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; and", "links": [ { "href": "#at-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures;", "links": [ { "href": "#at-1_smt.b", "rel": "assessment-for" } ] }, { "id": "at-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current awareness and training policy is reviewed and updated {{ insert: param, at-01_odp.05 }}; ", "links": [ { "href": "#at-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "at-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current awareness and training policy is reviewed and updated following {{ insert: param, at-01_odp.06 }};", "links": [ { "href": "#at-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "at-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current awareness and training procedures are reviewed and updated {{ insert: param, at-01_odp.07 }};", "links": [ { "href": "#at-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "at-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current awareness and training procedures are reviewed and updated following {{ insert: param, at-01_odp.08 }}.", "links": [ { "href": "#at-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt", "rel": "assessment-for" } ] }, { "id": "at-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nawareness and training policy and procedures\n\nother relevant documents or records" } ] }, { "id": "at-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with awareness and training responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "at-2", "class": "SP800-53", "title": "Literacy Training and Awareness", "params": [ { "id": "at-2_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-02_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-02_odp.02" } ], "label": "organization-defined frequency" }, { "id": "at-2_prm_2", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-02_odp.03" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-02_odp.04" } ], "label": "organization-defined events" }, { "id": "at-02_odp.01", "props": [ { "name": "label", "value": "AT-02_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training is defined;" } ] }, { "id": "at-02_odp.02", "props": [ { "name": "label", "value": "AT-02_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training is defined;" } ] }, { "id": "at-02_odp.03", "props": [ { "name": "label", "value": "AT-02_ODP[03]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that require security literacy training for system users are defined;" } ] }, { "id": "at-02_odp.04", "props": [ { "name": "label", "value": "AT-02_ODP[04]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that require privacy literacy training for system users are defined;" } ] }, { "id": "at-02_odp.05", "props": [ { "name": "alt-identifier", "value": "at-2_prm_3" }, { "name": "label", "value": "AT-02_ODP[05]", "class": "sp800-53a" } ], "label": "awareness techniques", "guidelines": [ { "prose": "techniques to be employed to increase the security and privacy awareness of system users are defined;" } ] }, { "id": "at-02_odp.06", "props": [ { "name": "alt-identifier", "value": "at-2_prm_4" }, { "name": "label", "value": "AT-02_ODP[06]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to update literacy training and awareness content is defined;" } ] }, { "id": "at-02_odp.07", "props": [ { "name": "alt-identifier", "value": "at-2_prm_5" }, { "name": "label", "value": "AT-02_ODP[07]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require literacy training and awareness content to be updated are defined;" } ] } ], "props": [ { "name": "label", "value": "AT-02", "class": "zero-padded" }, { "name": "label", "value": "AT-2" }, { "name": "label", "value": "AT-02", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#511f6832-23ca-49a3-8c0f-ce493373cab8", "rel": "reference" }, { "href": "#61ccf0f4-d3e7-42db-9796-ce6cb1c85989", "rel": "reference" }, { "href": "#276bd50a-7e58-48e5-a405-8c8cb91d7a5f", "rel": "reference" }, { "href": "#89f2a08d-fc49-46d0-856e-bf974c9b1573", "rel": "reference" }, { "href": "#ac-3", "rel": "related" }, { "href": "#ac-17", "rel": "related" }, { "href": "#ac-22", "rel": "related" }, { "href": "#at-3", "rel": "related" }, { "href": "#at-4", "rel": "related" }, { "href": "#cp-3", "rel": "related" }, { "href": "#ia-4", "rel": "related" }, { "href": "#ir-2", "rel": "related" }, { "href": "#ir-7", "rel": "related" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pl-4", "rel": "related" }, { "href": "#pm-13", "rel": "related" }, { "href": "#pm-21", "rel": "related" }, { "href": "#ps-7", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-16", "rel": "related" } ], "parts": [ { "id": "at-2_smt", "name": "statement", "parts": [ { "id": "at-2_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):", "parts": [ { "id": "at-2_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "As part of initial training for new users and {{ insert: param, at-2_prm_1 }} thereafter; and" }, { "id": "at-2_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "When required by system changes or following {{ insert: param, at-2_prm_2 }};" } ] }, { "id": "at-2_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Employ the following techniques to increase the security and privacy awareness of system users {{ insert: param, at-02_odp.05 }};" }, { "id": "at-2_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Update literacy training and awareness content {{ insert: param, at-02_odp.06 }} and following {{ insert: param, at-02_odp.07 }} ; and" }, { "id": "at-2_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques." } ] }, { "id": "at-2_gdn", "name": "guidance", "prose": "Organizations provide basic and advanced levels of literacy training to system users, including measures to test the knowledge level of users. Organizations determine the content of literacy training and awareness based on specific organizational requirements, the systems to which personnel have authorized access, and work environments (e.g., telework). The content includes an understanding of the need for security and privacy as well as actions by users to maintain security and personal privacy and to respond to suspected incidents. The content addresses the need for operations security and the handling of personally identifiable information.\n\nAwareness techniques include displaying posters, offering supplies inscribed with security and privacy reminders, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events. Literacy training after the initial training described in [AT-2a.1](#at-2_smt.a.1) is conducted at a minimum frequency consistent with applicable laws, directives, regulations, and policies. Subsequent literacy training may be satisfied by one or more short ad hoc sessions and include topical information on recent attack schemes, changes to organizational security and privacy policies, revised security and privacy expectations, or a subset of topics from the initial training. Updating literacy training and awareness content on a regular basis helps to ensure that the content remains relevant. Events that may precipitate an update to literacy training and awareness content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines." }, { "id": "at-2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01[01]", "class": "sp800-53a" } ], "prose": "security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;", "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01[02]", "class": "sp800-53a" } ], "prose": "privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;", "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.1-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01[03]", "class": "sp800-53a" } ], "prose": "security literacy training is provided to system users (including managers, senior executives, and contractors) {{ insert: param, at-02_odp.01 }} thereafter;", "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.1-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01[04]", "class": "sp800-53a" } ], "prose": "privacy literacy training is provided to system users (including managers, senior executives, and contractors) {{ insert: param, at-02_odp.02 }} thereafter;", "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.02", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.02[01]", "class": "sp800-53a" } ], "prose": "security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following {{ insert: param, at-02_odp.03 }};", "links": [ { "href": "#at-2_smt.a.2", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.02[02]", "class": "sp800-53a" } ], "prose": "privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following {{ insert: param, at-02_odp.04 }};", "links": [ { "href": "#at-2_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt.a", "rel": "assessment-for" } ] }, { "id": "at-2_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02b.", "class": "sp800-53a" } ], "prose": " {{ insert: param, at-02_odp.05 }} are employed to increase the security and privacy awareness of system users;", "links": [ { "href": "#at-2_smt.b", "rel": "assessment-for" } ] }, { "id": "at-2_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02c.", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02c.[01]", "class": "sp800-53a" } ], "prose": "literacy training and awareness content is updated {{ insert: param, at-02_odp.06 }};", "links": [ { "href": "#at-2_smt.c", "rel": "assessment-for" } ] }, { "id": "at-2_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02c.[02]", "class": "sp800-53a" } ], "prose": "literacy training and awareness content is updated following {{ insert: param, at-02_odp.07 }};", "links": [ { "href": "#at-2_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt.c", "rel": "assessment-for" } ] }, { "id": "at-2_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02d.", "class": "sp800-53a" } ], "prose": "lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.", "links": [ { "href": "#at-2_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt", "rel": "assessment-for" } ] }, { "id": "at-2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-02-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nliteracy training and awareness policy\n\nprocedures addressing literacy training and awareness implementation\n\nappropriate codes of federal regulations\n\nsecurity and privacy literacy training curriculum\n\nsecurity and privacy literacy training materials\n\ntraining records\n\nother relevant documents or records" } ] }, { "id": "at-2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-02-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for literacy training and awareness\n\norganizational personnel with information security and privacy responsibilities\n\norganizational personnel comprising the general system user community" } ] }, { "id": "at-2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AT-02-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms managing information security and privacy literacy training" } ] } ] }, { "id": "at-3", "class": "SP800-53", "title": "Role-based Training", "params": [ { "id": "at-3_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-03_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-03_odp.02" } ], "label": "organization-defined roles and responsibilities" }, { "id": "at-03_odp.01", "props": [ { "name": "label", "value": "AT-03_ODP[01]", "class": "sp800-53a" } ], "label": "roles and responsibilities", "guidelines": [ { "prose": "roles and responsibilities for role-based security training are defined;" } ] }, { "id": "at-03_odp.02", "props": [ { "name": "label", "value": "AT-03_ODP[02]", "class": "sp800-53a" } ], "label": "roles and responsibilities", "guidelines": [ { "prose": "roles and responsibilities for role-based privacy training are defined;" } ] }, { "id": "at-03_odp.03", "props": [ { "name": "alt-identifier", "value": "at-3_prm_2" }, { "name": "label", "value": "AT-03_ODP[03]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined;" } ] }, { "id": "at-03_odp.04", "props": [ { "name": "alt-identifier", "value": "at-3_prm_3" }, { "name": "label", "value": "AT-03_ODP[04]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to update role-based training content is defined;" } ] }, { "id": "at-03_odp.05", "props": [ { "name": "alt-identifier", "value": "at-3_prm_4" }, { "name": "label", "value": "AT-03_ODP[05]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that require role-based training content to be updated are defined;" } ] } ], "props": [ { "name": "label", "value": "AT-03", "class": "zero-padded" }, { "name": "label", "value": "AT-3" }, { "name": "label", "value": "AT-03", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#511f6832-23ca-49a3-8c0f-ce493373cab8", "rel": "reference" }, { "href": "#276bd50a-7e58-48e5-a405-8c8cb91d7a5f", "rel": "reference" }, { "href": "#ac-3", "rel": "related" }, { "href": "#ac-17", "rel": "related" }, { "href": "#ac-22", "rel": "related" }, { "href": "#at-2", "rel": "related" }, { "href": "#at-4", "rel": "related" }, { "href": "#cp-3", "rel": "related" }, { "href": "#ir-2", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-7", "rel": "related" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pl-4", "rel": "related" }, { "href": "#pm-13", "rel": "related" }, { "href": "#pm-23", "rel": "related" }, { "href": "#ps-7", "rel": "related" }, { "href": "#ps-9", "rel": "related" }, { "href": "#sa-3", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-11", "rel": "related" }, { "href": "#sa-16", "rel": "related" }, { "href": "#sr-5", "rel": "related" }, { "href": "#sr-6", "rel": "related" }, { "href": "#sr-11", "rel": "related" } ], "parts": [ { "id": "at-3_smt", "name": "statement", "parts": [ { "id": "at-3_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Provide role-based security and privacy training to personnel with the following roles and responsibilities: {{ insert: param, at-3_prm_1 }}:", "parts": [ { "id": "at-3_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Before authorizing access to the system, information, or performing assigned duties, and {{ insert: param, at-03_odp.03 }} thereafter; and" }, { "id": "at-3_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "When required by system changes;" } ] }, { "id": "at-3_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Update role-based training content {{ insert: param, at-03_odp.04 }} and following {{ insert: param, at-03_odp.05 }} ; and" }, { "id": "at-3_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Incorporate lessons learned from internal or external security incidents or breaches into role-based training." } ] }, { "id": "at-3_gdn", "name": "guidance", "prose": "Organizations determine the content of training based on the assigned roles and responsibilities of individuals as well as the security and privacy requirements of organizations and the systems to which personnel have authorized access, including technical training specifically tailored for assigned duties. Roles that may require role-based training include senior leaders or management officials (e.g., head of agency/chief executive officer, chief information officer, senior accountable official for risk management, senior agency information security officer, senior agency official for privacy), system owners; authorizing officials; system security officers; privacy officers; acquisition and procurement officials; enterprise architects; systems engineers; software developers; systems security engineers; privacy engineers; system, network, and database administrators; auditors; personnel conducting configuration management activities; personnel performing verification and validation activities; personnel with access to system-level software; control assessors; personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; and personnel with access to personally identifiable information.\n\nComprehensive role-based training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical controls. Role-based training also includes policies, procedures, tools, methods, and artifacts for the security and privacy roles defined. Organizations provide the training necessary for individuals to fulfill their responsibilities related to operations and supply chain risk management within the context of organizational security and privacy programs. Role-based training also applies to contractors who provide services to federal agencies. Types of training include web-based and computer-based training, classroom-style training, and hands-on training (including micro-training). Updating role-based training on a regular basis helps to ensure that the content remains relevant and effective. Events that may precipitate an update to role-based training content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines." }, { "id": "at-3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01[01]", "class": "sp800-53a" } ], "prose": "role-based security training is provided to {{ insert: param, at-03_odp.01 }} before authorizing access to the system, information, or performing assigned duties;", "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01[02]", "class": "sp800-53a" } ], "prose": "role-based privacy training is provided to {{ insert: param, at-03_odp.02 }} before authorizing access to the system, information, or performing assigned duties;", "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.1-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01[03]", "class": "sp800-53a" } ], "prose": "role-based security training is provided to {{ insert: param, at-03_odp.01 }} {{ insert: param, at-03_odp.03 }} thereafter;", "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.1-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01[04]", "class": "sp800-53a" } ], "prose": "role-based privacy training is provided to {{ insert: param, at-03_odp.02 }} {{ insert: param, at-03_odp.03 }} thereafter;", "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.02", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.02[01]", "class": "sp800-53a" } ], "prose": "role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;", "links": [ { "href": "#at-3_smt.a.2", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.02[02]", "class": "sp800-53a" } ], "prose": "role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;", "links": [ { "href": "#at-3_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt.a", "rel": "assessment-for" } ] }, { "id": "at-3_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03b.", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03b.[01]", "class": "sp800-53a" } ], "prose": "role-based training content is updated {{ insert: param, at-03_odp.04 }};", "links": [ { "href": "#at-3_smt.b", "rel": "assessment-for" } ] }, { "id": "at-3_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03b.[02]", "class": "sp800-53a" } ], "prose": "role-based training content is updated following {{ insert: param, at-03_odp.05 }};", "links": [ { "href": "#at-3_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt.b", "rel": "assessment-for" } ] }, { "id": "at-3_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03c.", "class": "sp800-53a" } ], "prose": "lessons learned from internal or external security incidents or breaches are incorporated into role-based training.", "links": [ { "href": "#at-3_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt", "rel": "assessment-for" } ] }, { "id": "at-3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-03-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nsecurity and privacy awareness and training policy\n\nprocedures addressing security and privacy training implementation\n\ncodes of federal regulations\n\nsecurity and privacy training curriculum\n\nsecurity and privacy training materials\n\ntraining records\n\nother relevant documents or records" } ] }, { "id": "at-3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-03-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for role-based security and privacy training\n\norganizational personnel with assigned system security and privacy roles and responsibilities" } ] }, { "id": "at-3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AT-03-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms managing role-based security and privacy training" } ] } ], "controls": [ { "id": "at-3.5", "class": "SP800-53-enhancement", "title": "Processing Personally Identifiable Information", "params": [ { "id": "at-03.05_odp.01", "props": [ { "name": "alt-identifier", "value": "at-3.5_prm_1" }, { "name": "label", "value": "AT-03(05)_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to be provided with initial and refresher training in the employment and operation of personally identifiable information processing and transparency controls is/are defined;" } ] }, { "id": "at-03.05_odp.02", "props": [ { "name": "alt-identifier", "value": "at-3.5_prm_2" }, { "name": "label", "value": "AT-03(05)_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide refresher training in the employment and operation of personally identifiable information processing and transparency controls is defined;" } ] } ], "props": [ { "name": "label", "value": "AT-03(05)", "class": "zero-padded" }, { "name": "label", "value": "AT-3(5)" }, { "name": "label", "value": "AT-03(05)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-03.05" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-3", "rel": "required" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#pt-5", "rel": "related" }, { "href": "#pt-6", "rel": "related" } ], "parts": [ { "id": "at-3.5_smt", "name": "statement", "prose": "Provide {{ insert: param, at-03.05_odp.01 }} with initial and {{ insert: param, at-03.05_odp.02 }} training in the employment and operation of personally identifiable information processing and transparency controls." }, { "id": "at-3.5_gdn", "name": "guidance", "prose": "Personally identifiable information processing and transparency controls include the organization’s authority to process personally identifiable information and personally identifiable information processing purposes. Role-based training for federal agencies addresses the types of information that may constitute personally identifiable information and the risks, considerations, and obligations associated with its processing. Such training also considers the authority to process personally identifiable information documented in privacy policies and notices, system of records notices, computer matching agreements and notices, privacy impact assessments, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, contracts, information sharing agreements, memoranda of understanding, and/or other documentation." }, { "id": "at-3.5_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03(05)", "class": "sp800-53a" } ], "prose": " {{ insert: param, at-03.05_odp.01 }} are provided with initial and refresher training {{ insert: param, at-03.05_odp.02 }} in the employment and operation of personally identifiable information processing and transparency controls.", "links": [ { "href": "#at-3.5_smt", "rel": "assessment-for" } ] }, { "id": "at-3.5_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-03(05)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy awareness and training policy\n\nprocedures addressing security and privacy awareness training implementation\n\nsecurity and privacy awareness training curriculum\n\nsecurity and privacy awareness training materials\n\nsystem security plan\n\nprivacy plan\n\norganizational privacy notices\n\norganizational policies\n\nsystem of records notices\n\nPrivacy Act statements\n\ncomputer matching agreements and notices\n\nprivacy impact assessments\n\ninformation sharing agreements\n\nother relevant documents or records" } ] }, { "id": "at-3.5_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-03(05)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for role-based security and privacy training\n\norganizational personnel who participate in security and privacy awareness training" } ] } ] } ] }, { "id": "at-4", "class": "SP800-53", "title": "Training Records", "params": [ { "id": "at-04_odp", "props": [ { "name": "alt-identifier", "value": "at-4_prm_1" }, { "name": "label", "value": "AT-04_ODP", "class": "sp800-53a" } ], "label": "time period", "guidelines": [ { "prose": "time period for retaining individual training records is defined;" } ] } ], "props": [ { "name": "label", "value": "AT-04", "class": "zero-padded" }, { "name": "label", "value": "AT-4" }, { "name": "label", "value": "AT-04", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#at-2", "rel": "related" }, { "href": "#at-3", "rel": "related" }, { "href": "#cp-3", "rel": "related" }, { "href": "#ir-2", "rel": "related" }, { "href": "#pm-14", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "at-4_smt", "name": "statement", "parts": [ { "id": "at-4_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and" }, { "id": "at-4_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Retain individual training records for {{ insert: param, at-04_odp }}." } ] }, { "id": "at-4_gdn", "name": "guidance", "prose": "Documentation for specialized training may be maintained by individual supervisors at the discretion of the organization. The National Archives and Records Administration provides guidance on records retention for federal agencies." }, { "id": "at-4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04", "class": "sp800-53a" } ], "parts": [ { "id": "at-4_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04a.", "class": "sp800-53a" } ], "parts": [ { "id": "at-4_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04a.[01]", "class": "sp800-53a" } ], "prose": "information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented;", "links": [ { "href": "#at-4_smt.a", "rel": "assessment-for" } ] }, { "id": "at-4_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04a.[02]", "class": "sp800-53a" } ], "prose": "information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored;", "links": [ { "href": "#at-4_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-4_smt.a", "rel": "assessment-for" } ] }, { "id": "at-4_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04b.", "class": "sp800-53a" } ], "prose": "individual training records are retained for {{ insert: param, at-04_odp }}.", "links": [ { "href": "#at-4_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-4_smt", "rel": "assessment-for" } ] }, { "id": "at-4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-04-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy awareness and training policy\n\nprocedures addressing security and privacy training records\n\nsecurity and privacy awareness and training records\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "at-4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-04-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy training record retention responsibilities" } ] }, { "id": "at-4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AT-04-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms supporting the management of security and privacy training records" } ] } ] } ] }, { "id": "au", "class": "family", "title": "Audit and Accountability", "props": [ { "name": "label", "value": "AU" } ], "controls": [ { "id": "au-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "au-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "au-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "au-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "au-01_odp.01", "props": [ { "name": "label", "value": "AU-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the audit and accountability policy is to be disseminated is/are defined;" } ] }, { "id": "au-01_odp.02", "props": [ { "name": "label", "value": "AU-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the audit and accountability procedures are to be disseminated is/are defined;" } ] }, { "id": "au-01_odp.03", "props": [ { "name": "alt-identifier", "value": "au-1_prm_2" }, { "name": "label", "value": "AU-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "au-01_odp.04", "props": [ { "name": "alt-identifier", "value": "au-1_prm_3" }, { "name": "label", "value": "AU-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the audit and accountability policy and procedures is defined;" } ] }, { "id": "au-01_odp.05", "props": [ { "name": "alt-identifier", "value": "au-1_prm_4" }, { "name": "label", "value": "AU-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current audit and accountability policy is reviewed and updated is defined;" } ] }, { "id": "au-01_odp.06", "props": [ { "name": "alt-identifier", "value": "au-1_prm_5" }, { "name": "label", "value": "AU-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current audit and accountability policy to be reviewed and updated are defined;" } ] }, { "id": "au-01_odp.07", "props": [ { "name": "alt-identifier", "value": "au-1_prm_6" }, { "name": "label", "value": "AU-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current audit and accountability procedures are reviewed and updated is defined;" } ] }, { "id": "au-01_odp.08", "props": [ { "name": "alt-identifier", "value": "au-1_prm_7" }, { "name": "label", "value": "AU-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require audit and accountability procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "AU-01", "class": "zero-padded" }, { "name": "label", "value": "AU-1" }, { "name": "label", "value": "AU-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "au-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "au-1_smt", "name": "statement", "parts": [ { "id": "au-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, au-1_prm_1 }}:", "parts": [ { "id": "au-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, au-01_odp.03 }} audit and accountability policy that:", "parts": [ { "id": "au-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "au-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "au-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;" } ] }, { "id": "au-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, au-01_odp.04 }} to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and" }, { "id": "au-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current audit and accountability:", "parts": [ { "id": "au-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, au-01_odp.05 }} and following {{ insert: param, au-01_odp.06 }} ; and" }, { "id": "au-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, au-01_odp.07 }} and following {{ insert: param, au-01_odp.08 }}." } ] } ] }, { "id": "au-1_gdn", "name": "guidance", "prose": "Audit and accountability policy and procedures address the controls in the AU family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of audit and accountability policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to audit and accountability policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "au-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01", "class": "sp800-53a" } ], "parts": [ { "id": "au-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "au-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.[01]", "class": "sp800-53a" } ], "prose": "an audit and accountability policy is developed and documented;", "links": [ { "href": "#au-1_smt.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.[02]", "class": "sp800-53a" } ], "prose": "the audit and accountability policy is disseminated to {{ insert: param, au-01_odp.01 }};", "links": [ { "href": "#au-1_smt.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.[03]", "class": "sp800-53a" } ], "prose": "audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented;", "links": [ { "href": "#au-1_smt.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.[04]", "class": "sp800-53a" } ], "prose": "the audit and accountability procedures are disseminated to {{ insert: param, au-01_odp.02 }};", "links": [ { "href": "#au-1_smt.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "au-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "au-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, au-01_odp.03 }} of the audit and accountability policy addresses purpose;", "links": [ { "href": "#au-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, au-01_odp.03 }} of the audit and accountability policy addresses scope;", "links": [ { "href": "#au-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, au-01_odp.03 }} of the audit and accountability policy addresses roles;", "links": [ { "href": "#au-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, au-01_odp.03 }} of the audit and accountability policy addresses responsibilities;", "links": [ { "href": "#au-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, au-01_odp.03 }} of the audit and accountability policy addresses management commitment;", "links": [ { "href": "#au-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, au-01_odp.03 }} of the audit and accountability policy addresses coordination among organizational entities;", "links": [ { "href": "#au-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, au-01_odp.03 }} of the audit and accountability policy addresses compliance;", "links": [ { "href": "#au-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#au-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, au-01_odp.03 }} of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#au-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#au-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#au-1_smt.a", "rel": "assessment-for" } ] }, { "id": "au-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, au-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures;", "links": [ { "href": "#au-1_smt.b", "rel": "assessment-for" } ] }, { "id": "au-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "au-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "au-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current audit and accountability policy is reviewed and updated {{ insert: param, au-01_odp.05 }};", "links": [ { "href": "#au-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "au-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current audit and accountability policy is reviewed and updated following {{ insert: param, au-01_odp.06 }};", "links": [ { "href": "#au-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#au-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "au-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "au-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current audit and accountability procedures are reviewed and updated {{ insert: param, au-01_odp.07 }};", "links": [ { "href": "#au-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "au-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current audit and accountability procedures are reviewed and updated following {{ insert: param, au-01_odp.08 }}.", "links": [ { "href": "#au-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#au-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#au-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#au-1_smt", "rel": "assessment-for" } ] }, { "id": "au-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AU-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Audit and accountability policy and procedures\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "au-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AU-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with audit and accountability responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "au-2", "class": "SP800-53", "title": "Event Logging", "params": [ { "id": "au-2_prm_2", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "au-02_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "au-02_odp.03" } ], "label": "organization-defined event types (subset of the event types defined in [AU-2a.](#au-2_smt.a)) along with the frequency of (or situation requiring) logging for each identified event type" }, { "id": "au-02_odp.01", "props": [ { "name": "alt-identifier", "value": "au-2_prm_1" }, { "name": "alt-label", "value": "event types that the system is capable of logging", "class": "sp800-53" }, { "name": "label", "value": "AU-02_ODP[01]", "class": "sp800-53a" } ], "label": "event types", "guidelines": [ { "prose": "the event types that the system is capable of logging in support of the audit function are defined;" } ] }, { "id": "au-02_odp.02", "props": [ { "name": "label", "value": "AU-02_ODP[02]", "class": "sp800-53a" } ], "label": "event types (subset of AU-02_ODP[01])", "guidelines": [ { "prose": "the event types (subset of AU-02_ODP[01]) for logging within the system are defined;" } ] }, { "id": "au-02_odp.03", "props": [ { "name": "label", "value": "AU-02_ODP[03]", "class": "sp800-53a" } ], "label": "frequency or situation", "guidelines": [ { "prose": "the frequency or situation requiring logging for each specified event type is defined;" } ] }, { "id": "au-02_odp.04", "props": [ { "name": "alt-identifier", "value": "au-2_prm_3" }, { "name": "label", "value": "AU-02_ODP[04]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency of event types selected for logging are reviewed and updated;" } ] } ], "props": [ { "name": "label", "value": "AU-02", "class": "zero-padded" }, { "name": "label", "value": "AU-2" }, { "name": "label", "value": "AU-02", "class": "sp800-53a" }, { "name": "sort-id", "value": "au-02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#5eee45d8-3313-4fdc-8d54-1742092bbdd6", "rel": "reference" }, { "href": "#ac-2", "rel": "related" }, { "href": "#ac-3", "rel": "related" }, { "href": "#ac-6", "rel": "related" }, { "href": "#ac-7", "rel": "related" }, { "href": "#ac-8", "rel": "related" }, { "href": "#ac-16", "rel": "related" }, { "href": "#ac-17", "rel": "related" }, { "href": "#au-3", "rel": "related" }, { "href": "#au-4", "rel": "related" }, { "href": "#au-5", "rel": "related" }, { "href": "#au-6", "rel": "related" }, { "href": "#au-7", "rel": "related" }, { "href": "#au-11", "rel": "related" }, { "href": "#au-12", "rel": "related" }, { "href": "#cm-3", "rel": "related" }, { "href": "#cm-5", "rel": "related" }, { "href": "#cm-6", "rel": "related" }, { "href": "#cm-13", "rel": "related" }, { "href": "#ia-3", "rel": "related" }, { "href": "#ma-4", "rel": "related" }, { "href": "#mp-4", "rel": "related" }, { "href": "#pe-3", "rel": "related" }, { "href": "#pm-21", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-7", "rel": "related" }, { "href": "#ra-8", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sc-7", "rel": "related" }, { "href": "#sc-18", "rel": "related" }, { "href": "#si-3", "rel": "related" }, { "href": "#si-4", "rel": "related" }, { "href": "#si-7", "rel": "related" }, { "href": "#si-10", "rel": "related" }, { "href": "#si-11", "rel": "related" } ], "parts": [ { "id": "au-2_smt", "name": "statement", "parts": [ { "id": "au-2_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Identify the types of events that the system is capable of logging in support of the audit function: {{ insert: param, au-02_odp.01 }};" }, { "id": "au-2_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;" }, { "id": "au-2_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Specify the following event types for logging within the system: {{ insert: param, au-2_prm_2 }};" }, { "id": "au-2_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and" }, { "id": "au-2_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Review and update the event types selected for logging {{ insert: param, au-02_odp.04 }}." } ] }, { "id": "au-2_gdn", "name": "guidance", "prose": "An event is an observable occurrence in a system. The types of events that require logging are those events that are significant and relevant to the security of systems and the privacy of individuals. Event logging also supports specific monitoring and auditing needs. Event types include password changes, failed logons or failed accesses related to systems, security or privacy attribute changes, administrative privilege usage, PIV credential usage, data action changes, query parameters, or external credential usage. In determining the set of event types that require logging, organizations consider the monitoring and auditing appropriate for each of the controls to be implemented. For completeness, event logging includes all protocols that are operational and supported by the system.\n\nTo balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. The types of events that organizations desire to be logged may change. Reviewing and updating the set of logged events is necessary to help ensure that the events remain relevant and continue to support the needs of the organization. Organizations consider how the types of logging events can reveal information about individuals that may give rise to privacy risk and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the logging event is based on patterns or time of usage.\n\nEvent logging requirements, including the need to log specific event types, may be referenced in other controls and control enhancements. These include [AC-2(4)](#ac-2.4), [AC-3(10)](#ac-3.10), [AC-6(9)](#ac-6.9), [AC-17(1)](#ac-17.1), [CM-3f](#cm-3_smt.f), [CM-5(1)](#cm-5.1), [IA-3(3)(b)](#ia-3.3_smt.b), [MA-4(1)](#ma-4.1), [MP-4(2)](#mp-4.2), [PE-3](#pe-3), [PM-21](#pm-21), [PT-7](#pt-7), [RA-8](#ra-8), [SC-7(9)](#sc-7.9), [SC-7(15)](#sc-7.15), [SI-3(8)](#si-3.8), [SI-4(22)](#si-4.22), [SI-7(8)](#si-7.8) , and [SI-10(1)](#si-10.1) . Organizations include event types that are required by applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. Audit records can be generated at various levels, including at the packet level as information traverses the network. Selecting the appropriate level of event logging is an important part of a monitoring and auditing capability and can identify the root causes of problems. When defining event types, organizations consider the logging necessary to cover related event types, such as the steps in distributed, transaction-based processes and the actions that occur in service-oriented architectures." }, { "id": "au-2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-02", "class": "sp800-53a" } ], "parts": [ { "id": "au-2_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-02a.", "class": "sp800-53a" } ], "prose": " {{ insert: param, au-02_odp.01 }} that the system is capable of logging are identified in support of the audit logging function;", "links": [ { "href": "#au-2_smt.a", "rel": "assessment-for" } ] }, { "id": "au-2_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-02b.", "class": "sp800-53a" } ], "prose": "the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;", "links": [ { "href": "#au-2_smt.b", "rel": "assessment-for" } ] }, { "id": "au-2_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-02c.", "class": "sp800-53a" } ], "parts": [ { "id": "au-2_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-02c.[01]", "class": "sp800-53a" } ], "prose": " {{ insert: param, au-02_odp.02 }} are specified for logging within the system;", "links": [ { "href": "#au-2_smt.c", "rel": "assessment-for" } ] }, { "id": "au-2_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-02c.[02]", "class": "sp800-53a" } ], "prose": "the specified event types are logged within the system {{ insert: param, au-02_odp.03 }};", "links": [ { "href": "#au-2_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#au-2_smt.c", "rel": "assessment-for" } ] }, { "id": "au-2_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-02d.", "class": "sp800-53a" } ], "prose": "a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents;", "links": [ { "href": "#au-2_smt.d", "rel": "assessment-for" } ] }, { "id": "au-2_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-02e.", "class": "sp800-53a" } ], "prose": "the event types selected for logging are reviewed and updated {{ insert: param, au-02_odp.04 }}.", "links": [ { "href": "#au-2_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#au-2_smt", "rel": "assessment-for" } ] }, { "id": "au-2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AU-02-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Audit and accountability policy\n\nprocedures addressing auditable events\n\nsystem security plan\n\nprivacy plan\n\nsystem design documentation\n\nsystem configuration settings and associated documentation\n\nsystem audit records\n\nsystem auditable events\n\nother relevant documents or records" } ] }, { "id": "au-2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AU-02-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with audit and accountability responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nsystem/network administrators" } ] }, { "id": "au-2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AU-02-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms implementing system auditing" } ] } ] }, { "id": "au-3.3", "class": "SP800-53-enhancement", "title": "Limit Personally Identifiable Information Elements", "params": [ { "id": "au-03.03_odp", "props": [ { "name": "alt-identifier", "value": "au-3.3_prm_1" }, { "name": "label", "value": "AU-03(03)_ODP", "class": "sp800-53a" } ], "label": "elements", "guidelines": [ { "prose": "elements identified in the privacy risk assessment are defined;" } ] } ], "props": [ { "name": "label", "value": "AU-03(03)", "class": "zero-padded" }, { "name": "label", "value": "AU-3(3)" }, { "name": "label", "value": "AU-03(03)", "class": "sp800-53a" }, { "name": "sort-id", "value": "au-03.03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#au-3", "rel": "required" }, { "href": "#ra-3", "rel": "related" } ], "parts": [ { "id": "au-3.3_smt", "name": "statement", "prose": "Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: {{ insert: param, au-03.03_odp }}." }, { "id": "au-3.3_gdn", "name": "guidance", "prose": "Limiting personally identifiable information in audit records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system." }, { "id": "au-3.3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-03(03)", "class": "sp800-53a" } ], "prose": "personally identifiable information contained in audit records is limited to {{ insert: param, au-03.03_odp }} identified in the privacy risk assessment.", "links": [ { "href": "#au-3.3_smt", "rel": "assessment-for" } ] }, { "id": "au-3.3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AU-03(03)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Audit and accountability policy\n\nsystem security plan\n\nprivacy plan\n\nprivacy risk assessment\n\nprivacy risk assessment results\n\nprocedures addressing content of audit records\n\nsystem design documentation\n\nsystem configuration settings and associated documentation\n\nlist of organization-defined auditable events\n\nsystem audit records\n\nthird party contracts\n\nother relevant documents or records" } ] }, { "id": "au-3.3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AU-03(03)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with audit and accountability responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nsystem/network administrators\n\nsystem developers" } ] }, { "id": "au-3.3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AU-03(03)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "system audit capability" } ] } ] }, { "id": "au-11", "class": "SP800-53", "title": "Audit Record Retention", "params": [ { "id": "au-11_odp", "props": [ { "name": "alt-identifier", "value": "au-11_prm_1" }, { "name": "alt-label", "value": "time period consistent with records retention policy", "class": "sp800-53" }, { "name": "label", "value": "AU-11_ODP", "class": "sp800-53a" } ], "label": "time period", "guidelines": [ { "prose": "a time period to retain audit records that is consistent with the records retention policy is defined;" } ] } ], "props": [ { "name": "label", "value": "AU-11", "class": "zero-padded" }, { "name": "label", "value": "AU-11" }, { "name": "label", "value": "AU-11", "class": "sp800-53a" }, { "name": "sort-id", "value": "au-11" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#au-2", "rel": "related" }, { "href": "#au-4", "rel": "related" }, { "href": "#au-5", "rel": "related" }, { "href": "#au-6", "rel": "related" }, { "href": "#au-9", "rel": "related" }, { "href": "#au-14", "rel": "related" }, { "href": "#mp-6", "rel": "related" }, { "href": "#ra-5", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "au-11_smt", "name": "statement", "prose": "Retain audit records for {{ insert: param, au-11_odp }} to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements." }, { "id": "au-11_gdn", "name": "guidance", "prose": "Organizations retain audit records until it is determined that the records are no longer needed for administrative, legal, audit, or other operational purposes. This includes the retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on records retention." }, { "id": "au-11_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AU-11", "class": "sp800-53a" } ], "prose": "audit records are retained for {{ insert: param, au-11_odp }} to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.", "links": [ { "href": "#au-11_smt", "rel": "assessment-for" } ] }, { "id": "au-11_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AU-11-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Audit and accountability policy\n\nsystem security plan\n\nprivacy plan\n\naudit record retention policy and procedures\n\nsecurity plan\n\norganization-defined retention period for audit records\n\naudit record archives\n\naudit logs\n\naudit records\n\nother relevant documents or records" } ] }, { "id": "au-11_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AU-11-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with audit record retention responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nsystem/network administrators" } ] } ] } ] }, { "id": "ca", "class": "family", "title": "Assessment, Authorization, and Monitoring", "props": [ { "name": "label", "value": "CA" } ], "controls": [ { "id": "ca-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "ca-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ca-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ca-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "ca-01_odp.01", "props": [ { "name": "label", "value": "CA-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated is/are defined;" } ] }, { "id": "ca-01_odp.02", "props": [ { "name": "label", "value": "CA-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the assessment, authorization, and monitoring procedures are to be disseminated is/are defined;" } ] }, { "id": "ca-01_odp.03", "props": [ { "name": "alt-identifier", "value": "ca-1_prm_2" }, { "name": "label", "value": "CA-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "ca-01_odp.04", "props": [ { "name": "alt-identifier", "value": "ca-1_prm_3" }, { "name": "label", "value": "CA-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the assessment, authorization, and monitoring policy and procedures is defined;" } ] }, { "id": "ca-01_odp.05", "props": [ { "name": "alt-identifier", "value": "ca-1_prm_4" }, { "name": "label", "value": "CA-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined;" } ] }, { "id": "ca-01_odp.06", "props": [ { "name": "alt-identifier", "value": "ca-1_prm_5" }, { "name": "label", "value": "CA-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined;" } ] }, { "id": "ca-01_odp.07", "props": [ { "name": "alt-identifier", "value": "ca-1_prm_6" }, { "name": "label", "value": "CA-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined;" } ] }, { "id": "ca-01_odp.08", "props": [ { "name": "alt-identifier", "value": "ca-1_prm_7" }, { "name": "label", "value": "CA-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "CA-01", "class": "zero-padded" }, { "name": "label", "value": "CA-1" }, { "name": "label", "value": "CA-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "ca-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#a21aef46-7330-48a0-b2e1-c5bb8b2dd11d", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#067223d8-1ec7-45c5-b21b-c848da6de8fb", "rel": "reference" }, { "href": "#62ea77ca-e450-4323-b210-e0d75390e785", "rel": "reference" }, { "href": "#98d415ca-7281-4064-9931-0c366637e324", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "ca-1_smt", "name": "statement", "parts": [ { "id": "ca-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, ca-1_prm_1 }}:", "parts": [ { "id": "ca-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, ca-01_odp.03 }} assessment, authorization, and monitoring policy that:", "parts": [ { "id": "ca-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "ca-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "ca-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;" } ] }, { "id": "ca-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, ca-01_odp.04 }} to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and" }, { "id": "ca-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current assessment, authorization, and monitoring:", "parts": [ { "id": "ca-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, ca-01_odp.05 }} and following {{ insert: param, ca-01_odp.06 }} ; and" }, { "id": "ca-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, ca-01_odp.07 }} and following {{ insert: param, ca-01_odp.08 }}." } ] } ] }, { "id": "ca-1_gdn", "name": "guidance", "prose": "Assessment, authorization, and monitoring policy and procedures address the controls in the CA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of assessment, authorization, and monitoring policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to assessment, authorization, and monitoring policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "ca-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01", "class": "sp800-53a" } ], "parts": [ { "id": "ca-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "ca-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.[01]", "class": "sp800-53a" } ], "prose": "an assessment, authorization, and monitoring policy is developed and documented;", "links": [ { "href": "#ca-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.[02]", "class": "sp800-53a" } ], "prose": "the assessment, authorization, and monitoring policy is disseminated to {{ insert: param, ca-01_odp.01 }};", "links": [ { "href": "#ca-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.[03]", "class": "sp800-53a" } ], "prose": "assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented;", "links": [ { "href": "#ca-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.[04]", "class": "sp800-53a" } ], "prose": "the assessment, authorization, and monitoring procedures are disseminated to {{ insert: param, ca-01_odp.02 }};", "links": [ { "href": "#ca-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "ca-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "ca-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ca-01_odp.03 }} assessment, authorization, and monitoring policy addresses purpose;", "links": [ { "href": "#ca-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ca-01_odp.03 }} assessment, authorization, and monitoring policy addresses scope;", "links": [ { "href": "#ca-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ca-01_odp.03 }} assessment, authorization, and monitoring policy addresses roles;", "links": [ { "href": "#ca-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ca-01_odp.03 }} assessment, authorization, and monitoring policy addresses responsibilities;", "links": [ { "href": "#ca-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ca-01_odp.03 }} assessment, authorization, and monitoring policy addresses management commitment;", "links": [ { "href": "#ca-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ca-01_odp.03 }} assessment, authorization, and monitoring policy addresses coordination among organizational entities;", "links": [ { "href": "#ca-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ca-01_odp.03 }} assessment, authorization, and monitoring policy addresses compliance;", "links": [ { "href": "#ca-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ca-01_odp.03 }} assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#ca-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ca-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures;", "links": [ { "href": "#ca-1_smt.b", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "ca-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "ca-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current assessment, authorization, and monitoring policy is reviewed and updated {{ insert: param, ca-01_odp.05 }}; ", "links": [ { "href": "#ca-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current assessment, authorization, and monitoring policy is reviewed and updated following {{ insert: param, ca-01_odp.06 }};", "links": [ { "href": "#ca-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "ca-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current assessment, authorization, and monitoring procedures are reviewed and updated {{ insert: param, ca-01_odp.07 }}; ", "links": [ { "href": "#ca-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "ca-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current assessment, authorization, and monitoring procedures are reviewed and updated following {{ insert: param, ca-01_odp.08 }}.", "links": [ { "href": "#ca-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-1_smt", "rel": "assessment-for" } ] }, { "id": "ca-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "CA-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Assessment, authorization, and monitoring policy and procedures\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ca-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "CA-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with assessment, authorization, and monitoring policy responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "ca-2", "class": "SP800-53", "title": "Control Assessments", "params": [ { "id": "ca-02_odp.01", "props": [ { "name": "alt-identifier", "value": "ca-2_prm_1" }, { "name": "alt-label", "value": "frequency", "class": "sp800-53" }, { "name": "label", "value": "CA-02_ODP[01]", "class": "sp800-53a" } ], "label": "assessment frequency", "guidelines": [ { "prose": "the frequency at which to assess controls in the system and its environment of operation is defined;" } ] }, { "id": "ca-02_odp.02", "props": [ { "name": "alt-identifier", "value": "ca-2_prm_2" }, { "name": "label", "value": "CA-02_ODP[02]", "class": "sp800-53a" } ], "label": "individuals or roles", "guidelines": [ { "prose": "individuals or roles to whom control assessment results are to be provided are defined;" } ] } ], "props": [ { "name": "label", "value": "CA-02", "class": "zero-padded" }, { "name": "label", "value": "CA-2" }, { "name": "label", "value": "CA-02", "class": "sp800-53a" }, { "name": "sort-id", "value": "ca-02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#30eb758a-2707-4bca-90ad-949a74d4eb16", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#a21aef46-7330-48a0-b2e1-c5bb8b2dd11d", "rel": "reference" }, { "href": "#122177fa-c4ed-485d-8345-3082c0fb9a06", "rel": "reference" }, { "href": "#067223d8-1ec7-45c5-b21b-c848da6de8fb", "rel": "reference" }, { "href": "#bbac9fc2-df5b-4f2d-bf99-90d0ade45349", "rel": "reference" }, { "href": "#98d415ca-7281-4064-9931-0c366637e324", "rel": "reference" }, { "href": "#ac-20", "rel": "related" }, { "href": "#ca-5", "rel": "related" }, { "href": "#ca-6", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ra-5", "rel": "related" }, { "href": "#ra-10", "rel": "related" }, { "href": "#sa-11", "rel": "related" }, { "href": "#sc-38", "rel": "related" }, { "href": "#si-3", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#sr-2", "rel": "related" }, { "href": "#sr-3", "rel": "related" } ], "parts": [ { "id": "ca-2_smt", "name": "statement", "parts": [ { "id": "ca-2_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Select the appropriate assessor or assessment team for the type of assessment to be conducted;" }, { "id": "ca-2_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Develop a control assessment plan that describes the scope of the assessment including:", "parts": [ { "id": "ca-2_smt.b.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Controls and control enhancements under assessment;" }, { "id": "ca-2_smt.b.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Assessment procedures to be used to determine control effectiveness; and" }, { "id": "ca-2_smt.b.3", "name": "item", "props": [ { "name": "label", "value": "3." } ], "prose": "Assessment environment, assessment team, and assessment roles and responsibilities;" } ] }, { "id": "ca-2_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;" }, { "id": "ca-2_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Assess the controls in the system and its environment of operation {{ insert: param, ca-02_odp.01 }} to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;" }, { "id": "ca-2_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Produce a control assessment report that document the results of the assessment; and" }, { "id": "ca-2_smt.f", "name": "item", "props": [ { "name": "label", "value": "f." } ], "prose": "Provide the results of the control assessment to {{ insert: param, ca-02_odp.02 }}." } ] }, { "id": "ca-2_gdn", "name": "guidance", "prose": "Organizations ensure that control assessors possess the required skills and technical expertise to develop effective assessment plans and to conduct assessments of system-specific, hybrid, common, and program management controls, as appropriate. The required skills include general knowledge of risk management concepts and approaches as well as comprehensive knowledge of and experience with the hardware, software, and firmware system components implemented.\n\nOrganizations assess controls in systems and the environments in which those systems operate as part of initial and ongoing authorizations, continuous monitoring, FISMA annual assessments, system design and development, systems security engineering, privacy engineering, and the system development life cycle. Assessments help to ensure that organizations meet information security and privacy requirements, identify weaknesses and deficiencies in the system design and development process, provide essential information needed to make risk-based decisions as part of authorization processes, and comply with vulnerability mitigation procedures. Organizations conduct assessments on the implemented controls as documented in security and privacy plans. Assessments can also be conducted throughout the system development life cycle as part of systems engineering and systems security engineering processes. The design for controls can be assessed as RFPs are developed, responses assessed, and design reviews conducted. If a design to implement controls and subsequent implementation in accordance with the design are assessed during development, the final control testing can be a simple confirmation utilizing previously completed control assessment and aggregating the outcomes.\n\nOrganizations may develop a single, consolidated security and privacy assessment plan for the system or maintain separate plans. A consolidated assessment plan clearly delineates the roles and responsibilities for control assessment. If multiple organizations participate in assessing a system, a coordinated approach can reduce redundancies and associated costs.\n\nOrganizations can use other types of assessment activities, such as vulnerability scanning and system monitoring, to maintain the security and privacy posture of systems during the system life cycle. Assessment reports document assessment results in sufficient detail, as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting requirements. Assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted. For example, assessments conducted in support of authorization decisions are provided to authorizing officials, senior agency officials for privacy, senior agency information security officers, and authorizing official designated representatives.\n\nTo satisfy annual assessment requirements, organizations can use assessment results from the following sources: initial or ongoing system authorizations, continuous monitoring, systems engineering processes, or system development life cycle activities. Organizations ensure that assessment results are current, relevant to the determination of control effectiveness, and obtained with the appropriate level of assessor independence. Existing control assessment results can be reused to the extent that the results are still valid and can also be supplemented with additional assessments as needed. After the initial authorizations, organizations assess controls during continuous monitoring. Organizations also establish the frequency for ongoing assessments in accordance with organizational continuous monitoring strategies. External audits, including audits by external entities such as regulatory agencies, are outside of the scope of [CA-2](#ca-2)." }, { "id": "ca-2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02", "class": "sp800-53a" } ], "parts": [ { "id": "ca-2_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02a.", "class": "sp800-53a" } ], "prose": "an appropriate assessor or assessment team is selected for the type of assessment to be conducted;", "links": [ { "href": "#ca-2_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02b.", "class": "sp800-53a" } ], "parts": [ { "id": "ca-2_obj.b.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02b.01", "class": "sp800-53a" } ], "prose": "a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;", "links": [ { "href": "#ca-2_smt.b.1", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.b.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02b.02", "class": "sp800-53a" } ], "prose": "a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness;", "links": [ { "href": "#ca-2_smt.b.2", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.b.3", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02b.03", "class": "sp800-53a" } ], "parts": [ { "id": "ca-2_obj.b.3-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02b.03[01]", "class": "sp800-53a" } ], "prose": "a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;", "links": [ { "href": "#ca-2_smt.b.3", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.b.3-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02b.03[02]", "class": "sp800-53a" } ], "prose": "a control assessment plan is developed that describes the scope of the assessment, including the assessment team;", "links": [ { "href": "#ca-2_smt.b.3", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.b.3-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02b.03[03]", "class": "sp800-53a" } ], "prose": "a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities;", "links": [ { "href": "#ca-2_smt.b.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-2_smt.b.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-2_smt.b", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02c.", "class": "sp800-53a" } ], "prose": "the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;", "links": [ { "href": "#ca-2_smt.c", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02d.", "class": "sp800-53a" } ], "parts": [ { "id": "ca-2_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02d.[01]", "class": "sp800-53a" } ], "prose": "controls are assessed in the system and its environment of operation {{ insert: param, ca-02_odp.01 }} to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;", "links": [ { "href": "#ca-2_smt.d", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02d.[02]", "class": "sp800-53a" } ], "prose": "controls are assessed in the system and its environment of operation {{ insert: param, ca-02_odp.01 }} to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements;", "links": [ { "href": "#ca-2_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-2_smt.d", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02e.", "class": "sp800-53a" } ], "prose": "a control assessment report is produced that documents the results of the assessment;", "links": [ { "href": "#ca-2_smt.e", "rel": "assessment-for" } ] }, { "id": "ca-2_obj.f", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-02f.", "class": "sp800-53a" } ], "prose": "the results of the control assessment are provided to {{ insert: param, ca-02_odp.02 }}.", "links": [ { "href": "#ca-2_smt.f", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-2_smt", "rel": "assessment-for" } ] }, { "id": "ca-2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "CA-02-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Assessment, authorization, and monitoring policy\n\nprocedures addressing assessment planning\n\nprocedures addressing control assessments\n\ncontrol assessment plan\n\ncontrol assessment report\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ca-2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "CA-02-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with control assessment responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ca-2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "CA-02-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms supporting control assessment, control assessment plan development, and/or control assessment reporting" } ] } ] }, { "id": "ca-5", "class": "SP800-53", "title": "Plan of Action and Milestones", "params": [ { "id": "ca-05_odp", "props": [ { "name": "alt-identifier", "value": "ca-5_prm_1" }, { "name": "label", "value": "CA-05_ODP", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities is defined;" } ] } ], "props": [ { "name": "label", "value": "CA-05", "class": "zero-padded" }, { "name": "label", "value": "CA-5" }, { "name": "label", "value": "CA-05", "class": "sp800-53a" }, { "name": "sort-id", "value": "ca-05" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#ca-2", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#pm-4", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ra-7", "rel": "related" }, { "href": "#si-2", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "ca-5_smt", "name": "statement", "parts": [ { "id": "ca-5_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and" }, { "id": "ca-5_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Update existing plan of action and milestones {{ insert: param, ca-05_odp }} based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities." } ] }, { "id": "ca-5_gdn", "name": "guidance", "prose": "Plans of action and milestones are useful for any type of organization to track planned remedial actions. Plans of action and milestones are required in authorization packages and subject to federal reporting requirements established by OMB." }, { "id": "ca-5_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-05", "class": "sp800-53a" } ], "parts": [ { "id": "ca-5_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-05a.", "class": "sp800-53a" } ], "prose": "a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system;", "links": [ { "href": "#ca-5_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-5_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-05b.", "class": "sp800-53a" } ], "prose": "existing plan of action and milestones are updated {{ insert: param, ca-05_odp }} based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.", "links": [ { "href": "#ca-5_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-5_smt", "rel": "assessment-for" } ] }, { "id": "ca-5_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "CA-05-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Assessment, authorization, and monitoring policy\n\nprocedures addressing plan of action and milestones\n\ncontrol assessment plan\n\ncontrol assessment report\n\ncontrol assessment evidence\n\nplan of action and milestones\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ca-5_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "CA-05-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with plan of action and milestones development and implementation responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ca-5_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "CA-05-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms for developing, implementing, and maintaining plan of action and milestones" } ] } ] }, { "id": "ca-6", "class": "SP800-53", "title": "Authorization", "params": [ { "id": "ca-06_odp", "props": [ { "name": "alt-identifier", "value": "ca-6_prm_1" }, { "name": "label", "value": "CA-06_ODP", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency at which to update the authorizations is defined;" } ] } ], "props": [ { "name": "label", "value": "CA-06", "class": "zero-padded" }, { "name": "label", "value": "CA-6" }, { "name": "label", "value": "CA-06", "class": "sp800-53a" }, { "name": "sort-id", "value": "ca-06" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#067223d8-1ec7-45c5-b21b-c848da6de8fb", "rel": "reference" }, { "href": "#ca-2", "rel": "related" }, { "href": "#ca-3", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-10", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#sa-10", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "ca-6_smt", "name": "statement", "parts": [ { "id": "ca-6_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Assign a senior official as the authorizing official for the system;" }, { "id": "ca-6_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;" }, { "id": "ca-6_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Ensure that the authorizing official for the system, before commencing operations:", "parts": [ { "id": "ca-6_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Accepts the use of common controls inherited by the system; and" }, { "id": "ca-6_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Authorizes the system to operate;" } ] }, { "id": "ca-6_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;" }, { "id": "ca-6_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Update the authorizations {{ insert: param, ca-06_odp }}." } ] }, { "id": "ca-6_gdn", "name": "guidance", "prose": "Authorizations are official management decisions by senior officials to authorize operation of systems, authorize the use of common controls for inheritance by organizational systems, and explicitly accept the risk to organizational operations and assets, individuals, other organizations, and the Nation based on the implementation of agreed-upon controls. Authorizing officials provide budgetary oversight for organizational systems and common controls or assume responsibility for the mission and business functions supported by those systems or common controls. The authorization process is a federal responsibility, and therefore, authorizing officials must be federal employees. Authorizing officials are both responsible and accountable for security and privacy risks associated with the operation and use of organizational systems. Nonfederal organizations may have similar processes to authorize systems and senior officials that assume the authorization role and associated responsibilities.\n\nAuthorizing officials issue ongoing authorizations of systems based on evidence produced from implemented continuous monitoring programs. Robust continuous monitoring programs reduce the need for separate reauthorization processes. Through the employment of comprehensive continuous monitoring processes, the information contained in authorization packages (i.e., security and privacy plans, assessment reports, and plans of action and milestones) is updated on an ongoing basis. This provides authorizing officials, common control providers, and system owners with an up-to-date status of the security and privacy posture of their systems, controls, and operating environments. To reduce the cost of reauthorization, authorizing officials can leverage the results of continuous monitoring processes to the maximum extent possible as the basis for rendering reauthorization decisions." }, { "id": "ca-6_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-06", "class": "sp800-53a" } ], "parts": [ { "id": "ca-6_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-06a.", "class": "sp800-53a" } ], "prose": "a senior official is assigned as the authorizing official for the system;", "links": [ { "href": "#ca-6_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-6_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-06b.", "class": "sp800-53a" } ], "prose": "a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems;", "links": [ { "href": "#ca-6_smt.b", "rel": "assessment-for" } ] }, { "id": "ca-6_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-06c.", "class": "sp800-53a" } ], "parts": [ { "id": "ca-6_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-06c.01", "class": "sp800-53a" } ], "prose": "before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system;", "links": [ { "href": "#ca-6_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ca-6_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-06c.02", "class": "sp800-53a" } ], "prose": "before commencing operations, the authorizing official for the system authorizes the system to operate;", "links": [ { "href": "#ca-6_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-6_smt.c", "rel": "assessment-for" } ] }, { "id": "ca-6_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-06d.", "class": "sp800-53a" } ], "prose": "the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;", "links": [ { "href": "#ca-6_smt.d", "rel": "assessment-for" } ] }, { "id": "ca-6_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-06e.", "class": "sp800-53a" } ], "prose": "the authorizations are updated {{ insert: param, ca-06_odp }}.", "links": [ { "href": "#ca-6_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-6_smt", "rel": "assessment-for" } ] }, { "id": "ca-6_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "CA-06-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Assessment, authorization, and monitoring policy\n\nprocedures addressing authorization\n\nsystem security plan, privacy plan, assessment report, plan of action and milestones\n\nauthorization statement\n\nother relevant documents or records" } ] }, { "id": "ca-6_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "CA-06-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with authorization responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ca-6_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "CA-06-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms that facilitate authorizations and updates" } ] } ] }, { "id": "ca-7", "class": "SP800-53", "title": "Continuous Monitoring", "params": [ { "id": "ca-7_prm_4", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ca-07_odp.04" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ca-07_odp.06" } ], "label": "organization-defined personnel or roles" }, { "id": "ca-7_prm_5", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ca-07_odp.05" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ca-07_odp.07" } ], "label": "organization-defined frequency" }, { "id": "ca-07_odp.01", "props": [ { "name": "alt-identifier", "value": "ca-7_prm_1" }, { "name": "label", "value": "CA-07_ODP[01]", "class": "sp800-53a" } ], "label": "system-level metrics", "guidelines": [ { "prose": "system-level metrics to be monitored are defined;" } ] }, { "id": "ca-07_odp.02", "props": [ { "name": "alt-identifier", "value": "ca-7_prm_2" }, { "name": "label", "value": "CA-07_ODP[02]", "class": "sp800-53a" } ], "label": "frequencies", "guidelines": [ { "prose": "frequencies at which to monitor control effectiveness are defined;" } ] }, { "id": "ca-07_odp.03", "props": [ { "name": "alt-identifier", "value": "ca-7_prm_3" }, { "name": "label", "value": "CA-07_ODP[03]", "class": "sp800-53a" } ], "label": "frequencies", "guidelines": [ { "prose": "frequencies at which to assess control effectiveness are defined;" } ] }, { "id": "ca-07_odp.04", "props": [ { "name": "label", "value": "CA-07_ODP[04]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the security status of the system is reported are defined;" } ] }, { "id": "ca-07_odp.05", "props": [ { "name": "label", "value": "CA-07_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency at which the security status of the system is reported is defined;" } ] }, { "id": "ca-07_odp.06", "props": [ { "name": "label", "value": "CA-07_ODP[06]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the privacy status of the system is reported are defined;" } ] }, { "id": "ca-07_odp.07", "props": [ { "name": "label", "value": "CA-07_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency at which the privacy status of the system is reported is defined;" } ] } ], "props": [ { "name": "label", "value": "CA-07", "class": "zero-padded" }, { "name": "label", "value": "CA-7" }, { "name": "label", "value": "CA-07", "class": "sp800-53a" }, { "name": "sort-id", "value": "ca-07" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#a21aef46-7330-48a0-b2e1-c5bb8b2dd11d", "rel": "reference" }, { "href": "#122177fa-c4ed-485d-8345-3082c0fb9a06", "rel": "reference" }, { "href": "#067223d8-1ec7-45c5-b21b-c848da6de8fb", "rel": "reference" }, { "href": "#bbac9fc2-df5b-4f2d-bf99-90d0ade45349", "rel": "reference" }, { "href": "#98d415ca-7281-4064-9931-0c366637e324", "rel": "reference" }, { "href": "#ac-2", "rel": "related" }, { "href": "#ac-6", "rel": "related" }, { "href": "#ac-17", "rel": "related" }, { "href": "#at-4", "rel": "related" }, { "href": "#au-6", "rel": "related" }, { "href": "#au-13", "rel": "related" }, { "href": "#ca-2", "rel": "related" }, { "href": "#ca-5", "rel": "related" }, { "href": "#ca-6", "rel": "related" }, { "href": "#cm-3", "rel": "related" }, { "href": "#cm-4", "rel": "related" }, { "href": "#cm-6", "rel": "related" }, { "href": "#cm-11", "rel": "related" }, { "href": "#ia-5", "rel": "related" }, { "href": "#ir-5", "rel": "related" }, { "href": "#ma-2", "rel": "related" }, { "href": "#ma-3", "rel": "related" }, { "href": "#ma-4", "rel": "related" }, { "href": "#pe-3", "rel": "related" }, { "href": "#pe-6", "rel": "related" }, { "href": "#pe-14", "rel": "related" }, { "href": "#pe-16", "rel": "related" }, { "href": "#pe-20", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pm-4", "rel": "related" }, { "href": "#pm-6", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-10", "rel": "related" }, { "href": "#pm-12", "rel": "related" }, { "href": "#pm-14", "rel": "related" }, { "href": "#pm-23", "rel": "related" }, { "href": "#pm-28", "rel": "related" }, { "href": "#pm-31", "rel": "related" }, { "href": "#ps-7", "rel": "related" }, { "href": "#pt-7", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#ra-5", "rel": "related" }, { "href": "#ra-7", "rel": "related" }, { "href": "#ra-10", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-9", "rel": "related" }, { "href": "#sa-11", "rel": "related" }, { "href": "#sc-5", "rel": "related" }, { "href": "#sc-7", "rel": "related" }, { "href": "#sc-18", "rel": "related" }, { "href": "#sc-38", "rel": "related" }, { "href": "#sc-43", "rel": "related" }, { "href": "#si-3", "rel": "related" }, { "href": "#si-4", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#sr-6", "rel": "related" } ], "parts": [ { "id": "ca-7_smt", "name": "statement", "prose": "Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:", "parts": [ { "id": "ca-7_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Establishing the following system-level metrics to be monitored: {{ insert: param, ca-07_odp.01 }};" }, { "id": "ca-7_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Establishing {{ insert: param, ca-07_odp.02 }} for monitoring and {{ insert: param, ca-07_odp.03 }} for assessment of control effectiveness;" }, { "id": "ca-7_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Ongoing control assessments in accordance with the continuous monitoring strategy;" }, { "id": "ca-7_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;" }, { "id": "ca-7_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Correlation and analysis of information generated by control assessments and monitoring;" }, { "id": "ca-7_smt.f", "name": "item", "props": [ { "name": "label", "value": "f." } ], "prose": "Response actions to address results of the analysis of control assessment and monitoring information; and" }, { "id": "ca-7_smt.g", "name": "item", "props": [ { "name": "label", "value": "g." } ], "prose": "Reporting the security and privacy status of the system to {{ insert: param, ca-7_prm_4 }} {{ insert: param, ca-7_prm_5 }}." } ] }, { "id": "ca-7_gdn", "name": "guidance", "prose": "Continuous monitoring at the system level facilitates ongoing awareness of the system security and privacy posture to support organizational risk management decisions. The terms \"continuous\" and \"ongoing\" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring generate risk response actions by organizations. When monitoring the effectiveness of multiple controls that have been grouped into capabilities, a root-cause analysis may be needed to determine the specific control that has failed. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security and privacy information on a continuing basis through reports and dashboards gives organizational officials the ability to make effective and timely risk management decisions, including ongoing authorization decisions.\n\nAutomation supports more frequent updates to hardware, software, and firmware inventories, authorization packages, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Continuous monitoring activities are scaled in accordance with the security categories of systems. Monitoring requirements, including the need for specific monitoring, may be referenced in other controls and control enhancements, such as [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-2(7)(b)](#ac-2.7_smt.b), [AC-2(7)(c)](#ac-2.7_smt.c), [AC-17(1)](#ac-17.1), [AT-4a](#at-4_smt.a), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [CM-11c](#cm-11_smt.c), [IR-5](#ir-5), [MA-2b](#ma-2_smt.b), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [PE-3d](#pe-3_smt.d), [PE-6](#pe-6), [PE-14b](#pe-14_smt.b), [PE-16](#pe-16), [PE-20](#pe-20), [PM-6](#pm-6), [PM-23](#pm-23), [PM-31](#pm-31), [PS-7e](#ps-7_smt.e), [SA-9c](#sa-9_smt.c), [SR-4](#sr-4), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) , and [SI-4](#si-4)." }, { "id": "ca-7_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07", "class": "sp800-53a" } ], "parts": [ { "id": "ca-7_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07[01]", "class": "sp800-53a" } ], "prose": "a system-level continuous monitoring strategy is developed;", "links": [ { "href": "#ca-7_smt", "rel": "assessment-for" } ] }, { "id": "ca-7_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07[02]", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy;", "links": [ { "href": "#ca-7_smt", "rel": "assessment-for" } ] }, { "id": "ca-7_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07a.", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: {{ insert: param, ca-07_odp.01 }};", "links": [ { "href": "#ca-7_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-7_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07b.", "class": "sp800-53a" } ], "parts": [ { "id": "ca-7_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07b.[01]", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring includes established {{ insert: param, ca-07_odp.02 }} for monitoring;", "links": [ { "href": "#ca-7_smt.b", "rel": "assessment-for" } ] }, { "id": "ca-7_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07b.[02]", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring includes established {{ insert: param, ca-07_odp.03 }} for assessment of control effectiveness;", "links": [ { "href": "#ca-7_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-7_smt.b", "rel": "assessment-for" } ] }, { "id": "ca-7_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07c.", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy;", "links": [ { "href": "#ca-7_smt.c", "rel": "assessment-for" } ] }, { "id": "ca-7_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07d.", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;", "links": [ { "href": "#ca-7_smt.d", "rel": "assessment-for" } ] }, { "id": "ca-7_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07e.", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring;", "links": [ { "href": "#ca-7_smt.e", "rel": "assessment-for" } ] }, { "id": "ca-7_obj.f", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07f.", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information;", "links": [ { "href": "#ca-7_smt.f", "rel": "assessment-for" } ] }, { "id": "ca-7_obj.g", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07g.", "class": "sp800-53a" } ], "parts": [ { "id": "ca-7_obj.g-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07g.[01]", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring includes reporting the security status of the system to {{ insert: param, ca-07_odp.04 }} {{ insert: param, ca-07_odp.05 }};", "links": [ { "href": "#ca-7_smt.g", "rel": "assessment-for" } ] }, { "id": "ca-7_obj.g-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07g.[02]", "class": "sp800-53a" } ], "prose": "system-level continuous monitoring includes reporting the privacy status of the system to {{ insert: param, ca-07_odp.06 }} {{ insert: param, ca-07_odp.07 }}.", "links": [ { "href": "#ca-7_smt.g", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-7_smt.g", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-7_smt", "rel": "assessment-for" } ] }, { "id": "ca-7_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "CA-07-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Assessment, authorization, and monitoring policy\n\norganizational continuous monitoring strategy\n\nsystem-level continuous monitoring strategy\n\nprocedures addressing continuous monitoring of system controls\n\nprocedures addressing configuration management\n\ncontrol assessment report\n\nplan of action and milestones\n\nsystem monitoring records\n\nconfiguration management records\n\nimpact analyses\n\nstatus reports\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ca-7_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "CA-07-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with continuous monitoring responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nsystem/network administrators" } ] }, { "id": "ca-7_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "CA-07-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms implementing continuous monitoring\n\nmechanisms supporting response actions to address assessment and monitoring results\n\nmechanisms supporting security and privacy status reporting" } ] } ], "controls": [ { "id": "ca-7.4", "class": "SP800-53-enhancement", "title": "Risk Monitoring", "props": [ { "name": "label", "value": "CA-07(04)", "class": "zero-padded" }, { "name": "label", "value": "CA-7(4)" }, { "name": "label", "value": "CA-07(04)", "class": "sp800-53a" }, { "name": "sort-id", "value": "ca-07.04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "system" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#ca-7", "rel": "required" } ], "parts": [ { "id": "ca-7.4_smt", "name": "statement", "prose": "Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following:", "parts": [ { "id": "ca-7.4_smt.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Effectiveness monitoring;" }, { "id": "ca-7.4_smt.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Compliance monitoring; and" }, { "id": "ca-7.4_smt.c", "name": "item", "props": [ { "name": "label", "value": "(c)" } ], "prose": "Change monitoring." } ] }, { "id": "ca-7.4_gdn", "name": "guidance", "prose": "Risk monitoring is informed by the established organizational risk tolerance. Effectiveness monitoring determines the ongoing effectiveness of the implemented risk response measures. Compliance monitoring verifies that required risk response measures are implemented. It also verifies that security and privacy requirements are satisfied. Change monitoring identifies changes to organizational systems and environments of operation that may affect security and privacy risk." }, { "id": "ca-7.4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07(04)", "class": "sp800-53a" } ], "prose": "risk monitoring is an integral part of the continuous monitoring strategy;", "parts": [ { "id": "ca-7.4_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07(04)(a)", "class": "sp800-53a" } ], "prose": "effectiveness monitoring is included in risk monitoring;", "links": [ { "href": "#ca-7.4_smt.a", "rel": "assessment-for" } ] }, { "id": "ca-7.4_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07(04)(b)", "class": "sp800-53a" } ], "prose": "compliance monitoring is included in risk monitoring;", "links": [ { "href": "#ca-7.4_smt.b", "rel": "assessment-for" } ] }, { "id": "ca-7.4_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "CA-07(04)(c)", "class": "sp800-53a" } ], "prose": "change monitoring is included in risk monitoring.", "links": [ { "href": "#ca-7.4_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ca-7.4_smt", "rel": "assessment-for" } ] }, { "id": "ca-7.4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "CA-07(04)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Assessment, authorization, and monitoring policy\n\norganizational continuous monitoring strategy\n\nsystem-level continuous monitoring strategy\n\nprocedures addressing continuous monitoring of system controls\n\nassessment report\n\nplan of action and milestones\n\nsystem monitoring records\n\nimpact analyses\n\nstatus reports\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ca-7.4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "CA-07(04)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with continuous monitoring responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ca-7.4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "CA-07(04)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms supporting risk monitoring" } ] } ] } ] } ] }, { "id": "cm", "class": "family", "title": "Configuration Management", "props": [ { "name": "label", "value": "CM" } ], "controls": [ { "id": "cm-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "cm-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "cm-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "cm-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "cm-01_odp.01", "props": [ { "name": "label", "value": "CM-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the configuration management policy is to be disseminated is/are defined;" } ] }, { "id": "cm-01_odp.02", "props": [ { "name": "label", "value": "CM-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the configuration management procedures are to be disseminated is/are defined;" } ] }, { "id": "cm-01_odp.03", "props": [ { "name": "alt-identifier", "value": "cm-1_prm_2" }, { "name": "label", "value": "CM-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "cm-01_odp.04", "props": [ { "name": "alt-identifier", "value": "cm-1_prm_3" }, { "name": "label", "value": "CM-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the configuration management policy and procedures is defined;" } ] }, { "id": "cm-01_odp.05", "props": [ { "name": "alt-identifier", "value": "cm-1_prm_4" }, { "name": "label", "value": "CM-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current configuration management policy is reviewed and updated is defined;" } ] }, { "id": "cm-01_odp.06", "props": [ { "name": "alt-identifier", "value": "cm-1_prm_5" }, { "name": "label", "value": "CM-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current configuration management policy to be reviewed and updated are defined;" } ] }, { "id": "cm-01_odp.07", "props": [ { "name": "alt-identifier", "value": "cm-1_prm_6" }, { "name": "label", "value": "CM-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current configuration management procedures are reviewed and updated is defined;" } ] }, { "id": "cm-01_odp.08", "props": [ { "name": "alt-identifier", "value": "cm-1_prm_7" }, { "name": "label", "value": "CM-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require configuration management procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "CM-01", "class": "zero-padded" }, { "name": "label", "value": "CM-1" }, { "name": "label", "value": "CM-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "cm-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "cm-1_smt", "name": "statement", "parts": [ { "id": "cm-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, cm-1_prm_1 }}:", "parts": [ { "id": "cm-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, cm-01_odp.03 }} configuration management policy that:", "parts": [ { "id": "cm-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "cm-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "cm-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the configuration management policy and the associated configuration management controls;" } ] }, { "id": "cm-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, cm-01_odp.04 }} to manage the development, documentation, and dissemination of the configuration management policy and procedures; and" }, { "id": "cm-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current configuration management:", "parts": [ { "id": "cm-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, cm-01_odp.05 }} and following {{ insert: param, cm-01_odp.06 }} ; and" }, { "id": "cm-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, cm-01_odp.07 }} and following {{ insert: param, cm-01_odp.08 }}." } ] } ] }, { "id": "cm-1_gdn", "name": "guidance", "prose": "Configuration management policy and procedures address the controls in the CM family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of configuration management policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission/business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to configuration management policy and procedures include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "cm-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01", "class": "sp800-53a" } ], "parts": [ { "id": "cm-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "cm-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.[01]", "class": "sp800-53a" } ], "prose": "a configuration management policy is developed and documented;", "links": [ { "href": "#cm-1_smt.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.[02]", "class": "sp800-53a" } ], "prose": "the configuration management policy is disseminated to {{ insert: param, cm-01_odp.01 }};", "links": [ { "href": "#cm-1_smt.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.[03]", "class": "sp800-53a" } ], "prose": "configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented;", "links": [ { "href": "#cm-1_smt.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.[04]", "class": "sp800-53a" } ], "prose": "the configuration management procedures are disseminated to {{ insert: param, cm-01_odp.02 }};", "links": [ { "href": "#cm-1_smt.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "cm-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "cm-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, cm-01_odp.03 }} of the configuration management policy addresses purpose;", "links": [ { "href": "#cm-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, cm-01_odp.03 }} of the configuration management policy addresses scope;", "links": [ { "href": "#cm-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, cm-01_odp.03 }} of the configuration management policy addresses roles;", "links": [ { "href": "#cm-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, cm-01_odp.03 }} of the configuration management policy addresses responsibilities;", "links": [ { "href": "#cm-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, cm-01_odp.03 }} of the configuration management policy addresses management commitment;", "links": [ { "href": "#cm-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, cm-01_odp.03 }} of the configuration management policy addresses coordination among organizational entities;", "links": [ { "href": "#cm-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, cm-01_odp.03 }} of the configuration management policy addresses compliance;", "links": [ { "href": "#cm-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#cm-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01a.01(b)", "class": "sp800-53a" } ], "prose": "the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#cm-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#cm-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#cm-1_smt.a", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, cm-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures;", "links": [ { "href": "#cm-1_smt.b", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "cm-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "cm-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current configuration management policy is reviewed and updated {{ insert: param, cm-01_odp.05 }}; ", "links": [ { "href": "#cm-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current configuration management policy is reviewed and updated following {{ insert: param, cm-01_odp.06 }};", "links": [ { "href": "#cm-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#cm-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "cm-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current configuration management procedures are reviewed and updated {{ insert: param, cm-01_odp.07 }}; ", "links": [ { "href": "#cm-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "cm-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current configuration management procedures are reviewed and updated following {{ insert: param, cm-01_odp.08 }}.", "links": [ { "href": "#cm-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#cm-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#cm-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#cm-1_smt", "rel": "assessment-for" } ] }, { "id": "cm-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "CM-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Configuration management policy and procedures\n\nsecurity and privacy program policies and procedures\n\nassessment or audit findings\n\ndocumentation of security incidents or breaches\n\nsystem security plan\n\nprivacy plan\n\nrisk management strategy\n\nother relevant artifacts, documents, or records" } ] }, { "id": "cm-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "CM-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with configuration management responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "cm-4", "class": "SP800-53", "title": "Impact Analyses", "props": [ { "name": "label", "value": "CM-04", "class": "zero-padded" }, { "name": "label", "value": "CM-4" }, { "name": "label", "value": "CM-04", "class": "sp800-53a" }, { "name": "sort-id", "value": "cm-04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#20db4e66-e257-450c-b2e4-2bb9a62a2c88", "rel": "reference" }, { "href": "#ca-7", "rel": "related" }, { "href": "#cm-3", "rel": "related" }, { "href": "#cm-8", "rel": "related" }, { "href": "#cm-9", "rel": "related" }, { "href": "#ma-2", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#ra-5", "rel": "related" }, { "href": "#ra-8", "rel": "related" }, { "href": "#sa-5", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-10", "rel": "related" }, { "href": "#si-2", "rel": "related" } ], "parts": [ { "id": "cm-4_smt", "name": "statement", "prose": "Analyze changes to the system to determine potential security and privacy impacts prior to change implementation." }, { "id": "cm-4_gdn", "name": "guidance", "prose": "Organizational personnel with security or privacy responsibilities conduct impact analyses. Individuals conducting impact analyses possess the necessary skills and technical expertise to analyze the changes to systems as well as the security or privacy ramifications. Impact analyses include reviewing security and privacy plans, policies, and procedures to understand control requirements; reviewing system design documentation and operational procedures to understand control implementation and how specific system changes might affect the controls; reviewing the impact of changes on organizational supply chain partners with stakeholders; and determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks. Impact analyses also include risk assessments to understand the impact of the changes and determine if additional controls are required." }, { "id": "cm-4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-04", "class": "sp800-53a" } ], "parts": [ { "id": "cm-4_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-04[01]", "class": "sp800-53a" } ], "prose": "changes to the system are analyzed to determine potential security impacts prior to change implementation;", "links": [ { "href": "#cm-4_smt", "rel": "assessment-for" } ] }, { "id": "cm-4_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "CM-04[02]", "class": "sp800-53a" } ], "prose": "changes to the system are analyzed to determine potential privacy impacts prior to change implementation.", "links": [ { "href": "#cm-4_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#cm-4_smt", "rel": "assessment-for" } ] }, { "id": "cm-4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "CM-04-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Configuration management policy\n\nprocedures addressing security impact analyses for changes to the system\n\nprocedures addressing privacy impact analyses for changes to the system\n\nconfiguration management plan\n\nsecurity impact analysis documentation\n\nprivacy impact analysis documentation\n\nprivacy impact assessment\n\nprivacy risk assessment documentation, system design documentation\n\nanalysis tools and associated outputs\n\nchange control records\n\nsystem audit records\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "cm-4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "CM-04-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibility for conducting security impact analyses\n\norganizational personnel with responsibility for conducting privacy impact analyses\n\norganizational personnel with information security and privacy responsibilities\n\nsystem developer\n\nsystem/network administrators\n\nmembers of change control board or similar" } ] }, { "id": "cm-4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "CM-04-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for security impact analyses\n\norganizational processes for privacy impact analyses" } ] } ] } ] }, { "id": "ir", "class": "family", "title": "Incident Response", "props": [ { "name": "label", "value": "IR" } ], "controls": [ { "id": "ir-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "ir-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ir-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ir-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "ir-01_odp.01", "props": [ { "name": "label", "value": "IR-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the incident response policy is to be disseminated is/are defined;" } ] }, { "id": "ir-01_odp.02", "props": [ { "name": "label", "value": "IR-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the incident response procedures are to be disseminated is/are defined;" } ] }, { "id": "ir-01_odp.03", "props": [ { "name": "alt-identifier", "value": "ir-1_prm_2" }, { "name": "label", "value": "IR-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "ir-01_odp.04", "props": [ { "name": "alt-identifier", "value": "ir-1_prm_3" }, { "name": "label", "value": "IR-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the incident response policy and procedures is defined;" } ] }, { "id": "ir-01_odp.05", "props": [ { "name": "alt-identifier", "value": "ir-1_prm_4" }, { "name": "label", "value": "IR-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current incident response policy is reviewed and updated is defined;" } ] }, { "id": "ir-01_odp.06", "props": [ { "name": "alt-identifier", "value": "ir-1_prm_5" }, { "name": "label", "value": "IR-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current incident response policy to be reviewed and updated are defined;" } ] }, { "id": "ir-01_odp.07", "props": [ { "name": "alt-identifier", "value": "ir-1_prm_6" }, { "name": "label", "value": "IR-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current incident response procedures are reviewed and updated is defined;" } ] }, { "id": "ir-01_odp.08", "props": [ { "name": "alt-identifier", "value": "ir-1_prm_7" }, { "name": "label", "value": "IR-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the incident response procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "IR-01", "class": "zero-padded" }, { "name": "label", "value": "IR-1" }, { "name": "label", "value": "IR-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#511f6832-23ca-49a3-8c0f-ce493373cab8", "rel": "reference" }, { "href": "#49b8aa2d-a88c-4bff-9f20-876ccb8f7dcb", "rel": "reference" }, { "href": "#3dd249b0-f57d-44ba-a03e-c3eab1b835ff", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "ir-1_smt", "name": "statement", "parts": [ { "id": "ir-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, ir-1_prm_1 }}:", "parts": [ { "id": "ir-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, ir-01_odp.03 }} incident response policy that:", "parts": [ { "id": "ir-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "ir-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "ir-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;" } ] }, { "id": "ir-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, ir-01_odp.04 }} to manage the development, documentation, and dissemination of the incident response policy and procedures; and" }, { "id": "ir-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current incident response:", "parts": [ { "id": "ir-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, ir-01_odp.05 }} and following {{ insert: param, ir-01_odp.06 }} ; and" }, { "id": "ir-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, ir-01_odp.07 }} and following {{ insert: param, ir-01_odp.08 }}." } ] } ] }, { "id": "ir-1_gdn", "name": "guidance", "prose": "Incident response policy and procedures address the controls in the IR family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of incident response policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to incident response policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "ir-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01", "class": "sp800-53a" } ], "parts": [ { "id": "ir-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.[01]", "class": "sp800-53a" } ], "prose": "an incident response policy is developed and documented;", "links": [ { "href": "#ir-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.[02]", "class": "sp800-53a" } ], "prose": "the incident response policy is disseminated to {{ insert: param, ir-01_odp.01 }};", "links": [ { "href": "#ir-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.[03]", "class": "sp800-53a" } ], "prose": "incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented;", "links": [ { "href": "#ir-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.[04]", "class": "sp800-53a" } ], "prose": "the incident response procedures are disseminated to {{ insert: param, ir-01_odp.02 }};", "links": [ { "href": "#ir-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "ir-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "ir-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ir-01_odp.03 }} incident response policy addresses purpose;", "links": [ { "href": "#ir-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ir-01_odp.03 }} incident response policy addresses scope;", "links": [ { "href": "#ir-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ir-01_odp.03 }} incident response policy addresses roles;", "links": [ { "href": "#ir-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ir-01_odp.03 }} incident response policy addresses responsibilities;", "links": [ { "href": "#ir-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ir-01_odp.03 }} incident response policy addresses management commitment;", "links": [ { "href": "#ir-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ir-01_odp.03 }} incident response policy addresses coordination among organizational entities;", "links": [ { "href": "#ir-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ir-01_odp.03 }} incident response policy addresses compliance;", "links": [ { "href": "#ir-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ir-01_odp.03 }} incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#ir-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ir-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the incident response policy and procedures;", "links": [ { "href": "#ir-1_smt.b", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "ir-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current incident response policy is reviewed and updated {{ insert: param, ir-01_odp.05 }};", "links": [ { "href": "#ir-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current incident response policy is reviewed and updated following {{ insert: param, ir-01_odp.06 }};", "links": [ { "href": "#ir-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "ir-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current incident response procedures are reviewed and updated {{ insert: param, ir-01_odp.07 }};", "links": [ { "href": "#ir-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "ir-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current incident response procedures are reviewed and updated following {{ insert: param, ir-01_odp.08 }}.", "links": [ { "href": "#ir-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-1_smt", "rel": "assessment-for" } ] }, { "id": "ir-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy and procedures\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ir-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident response responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "ir-2", "class": "SP800-53", "title": "Incident Response Training", "params": [ { "id": "ir-02_odp.01", "props": [ { "name": "alt-identifier", "value": "ir-2_prm_1" }, { "name": "label", "value": "IR-02_ODP[01]", "class": "sp800-53a" } ], "label": "time period", "guidelines": [ { "prose": "a time period within which incident response training is to be provided to system users assuming an incident response role or responsibility is defined;" } ] }, { "id": "ir-02_odp.02", "props": [ { "name": "alt-identifier", "value": "ir-2_prm_2" }, { "name": "label", "value": "IR-02_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency at which to provide incident response training to users is defined;" } ] }, { "id": "ir-02_odp.03", "props": [ { "name": "alt-identifier", "value": "ir-2_prm_3" }, { "name": "label", "value": "IR-02_ODP[03]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency at which to review and update incident response training content is defined;" } ] }, { "id": "ir-02_odp.04", "props": [ { "name": "alt-identifier", "value": "ir-2_prm_4" }, { "name": "label", "value": "IR-02_ODP[04]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that initiate a review of the incident response training content are defined;" } ] } ], "props": [ { "name": "label", "value": "IR-02", "class": "zero-padded" }, { "name": "label", "value": "IR-2" }, { "name": "label", "value": "IR-02", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#5f4705ac-8d17-438c-b23a-ac7f12362ae4", "rel": "reference" }, { "href": "#511f6832-23ca-49a3-8c0f-ce493373cab8", "rel": "reference" }, { "href": "#at-2", "rel": "related" }, { "href": "#at-3", "rel": "related" }, { "href": "#at-4", "rel": "related" }, { "href": "#cp-3", "rel": "related" }, { "href": "#ir-3", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-8", "rel": "related" }, { "href": "#ir-9", "rel": "related" } ], "parts": [ { "id": "ir-2_smt", "name": "statement", "parts": [ { "id": "ir-2_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Provide incident response training to system users consistent with assigned roles and responsibilities:", "parts": [ { "id": "ir-2_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Within {{ insert: param, ir-02_odp.01 }} of assuming an incident response role or responsibility or acquiring system access;" }, { "id": "ir-2_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "When required by system changes; and" }, { "id": "ir-2_smt.a.3", "name": "item", "props": [ { "name": "label", "value": "3." } ], "prose": " {{ insert: param, ir-02_odp.02 }} thereafter; and" } ] }, { "id": "ir-2_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Review and update incident response training content {{ insert: param, ir-02_odp.03 }} and following {{ insert: param, ir-02_odp.04 }}." } ] }, { "id": "ir-2_gdn", "name": "guidance", "prose": "Incident response training is associated with the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail are included in such training. For example, users may only need to know who to call or how to recognize an incident; system administrators may require additional training on how to handle incidents; and incident responders may receive more specific training on forensics, data collection techniques, reporting, system recovery, and system restoration. Incident response training includes user training in identifying and reporting suspicious activities from external and internal sources. Incident response training for users may be provided as part of [AT-2](#at-2) or [AT-3](#at-3) . Events that may precipitate an update to incident response training content include, but are not limited to, incident response plan testing or response to an actual incident (lessons learned), assessment or audit findings, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines." }, { "id": "ir-2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02", "class": "sp800-53a" } ], "parts": [ { "id": "ir-2_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02a.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-2_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02a.01", "class": "sp800-53a" } ], "prose": "incident response training is provided to system users consistent with assigned roles and responsibilities within {{ insert: param, ir-02_odp.01 }} of assuming an incident response role or responsibility or acquiring system access;", "links": [ { "href": "#ir-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "ir-2_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02a.02", "class": "sp800-53a" } ], "prose": "incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes;", "links": [ { "href": "#ir-2_smt.a.2", "rel": "assessment-for" } ] }, { "id": "ir-2_obj.a.3", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02a.03", "class": "sp800-53a" } ], "prose": "incident response training is provided to system users consistent with assigned roles and responsibilities {{ insert: param, ir-02_odp.02 }} thereafter;", "links": [ { "href": "#ir-2_smt.a.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-2_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-2_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02b.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-2_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02b.[01]", "class": "sp800-53a" } ], "prose": "incident response training content is reviewed and updated {{ insert: param, ir-02_odp.03 }};", "links": [ { "href": "#ir-2_smt.b", "rel": "assessment-for" } ] }, { "id": "ir-2_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02b.[02]", "class": "sp800-53a" } ], "prose": "incident response training content is reviewed and updated following {{ insert: param, ir-02_odp.04 }}.", "links": [ { "href": "#ir-2_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-2_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-2_smt", "rel": "assessment-for" } ] }, { "id": "ir-2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-02-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy\n\nprocedures addressing incident response training\n\nincident response training curriculum\n\nincident response training materials\n\nprivacy plan\n\nincident response plan\n\nincident response training records\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ir-2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-02-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident response training and operational responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ], "controls": [ { "id": "ir-2.3", "class": "SP800-53-enhancement", "title": "Breach", "props": [ { "name": "label", "value": "IR-02(03)", "class": "zero-padded" }, { "name": "label", "value": "IR-2(3)" }, { "name": "label", "value": "IR-02(03)", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-02.03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#ir-2", "rel": "required" } ], "parts": [ { "id": "ir-2.3_smt", "name": "statement", "prose": "Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach." }, { "id": "ir-2.3_gdn", "name": "guidance", "prose": "For federal agencies, an incident that involves personally identifiable information is considered a breach. A breach results in the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or a similar occurrence where a person other than an authorized user accesses or potentially accesses personally identifiable information or an authorized user accesses or potentially accesses such information for other than authorized purposes. The incident response training emphasizes the obligation of individuals to report both confirmed and suspected breaches involving information in any medium or form, including paper, oral, and electronic. Incident response training includes tabletop exercises that simulate a breach. See [IR-2(1)](#ir-2.1)." }, { "id": "ir-2.3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02(03)", "class": "sp800-53a" } ], "parts": [ { "id": "ir-2.3_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02(03)[01]", "class": "sp800-53a" } ], "prose": "incident response training on how to identify and respond to a breach is provided;", "links": [ { "href": "#ir-2.3_smt", "rel": "assessment-for" } ] }, { "id": "ir-2.3_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-02(03)[02]", "class": "sp800-53a" } ], "prose": "incident response training on the organization’s process for reporting a breach is provided.", "links": [ { "href": "#ir-2.3_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-2.3_smt", "rel": "assessment-for" } ] }, { "id": "ir-2.3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-02(03)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy\n\ncontingency planning policy\n\nprocedures addressing incident response testing\n\nprocedures addressing contingency plan testing\n\nincident response testing material\n\nincident response test results\n\nincident response test plan\n\nincident response plan\n\ncontingency plan\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ir-2.3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-02(03)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident response training responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] } ] }, { "id": "ir-3", "class": "SP800-53", "title": "Incident Response Testing", "params": [ { "id": "ir-03_odp.01", "props": [ { "name": "alt-identifier", "value": "ir-3_prm_1" }, { "name": "label", "value": "IR-03_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency at which to test the effectiveness of the incident response capability for the system is defined;" } ] }, { "id": "ir-03_odp.02", "props": [ { "name": "alt-identifier", "value": "ir-3_prm_2" }, { "name": "label", "value": "IR-03_ODP[02]", "class": "sp800-53a" } ], "label": "tests", "guidelines": [ { "prose": "tests used to test the effectiveness of the incident response capability for the system are defined;" } ] } ], "props": [ { "name": "label", "value": "IR-03", "class": "zero-padded" }, { "name": "label", "value": "IR-3" }, { "name": "label", "value": "IR-03", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#53be2fcf-cfd1-4bcb-896b-9a3b65c22098", "rel": "reference" }, { "href": "#122177fa-c4ed-485d-8345-3082c0fb9a06", "rel": "reference" }, { "href": "#cp-3", "rel": "related" }, { "href": "#cp-4", "rel": "related" }, { "href": "#ir-2", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-8", "rel": "related" }, { "href": "#pm-14", "rel": "related" } ], "parts": [ { "id": "ir-3_smt", "name": "statement", "prose": "Test the effectiveness of the incident response capability for the system {{ insert: param, ir-03_odp.01 }} using the following tests: {{ insert: param, ir-03_odp.02 }}." }, { "id": "ir-3_gdn", "name": "guidance", "prose": "Organizations test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, and simulations (parallel or full interrupt). Incident response testing can include a determination of the effects on organizational operations and assets and individuals due to incident response. The use of qualitative and quantitative data aids in determining the effectiveness of incident response processes." }, { "id": "ir-3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-03", "class": "sp800-53a" } ], "prose": "the effectiveness of the incident response capability for the system is tested {{ insert: param, ir-03_odp.01 }} using {{ insert: param, ir-03_odp.02 }}.", "links": [ { "href": "#ir-3_smt", "rel": "assessment-for" } ] }, { "id": "ir-3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-03-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy\n\ncontingency planning policy\n\nprocedures addressing incident response testing\n\nprocedures addressing contingency plan testing\n\nincident response testing material\n\nincident response test results\n\nincident response test plan\n\nincident response plan\n\ncontingency plan\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ir-3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-03-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident response testing responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "ir-4", "class": "SP800-53", "title": "Incident Handling", "props": [ { "name": "label", "value": "IR-04", "class": "zero-padded" }, { "name": "label", "value": "IR-4" }, { "name": "label", "value": "IR-04", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#4ff10ed3-d8fe-4246-99e3-443045e27482", "rel": "reference" }, { "href": "#0f963c17-ab5a-432a-a867-91eac550309b", "rel": "reference" }, { "href": "#5f4705ac-8d17-438c-b23a-ac7f12362ae4", "rel": "reference" }, { "href": "#49b8aa2d-a88c-4bff-9f20-876ccb8f7dcb", "rel": "reference" }, { "href": "#cfdb1858-c473-46b3-89f9-a700308d0be2", "rel": "reference" }, { "href": "#10cf2fad-a216-41f9-bb1a-531b7e3119e3", "rel": "reference" }, { "href": "#9ef4b43c-42a4-4316-87dc-ffaf528bc05c", "rel": "reference" }, { "href": "#61ccf0f4-d3e7-42db-9796-ce6cb1c85989", "rel": "reference" }, { "href": "#31ae65ab-3f26-46b7-9d64-f25a4dac5778", "rel": "reference" }, { "href": "#2be7b163-e50a-435c-8906-f1162f2a457a", "rel": "reference" }, { "href": "#ac-19", "rel": "related" }, { "href": "#au-6", "rel": "related" }, { "href": "#au-7", "rel": "related" }, { "href": "#cm-6", "rel": "related" }, { "href": "#cp-2", "rel": "related" }, { "href": "#cp-3", "rel": "related" }, { "href": "#cp-4", "rel": "related" }, { "href": "#ir-2", "rel": "related" }, { "href": "#ir-3", "rel": "related" }, { "href": "#ir-5", "rel": "related" }, { "href": "#ir-6", "rel": "related" }, { "href": "#ir-8", "rel": "related" }, { "href": "#pe-6", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pm-12", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sc-5", "rel": "related" }, { "href": "#sc-7", "rel": "related" }, { "href": "#si-3", "rel": "related" }, { "href": "#si-4", "rel": "related" }, { "href": "#si-7", "rel": "related" } ], "parts": [ { "id": "ir-4_smt", "name": "statement", "parts": [ { "id": "ir-4_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;" }, { "id": "ir-4_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Coordinate incident handling activities with contingency planning activities;" }, { "id": "ir-4_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and" }, { "id": "ir-4_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization." } ] }, { "id": "ir-4_gdn", "name": "guidance", "prose": "Organizations recognize that incident response capabilities are dependent on the capabilities of organizational systems and the mission and business processes being supported by those systems. Organizations consider incident response as part of the definition, design, and development of mission and business processes and systems. Incident-related information can be obtained from a variety of sources, including audit monitoring, physical access monitoring, and network monitoring; user or administrator reports; and reported supply chain events. An effective incident handling capability includes coordination among many organizational entities (e.g., mission or business owners, system owners, authorizing officials, human resources offices, physical security offices, personnel security offices, legal departments, risk executive [function], operations personnel, procurement offices). Suspected security incidents include the receipt of suspicious email communications that can contain malicious code. Suspected supply chain incidents include the insertion of counterfeit hardware or malicious code into organizational systems or system components. For federal agencies, an incident that involves personally identifiable information is considered a breach. A breach results in unauthorized disclosure, the loss of control, unauthorized acquisition, compromise, or a similar occurrence where a person other than an authorized user accesses or potentially accesses personally identifiable information or an authorized user accesses or potentially accesses such information for other than authorized purposes." }, { "id": "ir-4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04", "class": "sp800-53a" } ], "parts": [ { "id": "ir-4_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04a.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-4_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04a.[01]", "class": "sp800-53a" } ], "prose": "an incident handling capability for incidents is implemented that is consistent with the incident response plan;", "links": [ { "href": "#ir-4_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04a.[02]", "class": "sp800-53a" } ], "prose": "the incident handling capability for incidents includes preparation;", "links": [ { "href": "#ir-4_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04a.[03]", "class": "sp800-53a" } ], "prose": "the incident handling capability for incidents includes detection and analysis;", "links": [ { "href": "#ir-4_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04a.[04]", "class": "sp800-53a" } ], "prose": "the incident handling capability for incidents includes containment;", "links": [ { "href": "#ir-4_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04a.[05]", "class": "sp800-53a" } ], "prose": "the incident handling capability for incidents includes eradication;", "links": [ { "href": "#ir-4_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04a.[06]", "class": "sp800-53a" } ], "prose": "the incident handling capability for incidents includes recovery;", "links": [ { "href": "#ir-4_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-4_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04b.", "class": "sp800-53a" } ], "prose": "incident handling activities are coordinated with contingency planning activities;", "links": [ { "href": "#ir-4_smt.b", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04c.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-4_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04c.[01]", "class": "sp800-53a" } ], "prose": "lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing;", "links": [ { "href": "#ir-4_smt.c", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04c.[02]", "class": "sp800-53a" } ], "prose": "the changes resulting from the incorporated lessons learned are implemented accordingly;", "links": [ { "href": "#ir-4_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-4_smt.c", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04d.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-4_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04d.[01]", "class": "sp800-53a" } ], "prose": "the rigor of incident handling activities is comparable and predictable across the organization;", "links": [ { "href": "#ir-4_smt.d", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04d.[02]", "class": "sp800-53a" } ], "prose": "the intensity of incident handling activities is comparable and predictable across the organization;", "links": [ { "href": "#ir-4_smt.d", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.d-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04d.[03]", "class": "sp800-53a" } ], "prose": "the scope of incident handling activities is comparable and predictable across the organization;", "links": [ { "href": "#ir-4_smt.d", "rel": "assessment-for" } ] }, { "id": "ir-4_obj.d-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-04d.[04]", "class": "sp800-53a" } ], "prose": "the results of incident handling activities are comparable and predictable across the organization.", "links": [ { "href": "#ir-4_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-4_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-4_smt", "rel": "assessment-for" } ] }, { "id": "ir-4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-04-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy\n\ncontingency planning policy\n\nprocedures addressing incident handling\n\nincident response plan\n\ncontingency plan\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ir-4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-04-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident handling responsibilities\n\norganizational personnel with contingency planning responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ir-4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "IR-04-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident handling capability for the organization" } ] } ] }, { "id": "ir-5", "class": "SP800-53", "title": "Incident Monitoring", "props": [ { "name": "label", "value": "IR-05", "class": "zero-padded" }, { "name": "label", "value": "IR-5" }, { "name": "label", "value": "IR-05", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-05" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#49b8aa2d-a88c-4bff-9f20-876ccb8f7dcb", "rel": "reference" }, { "href": "#au-6", "rel": "related" }, { "href": "#au-7", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-6", "rel": "related" }, { "href": "#ir-8", "rel": "related" }, { "href": "#pe-6", "rel": "related" }, { "href": "#pm-5", "rel": "related" }, { "href": "#sc-5", "rel": "related" }, { "href": "#sc-7", "rel": "related" }, { "href": "#si-3", "rel": "related" }, { "href": "#si-4", "rel": "related" }, { "href": "#si-7", "rel": "related" } ], "parts": [ { "id": "ir-5_smt", "name": "statement", "prose": "Track and document incidents." }, { "id": "ir-5_gdn", "name": "guidance", "prose": "Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. [IR-4](#ir-4) provides information on the types of incidents that are appropriate for monitoring." }, { "id": "ir-5_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-05", "class": "sp800-53a" } ], "parts": [ { "id": "ir-5_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-05[01]", "class": "sp800-53a" } ], "prose": "incidents are tracked;", "links": [ { "href": "#ir-5_smt", "rel": "assessment-for" } ] }, { "id": "ir-5_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-05[02]", "class": "sp800-53a" } ], "prose": "incidents are documented.", "links": [ { "href": "#ir-5_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-5_smt", "rel": "assessment-for" } ] }, { "id": "ir-5_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-05-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy\n\nprocedures addressing incident monitoring\n\nincident response records and documentation\n\nincident response plan\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ir-5_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-05-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident monitoring responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ir-5_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "IR-05-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident monitoring capability for the organization\n\nmechanisms supporting and/or implementing the tracking and documenting of system security incidents" } ] } ] }, { "id": "ir-6", "class": "SP800-53", "title": "Incident Reporting", "params": [ { "id": "ir-06_odp.01", "props": [ { "name": "alt-identifier", "value": "ir-6_prm_1" }, { "name": "label", "value": "IR-06_ODP[01]", "class": "sp800-53a" } ], "label": "time period", "guidelines": [ { "prose": "time period for personnel to report suspected incidents to the organizational incident response capability is defined;" } ] }, { "id": "ir-06_odp.02", "props": [ { "name": "alt-identifier", "value": "ir-6_prm_2" }, { "name": "label", "value": "IR-06_ODP[02]", "class": "sp800-53a" } ], "label": "authorities", "guidelines": [ { "prose": "authorities to whom incident information is to be reported are defined;" } ] } ], "props": [ { "name": "label", "value": "IR-06", "class": "zero-padded" }, { "name": "label", "value": "IR-6" }, { "name": "label", "value": "IR-06", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-06" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#4ff10ed3-d8fe-4246-99e3-443045e27482", "rel": "reference" }, { "href": "#0f963c17-ab5a-432a-a867-91eac550309b", "rel": "reference" }, { "href": "#40b78258-c892-480e-9af8-77ac36648301", "rel": "reference" }, { "href": "#49b8aa2d-a88c-4bff-9f20-876ccb8f7dcb", "rel": "reference" }, { "href": "#cm-6", "rel": "related" }, { "href": "#cp-2", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-5", "rel": "related" }, { "href": "#ir-8", "rel": "related" }, { "href": "#ir-9", "rel": "related" } ], "parts": [ { "id": "ir-6_smt", "name": "statement", "parts": [ { "id": "ir-6_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Require personnel to report suspected incidents to the organizational incident response capability within {{ insert: param, ir-06_odp.01 }} ; and" }, { "id": "ir-6_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Report incident information to {{ insert: param, ir-06_odp.02 }}." } ] }, { "id": "ir-6_gdn", "name": "guidance", "prose": "The types of incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Incident information can inform risk assessments, control effectiveness assessments, security requirements for acquisitions, and selection criteria for technology products." }, { "id": "ir-6_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-06", "class": "sp800-53a" } ], "parts": [ { "id": "ir-6_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-06a.", "class": "sp800-53a" } ], "prose": "personnel is/are required to report suspected incidents to the organizational incident response capability within {{ insert: param, ir-06_odp.01 }};", "links": [ { "href": "#ir-6_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-6_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-06b.", "class": "sp800-53a" } ], "prose": "incident information is reported to {{ insert: param, ir-06_odp.02 }}.", "links": [ { "href": "#ir-6_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-6_smt", "rel": "assessment-for" } ] }, { "id": "ir-6_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-06-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy\n\nprocedures addressing incident reporting\n\nincident reporting records and documentation\n\nincident response plan\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ir-6_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-06-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident reporting responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\npersonnel who have/should have reported incidents\n\npersonnel (authorities) to whom incident information is to be reported\n\nsystem users" } ] }, { "id": "ir-6_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "IR-06-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for incident reporting\n\nmechanisms supporting and/or implementing incident reporting" } ] } ] }, { "id": "ir-7", "class": "SP800-53", "title": "Incident Response Assistance", "props": [ { "name": "label", "value": "IR-07", "class": "zero-padded" }, { "name": "label", "value": "IR-7" }, { "name": "label", "value": "IR-07", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-07" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#2be7b163-e50a-435c-8906-f1162f2a457a", "rel": "reference" }, { "href": "#at-2", "rel": "related" }, { "href": "#at-3", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-6", "rel": "related" }, { "href": "#ir-8", "rel": "related" }, { "href": "#pm-22", "rel": "related" }, { "href": "#pm-26", "rel": "related" }, { "href": "#sa-9", "rel": "related" }, { "href": "#si-18", "rel": "related" } ], "parts": [ { "id": "ir-7_smt", "name": "statement", "prose": "Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents." }, { "id": "ir-7_gdn", "name": "guidance", "prose": "Incident response support resources provided by organizations include help desks, assistance groups, automated ticketing systems to open and track incident response tickets, and access to forensics services or consumer redress services, when required." }, { "id": "ir-7_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-07", "class": "sp800-53a" } ], "parts": [ { "id": "ir-7_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-07[01]", "class": "sp800-53a" } ], "prose": "an incident response support resource, integral to the organizational incident response capability, is provided;", "links": [ { "href": "#ir-7_smt", "rel": "assessment-for" } ] }, { "id": "ir-7_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-07[02]", "class": "sp800-53a" } ], "prose": "the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents.", "links": [ { "href": "#ir-7_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-7_smt", "rel": "assessment-for" } ] }, { "id": "ir-7_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-07-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy\n\nprocedures addressing incident response assistance\n\nincident response plan\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ir-7_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-07-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident response assistance and support responsibilities\n\norganizational personnel with access to incident response support and assistance capability\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ir-7_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "IR-07-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for incident response assistance\n\nmechanisms supporting and/or implementing incident response assistance" } ] } ] }, { "id": "ir-8", "class": "SP800-53", "title": "Incident Response Plan", "params": [ { "id": "ir-8_prm_5", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ir-08_odp.06" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ir-08_odp.05" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ir-08_odp.07" } ], "label": "organization-defined incident response personnel (identified by name and/or by role) and organizational elements" }, { "id": "ir-08_odp.01", "props": [ { "name": "alt-identifier", "value": "ir-8_prm_1" }, { "name": "label", "value": "IR-08_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles that review and approve the incident response plan is/are identified;" } ] }, { "id": "ir-08_odp.02", "props": [ { "name": "alt-identifier", "value": "ir-8_prm_2" }, { "name": "label", "value": "IR-08_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to review and approve the incident response plan is defined;" } ] }, { "id": "ir-08_odp.03", "props": [ { "name": "alt-identifier", "value": "ir-8_prm_3" }, { "name": "label", "value": "IR-08_ODP[03]", "class": "sp800-53a" } ], "label": "entities, personnel, or roles", "guidelines": [ { "prose": "entities, personnel, or roles with designated responsibility for incident response are defined;" } ] }, { "id": "ir-08_odp.04", "props": [ { "name": "alt-identifier", "value": "ir-8_prm_4" }, { "name": "alt-label", "value": "incident response personnel (identified by name and/or by role) and organizational elements", "class": "sp800-53" }, { "name": "label", "value": "IR-08_ODP[04]", "class": "sp800-53a" } ], "label": "incident response personnel", "guidelines": [ { "prose": "incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed is/are defined;" } ] }, { "id": "ir-08_odp.05", "props": [ { "name": "label", "value": "IR-08_ODP[05]", "class": "sp800-53a" } ], "label": "organizational elements", "guidelines": [ { "prose": "organizational elements to which copies of the incident response plan are to be distributed are defined;" } ] }, { "id": "ir-08_odp.06", "props": [ { "name": "label", "value": "IR-08_ODP[06]", "class": "sp800-53a" } ], "label": "incident response personnel", "guidelines": [ { "prose": "incident response personnel (identified by name and/or by role) to whom changes to the incident response plan is/are communicated are defined;" } ] }, { "id": "ir-08_odp.07", "props": [ { "name": "label", "value": "IR-08_ODP[07]", "class": "sp800-53a" } ], "label": "organizational elements", "guidelines": [ { "prose": "organizational elements to which changes to the incident response plan are communicated are defined;" } ] } ], "props": [ { "name": "label", "value": "IR-08", "class": "zero-padded" }, { "name": "label", "value": "IR-8" }, { "name": "label", "value": "IR-08", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-08" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#49b8aa2d-a88c-4bff-9f20-876ccb8f7dcb", "rel": "reference" }, { "href": "#5f4705ac-8d17-438c-b23a-ac7f12362ae4", "rel": "reference" }, { "href": "#ac-2", "rel": "related" }, { "href": "#cp-2", "rel": "related" }, { "href": "#cp-4", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-7", "rel": "related" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pe-6", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#sa-15", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#sr-8", "rel": "related" } ], "parts": [ { "id": "ir-8_smt", "name": "statement", "parts": [ { "id": "ir-8_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop an incident response plan that:", "parts": [ { "id": "ir-8_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Provides the organization with a roadmap for implementing its incident response capability;" }, { "id": "ir-8_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Describes the structure and organization of the incident response capability;" }, { "id": "ir-8_smt.a.3", "name": "item", "props": [ { "name": "label", "value": "3." } ], "prose": "Provides a high-level approach for how the incident response capability fits into the overall organization;" }, { "id": "ir-8_smt.a.4", "name": "item", "props": [ { "name": "label", "value": "4." } ], "prose": "Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;" }, { "id": "ir-8_smt.a.5", "name": "item", "props": [ { "name": "label", "value": "5." } ], "prose": "Defines reportable incidents;" }, { "id": "ir-8_smt.a.6", "name": "item", "props": [ { "name": "label", "value": "6." } ], "prose": "Provides metrics for measuring the incident response capability within the organization;" }, { "id": "ir-8_smt.a.7", "name": "item", "props": [ { "name": "label", "value": "7." } ], "prose": "Defines the resources and management support needed to effectively maintain and mature an incident response capability;" }, { "id": "ir-8_smt.a.8", "name": "item", "props": [ { "name": "label", "value": "8." } ], "prose": "Addresses the sharing of incident information;" }, { "id": "ir-8_smt.a.9", "name": "item", "props": [ { "name": "label", "value": "9." } ], "prose": "Is reviewed and approved by {{ insert: param, ir-08_odp.01 }} {{ insert: param, ir-08_odp.02 }} ; and" }, { "id": "ir-8_smt.a.10", "name": "item", "props": [ { "name": "label", "value": "10." } ], "prose": "Explicitly designates responsibility for incident response to {{ insert: param, ir-08_odp.03 }}." } ] }, { "id": "ir-8_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Distribute copies of the incident response plan to {{ insert: param, ir-08_odp.04 }};" }, { "id": "ir-8_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;" }, { "id": "ir-8_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Communicate incident response plan changes to {{ insert: param, ir-8_prm_5 }} ; and" }, { "id": "ir-8_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Protect the incident response plan from unauthorized disclosure and modification." } ] }, { "id": "ir-8_gdn", "name": "guidance", "prose": "It is important that organizations develop and implement a coordinated approach to incident response. Organizational mission and business functions determine the structure of incident response capabilities. As part of the incident response capabilities, organizations consider the coordination and sharing of information with external organizations, including external service providers and other organizations involved in the supply chain. For incidents involving personally identifiable information (i.e., breaches), include a process to determine whether notice to oversight organizations or affected individuals is appropriate and provide that notice accordingly." }, { "id": "ir-8_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08", "class": "sp800-53a" } ], "parts": [ { "id": "ir-8_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-8_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.01", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability;", "links": [ { "href": "#ir-8_smt.a.1", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.02", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that describes the structure and organization of the incident response capability;", "links": [ { "href": "#ir-8_smt.a.2", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.a.3", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.03", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization;", "links": [ { "href": "#ir-8_smt.a.3", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.a.4", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.04", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions;", "links": [ { "href": "#ir-8_smt.a.4", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.a.5", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.05", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that defines reportable incidents;", "links": [ { "href": "#ir-8_smt.a.5", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.a.6", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.06", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that provides metrics for measuring the incident response capability within the organization;", "links": [ { "href": "#ir-8_smt.a.6", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.a.7", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.07", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability;", "links": [ { "href": "#ir-8_smt.a.7", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.a.8", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.08", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that addresses the sharing of incident information;", "links": [ { "href": "#ir-8_smt.a.8", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.a.9", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.09", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that is reviewed and approved by {{ insert: param, ir-08_odp.01 }} {{ insert: param, ir-08_odp.02 }};", "links": [ { "href": "#ir-8_smt.a.9", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.a.10", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08a.10", "class": "sp800-53a" } ], "prose": "an incident response plan is developed that explicitly designates responsibility for incident response to {{ insert: param, ir-08_odp.03 }}.", "links": [ { "href": "#ir-8_smt.a.10", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-8_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08b.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-8_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08b.[01]", "class": "sp800-53a" } ], "prose": "copies of the incident response plan are distributed to {{ insert: param, ir-08_odp.04 }};", "links": [ { "href": "#ir-8_smt.b", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08b.[02]", "class": "sp800-53a" } ], "prose": "copies of the incident response plan are distributed to {{ insert: param, ir-08_odp.05 }};", "links": [ { "href": "#ir-8_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-8_smt.b", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08c.", "class": "sp800-53a" } ], "prose": "the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing;", "links": [ { "href": "#ir-8_smt.c", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08d.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-8_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08d.[01]", "class": "sp800-53a" } ], "prose": "incident response plan changes are communicated to {{ insert: param, ir-08_odp.06 }};", "links": [ { "href": "#ir-8_smt.d", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08d.[02]", "class": "sp800-53a" } ], "prose": "incident response plan changes are communicated to {{ insert: param, ir-08_odp.07 }};", "links": [ { "href": "#ir-8_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-8_smt.d", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08e.", "class": "sp800-53a" } ], "parts": [ { "id": "ir-8_obj.e-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08e.[01]", "class": "sp800-53a" } ], "prose": "the incident response plan is protected from unauthorized disclosure;", "links": [ { "href": "#ir-8_smt.e", "rel": "assessment-for" } ] }, { "id": "ir-8_obj.e-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08e.[02]", "class": "sp800-53a" } ], "prose": "the incident response plan is protected from unauthorized modification.", "links": [ { "href": "#ir-8_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-8_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-8_smt", "rel": "assessment-for" } ] }, { "id": "ir-8_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-08-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy\n\nprocedures addressing incident response planning\n\nincident response plan\n\nsystem security plan\n\nprivacy plan\n\nrecords of incident response plan reviews and approvals\n\nother relevant documents or records" } ] }, { "id": "ir-8_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-08-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident response planning responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ir-8_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "IR-08-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational incident response plan and related organizational processes" } ] } ], "controls": [ { "id": "ir-8.1", "class": "SP800-53-enhancement", "title": "Breaches", "props": [ { "name": "label", "value": "IR-08(01)", "class": "zero-padded" }, { "name": "label", "value": "IR-8(1)" }, { "name": "label", "value": "IR-08(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "ir-08.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#ir-8", "rel": "required" }, { "href": "#pt-1", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#pt-4", "rel": "related" }, { "href": "#pt-5", "rel": "related" }, { "href": "#pt-7", "rel": "related" } ], "parts": [ { "id": "ir-8.1_smt", "name": "statement", "prose": "Include the following in the Incident Response Plan for breaches involving personally identifiable information:", "parts": [ { "id": "ir-8.1_smt.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "A process to determine if notice to individuals or other organizations, including oversight organizations, is needed;" }, { "id": "ir-8.1_smt.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and" }, { "id": "ir-8.1_smt.c", "name": "item", "props": [ { "name": "label", "value": "(c)" } ], "prose": "Identification of applicable privacy requirements." } ] }, { "id": "ir-8.1_gdn", "name": "guidance", "prose": "Organizations may be required by law, regulation, or policy to follow specific procedures relating to breaches, including notice to individuals, affected organizations, and oversight bodies; standards of harm; and mitigation or other specific requirements." }, { "id": "ir-8.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08(01)", "class": "sp800-53a" } ], "parts": [ { "id": "ir-8.1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08(01)(a)", "class": "sp800-53a" } ], "prose": "the incident response plan for breaches involving personally identifiable information includes a process to determine if notice to individuals or other organizations, including oversight organizations, is needed;", "links": [ { "href": "#ir-8.1_smt.a", "rel": "assessment-for" } ] }, { "id": "ir-8.1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08(01)(b)", "class": "sp800-53a" } ], "prose": "the incident response plan for breaches involving personally identifiable information includes an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms;", "links": [ { "href": "#ir-8.1_smt.b", "rel": "assessment-for" } ] }, { "id": "ir-8.1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "IR-08(01)(c)", "class": "sp800-53a" } ], "prose": "the incident response plan for breaches involving personally identifiable information includes the identification of applicable privacy requirements.", "links": [ { "href": "#ir-8.1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ir-8.1_smt", "rel": "assessment-for" } ] }, { "id": "ir-8.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "IR-08(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Incident response policy\n\nprocedures addressing incident response planning\n\nincident response plan\n\nsystem security plan\n\nprivacy plan\n\nrecords of incident response plan reviews and approvals\n\nother relevant documents or records" } ] }, { "id": "ir-8.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "IR-08(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with incident response planning responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ir-8.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "IR-08(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational incident response plan and related organizational processes" } ] } ] } ] } ] }, { "id": "mp", "class": "family", "title": "Media Protection", "props": [ { "name": "label", "value": "MP" } ], "controls": [ { "id": "mp-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "mp-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "mp-01_odp.01", "props": [ { "name": "label", "value": "MP-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the media protection policy is to be disseminated is/are defined;" } ] }, { "id": "mp-01_odp.02", "props": [ { "name": "label", "value": "MP-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the media protection procedures are to be disseminated is/are defined;" } ] }, { "id": "mp-01_odp.03", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_2" }, { "name": "label", "value": "MP-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "mp-01_odp.04", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_3" }, { "name": "label", "value": "MP-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the media protection policy and procedures is defined;" } ] }, { "id": "mp-01_odp.05", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_4" }, { "name": "label", "value": "MP-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency with which the current media protection policy is reviewed and updated is defined;" } ] }, { "id": "mp-01_odp.06", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_5" }, { "name": "label", "value": "MP-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current media protection policy to be reviewed and updated are defined;" } ] }, { "id": "mp-01_odp.07", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_6" }, { "name": "label", "value": "MP-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency with which the current media protection procedures are reviewed and updated is defined;" } ] }, { "id": "mp-01_odp.08", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_7" }, { "name": "label", "value": "MP-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require media protection procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-01", "class": "zero-padded" }, { "name": "label", "value": "MP-1" }, { "name": "label", "value": "MP-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "mp-1_smt", "name": "statement", "parts": [ { "id": "mp-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, mp-1_prm_1 }}:", "parts": [ { "id": "mp-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, mp-01_odp.03 }} media protection policy that:", "parts": [ { "id": "mp-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "mp-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "mp-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;" } ] }, { "id": "mp-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, mp-01_odp.04 }} to manage the development, documentation, and dissemination of the media protection policy and procedures; and" }, { "id": "mp-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current media protection:", "parts": [ { "id": "mp-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, mp-01_odp.05 }} and following {{ insert: param, mp-01_odp.06 }} ; and" }, { "id": "mp-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, mp-01_odp.07 }} and following {{ insert: param, mp-01_odp.08 }}." } ] } ] }, { "id": "mp-1_gdn", "name": "guidance", "prose": "Media protection policy and procedures address the controls in the MP family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of media protection policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to media protection policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "mp-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.[01]", "class": "sp800-53a" } ], "prose": "a media protection policy is developed and documented;", "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.[02]", "class": "sp800-53a" } ], "prose": "the media protection policy is disseminated to {{ insert: param, mp-01_odp.01 }};", "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.[03]", "class": "sp800-53a" } ], "prose": "media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented;", "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.[04]", "class": "sp800-53a" } ], "prose": "the media protection procedures are disseminated to {{ insert: param, mp-01_odp.02 }};", "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses purpose;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses scope;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses roles;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses responsibilities;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses management commitment;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses coordination among organizational entities;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy compliance;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(b)", "class": "sp800-53a" } ], "prose": "the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#mp-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.", "links": [ { "href": "#mp-1_smt.b", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current media protection policy is reviewed and updated {{ insert: param, mp-01_odp.05 }}; ", "links": [ { "href": "#mp-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current media protection policy is reviewed and updated following {{ insert: param, mp-01_odp.06 }};", "links": [ { "href": "#mp-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current media protection procedures are reviewed and updated {{ insert: param, mp-01_odp.07 }}; ", "links": [ { "href": "#mp-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current media protection procedures are reviewed and updated following {{ insert: param, mp-01_odp.08 }}.", "links": [ { "href": "#mp-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt", "rel": "assessment-for" } ] }, { "id": "mp-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Media protection policy and procedures\n\norganizational risk management strategy\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "mp-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with media protection responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "mp-6", "class": "SP800-53", "title": "Media Sanitization", "params": [ { "id": "mp-6_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.03" } ], "label": "organization-defined system media" }, { "id": "mp-6_prm_2", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.04" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.05" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.06" } ], "label": "organization-defined sanitization techniques and procedures" }, { "id": "mp-06_odp.01", "props": [ { "name": "label", "value": "MP-06_ODP[01]", "class": "sp800-53a" } ], "label": "system media", "guidelines": [ { "prose": "system media to be sanitized prior to disposal is defined;" } ] }, { "id": "mp-06_odp.02", "props": [ { "name": "label", "value": "MP-06_ODP[02]", "class": "sp800-53a" } ], "label": "system media", "guidelines": [ { "prose": "system media to be sanitized prior to release from organizational control is defined;" } ] }, { "id": "mp-06_odp.03", "props": [ { "name": "label", "value": "MP-06_ODP[03]", "class": "sp800-53a" } ], "label": "system media", "guidelines": [ { "prose": "system media to be sanitized prior to release for reuse is defined;" } ] }, { "id": "mp-06_odp.04", "props": [ { "name": "label", "value": "MP-06_ODP[04]", "class": "sp800-53a" } ], "label": "sanitization techniques and procedures", "guidelines": [ { "prose": "sanitization techniques and procedures to be used for sanitization prior to disposal are defined;" } ] }, { "id": "mp-06_odp.05", "props": [ { "name": "label", "value": "MP-06_ODP[05]", "class": "sp800-53a" } ], "label": "sanitization techniques and procedures", "guidelines": [ { "prose": "sanitization techniques and procedures to be used for sanitization prior to release from organizational control are defined;" } ] }, { "id": "mp-06_odp.06", "props": [ { "name": "label", "value": "MP-06_ODP[06]", "class": "sp800-53a" } ], "label": "sanitization techniques and procedures", "guidelines": [ { "prose": "sanitization techniques and procedures to be used for sanitization prior to release for reuse are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-06", "class": "zero-padded" }, { "name": "label", "value": "MP-6" }, { "name": "label", "value": "MP-06", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#91f992fb-f668-4c91-a50f-0f05b95ccee3", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c28ae9a8-1121-42a9-a85e-00cfcc9b9a94", "rel": "reference" }, { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#e72fde0b-6fc2-497e-a9db-d8fce5a11b8a", "rel": "reference" }, { "href": "#9be5d661-421f-41ad-854e-86f98b811891", "rel": "reference" }, { "href": "#a5b1d18d-e670-4586-9e6d-4a88b7ba3df6", "rel": "reference" }, { "href": "#0f66be67-85e7-4ca6-bd19-39453e9f4394", "rel": "reference" }, { "href": "#4c501da5-9d79-4cb6-ba80-97260e1ce327", "rel": "reference" }, { "href": "#df9f87e9-71e7-4c74-9ac3-3cabd4e92f21", "rel": "reference" }, { "href": "#ac-3", "rel": "related" }, { "href": "#ac-7", "rel": "related" }, { "href": "#au-11", "rel": "related" }, { "href": "#ma-2", "rel": "related" }, { "href": "#ma-3", "rel": "related" }, { "href": "#ma-4", "rel": "related" }, { "href": "#ma-5", "rel": "related" }, { "href": "#pm-22", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#si-18", "rel": "related" }, { "href": "#si-19", "rel": "related" }, { "href": "#sr-11", "rel": "related" } ], "parts": [ { "id": "mp-6_smt", "name": "statement", "parts": [ { "id": "mp-6_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Sanitize {{ insert: param, mp-6_prm_1 }} prior to disposal, release out of organizational control, or release for reuse using {{ insert: param, mp-6_prm_2 }} ; and" }, { "id": "mp-6_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information." } ] }, { "id": "mp-6_gdn", "name": "guidance", "prose": "Media sanitization applies to all digital and non-digital system media subject to disposal or reuse, whether or not the media is considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, workstations, network components, mobile devices, and non-digital media (e.g., paper and microfilm). The sanitization process removes information from system media such that the information cannot be retrieved or reconstructed. Sanitization techniques—including clearing, purging, cryptographic erase, de-identification of personally identifiable information, and destruction—prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods, recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media that contains information deemed to be in the public domain or publicly releasable or information deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes destruction, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections or words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media that contains classified information. NARA policies control the sanitization process for controlled unclassified information." }, { "id": "mp-6_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06", "class": "sp800-53a" } ], "parts": [ { "id": "mp-6_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06a.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-6_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06a.[01]", "class": "sp800-53a" } ], "prose": " {{ insert: param, mp-06_odp.01 }} is sanitized using {{ insert: param, mp-06_odp.04 }} prior to disposal;", "links": [ { "href": "#mp-6_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-6_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06a.[02]", "class": "sp800-53a" } ], "prose": " {{ insert: param, mp-06_odp.02 }} is sanitized using {{ insert: param, mp-06_odp.05 }} prior to release from organizational control;", "links": [ { "href": "#mp-6_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-6_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06a.[03]", "class": "sp800-53a" } ], "prose": " {{ insert: param, mp-06_odp.03 }} is sanitized using {{ insert: param, mp-06_odp.06 }} prior to release for reuse;", "links": [ { "href": "#mp-6_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-6_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-6_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06b.", "class": "sp800-53a" } ], "prose": "sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.", "links": [ { "href": "#mp-6_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-6_smt", "rel": "assessment-for" } ] }, { "id": "mp-6_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-06-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media sanitization and disposal\n\napplicable federal standards and policies addressing media sanitization policy\n\nmedia sanitization records\n\nsystem audit records\n\nsystem design documentation\n\nrecords retention and disposition policy\n\nrecords retention and disposition procedures\n\nsystem configuration settings and associated documentation\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "mp-6_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-06-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with media sanitization responsibilities\n\norganizational personnel with records retention and disposition responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-6_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-06-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media sanitization\n\nmechanisms supporting and/or implementing media sanitization" } ] } ] } ] }, { "id": "pe", "class": "family", "title": "Physical and Environmental Protection", "props": [ { "name": "label", "value": "PE" } ], "controls": [ { "id": "pe-8.3", "class": "SP800-53-enhancement", "title": "Limit Personally Identifiable Information Elements", "params": [ { "id": "pe-08.03_odp", "props": [ { "name": "alt-identifier", "value": "pe-8.3_prm_1" }, { "name": "label", "value": "PE-08(03)_ODP", "class": "sp800-53a" } ], "label": "elements", "guidelines": [ { "prose": "elements identified in the privacy risk assessment to limit personally identifiable information contained in visitor access logs are defined;" } ] } ], "props": [ { "name": "label", "value": "PE-08(03)", "class": "zero-padded" }, { "name": "label", "value": "PE-8(3)" }, { "name": "label", "value": "PE-08(03)", "class": "sp800-53a" }, { "name": "sort-id", "value": "pe-08.03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#pe-8", "rel": "required" }, { "href": "#ra-3", "rel": "related" }, { "href": "#sa-8", "rel": "related" } ], "parts": [ { "id": "pe-8.3_smt", "name": "statement", "prose": "Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: {{ insert: param, pe-08.03_odp }}." }, { "id": "pe-8.3_gdn", "name": "guidance", "prose": "Organizations may have requirements that specify the contents of visitor access records. Limiting personally identifiable information in visitor access records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system." }, { "id": "pe-8.3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PE-08(03)", "class": "sp800-53a" } ], "prose": "personally identifiable information contained in visitor access records is limited to {{ insert: param, pe-08.03_odp }} identified in the privacy risk assessment.", "links": [ { "href": "#pe-8.3_smt", "rel": "assessment-for" } ] }, { "id": "pe-8.3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PE-08(03)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Physical and environmental protection policy\n\npersonally identifiable information processing policy\n\nprivacy risk assessment documentation\n\nprivacy impact assessment\n\nvisitor access records\n\npersonally identifiable information inventory\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pe-8.3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PE-08(03)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with visitor access records responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pe-8.3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PE-08(03)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for maintaining and reviewing visitor access records" } ] } ] } ] }, { "id": "pl", "class": "family", "title": "Planning", "props": [ { "name": "label", "value": "PL" } ], "controls": [ { "id": "pl-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "pl-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pl-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pl-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "pl-01_odp.01", "props": [ { "name": "label", "value": "PL-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the planning policy is to be disseminated is/are defined;" } ] }, { "id": "pl-01_odp.02", "props": [ { "name": "label", "value": "PL-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the planning procedures are to be disseminated is/are defined;" } ] }, { "id": "pl-01_odp.03", "props": [ { "name": "alt-identifier", "value": "pl-1_prm_2" }, { "name": "label", "value": "PL-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "pl-01_odp.04", "props": [ { "name": "alt-identifier", "value": "pl-1_prm_3" }, { "name": "label", "value": "PL-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the planning policy and procedures is defined;" } ] }, { "id": "pl-01_odp.05", "props": [ { "name": "alt-identifier", "value": "pl-1_prm_4" }, { "name": "label", "value": "PL-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency with which the current planning policy is reviewed and updated is defined;" } ] }, { "id": "pl-01_odp.06", "props": [ { "name": "alt-identifier", "value": "pl-1_prm_5" }, { "name": "label", "value": "PL-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current planning policy to be reviewed and updated are defined;" } ] }, { "id": "pl-01_odp.07", "props": [ { "name": "alt-identifier", "value": "pl-1_prm_6" }, { "name": "label", "value": "PL-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency with which the current planning procedures are reviewed and updated is defined;" } ] }, { "id": "pl-01_odp.08", "props": [ { "name": "alt-identifier", "value": "pl-1_prm_7" }, { "name": "label", "value": "PL-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "PL-01", "class": "zero-padded" }, { "name": "label", "value": "PL-1" }, { "name": "label", "value": "PL-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "pl-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#30eb758a-2707-4bca-90ad-949a74d4eb16", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "pl-1_smt", "name": "statement", "parts": [ { "id": "pl-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, pl-1_prm_1 }}:", "parts": [ { "id": "pl-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, pl-01_odp.03 }} planning policy that:", "parts": [ { "id": "pl-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "pl-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "pl-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the planning policy and the associated planning controls;" } ] }, { "id": "pl-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, pl-01_odp.04 }} to manage the development, documentation, and dissemination of the planning policy and procedures; and" }, { "id": "pl-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current planning:", "parts": [ { "id": "pl-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, pl-01_odp.05 }} and following {{ insert: param, pl-01_odp.06 }} ; and" }, { "id": "pl-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, pl-01_odp.07 }} and following {{ insert: param, pl-01_odp.08 }}." } ] } ] }, { "id": "pl-1_gdn", "name": "guidance", "prose": "Planning policy and procedures for the controls in the PL family implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on their development. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission level or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission/business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to planning policy and procedures include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "pl-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01", "class": "sp800-53a" } ], "parts": [ { "id": "pl-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "pl-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.[01]", "class": "sp800-53a" } ], "prose": "a planning policy is developed and documented.", "links": [ { "href": "#pl-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.[02]", "class": "sp800-53a" } ], "prose": "the planning policy is disseminated to {{ insert: param, pl-01_odp.01 }};", "links": [ { "href": "#pl-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.[03]", "class": "sp800-53a" } ], "prose": "planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed and documented;", "links": [ { "href": "#pl-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.[04]", "class": "sp800-53a" } ], "prose": "the planning procedures are disseminated to {{ insert: param, pl-01_odp.02 }};", "links": [ { "href": "#pl-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "pl-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "pl-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pl-01_odp.03 }} planning policy addresses purpose;", "links": [ { "href": "#pl-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pl-01_odp.03 }} planning policy addresses scope;", "links": [ { "href": "#pl-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pl-01_odp.03 }} planning policy addresses roles;", "links": [ { "href": "#pl-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pl-01_odp.03 }} planning policy addresses responsibilities;", "links": [ { "href": "#pl-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pl-01_odp.03 }} planning policy addresses management commitment;", "links": [ { "href": "#pl-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pl-01_odp.03 }} planning policy addresses coordination among organizational entities;", "links": [ { "href": "#pl-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pl-01_odp.03 }} planning policy addresses compliance;", "links": [ { "href": "#pl-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pl-01_odp.03 }} planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#pl-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pl-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the planning policy and procedures;", "links": [ { "href": "#pl-1_smt.b", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "pl-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "pl-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current planning policy is reviewed and updated {{ insert: param, pl-01_odp.05 }};", "links": [ { "href": "#pl-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current planning policy is reviewed and updated following {{ insert: param, pl-01_odp.06 }};", "links": [ { "href": "#pl-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "pl-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current planning procedures are reviewed and updated {{ insert: param, pl-01_odp.07 }};", "links": [ { "href": "#pl-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "pl-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current planning procedures are reviewed and updated following {{ insert: param, pl-01_odp.08 }}.", "links": [ { "href": "#pl-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-1_smt", "rel": "assessment-for" } ] }, { "id": "pl-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PL-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Planning policy and procedures\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pl-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PL-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with planning responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "pl-2", "class": "SP800-53", "title": "System Security and Privacy Plans", "params": [ { "id": "pl-02_odp.01", "props": [ { "name": "alt-identifier", "value": "pl-2_prm_1" }, { "name": "label", "value": "PL-02_ODP[01]", "class": "sp800-53a" } ], "label": "individuals or groups", "guidelines": [ { "prose": "individuals or groups with whom security and privacy-related activities affecting the system that require planning and coordination is/are assigned;" } ] }, { "id": "pl-02_odp.02", "props": [ { "name": "alt-identifier", "value": "pl-2_prm_2" }, { "name": "label", "value": "PL-02_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned;" } ] }, { "id": "pl-02_odp.03", "props": [ { "name": "alt-identifier", "value": "pl-2_prm_3" }, { "name": "label", "value": "PL-02_ODP[03]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency to review system security and privacy plans is defined;" } ] } ], "props": [ { "name": "label", "value": "PL-02", "class": "zero-padded" }, { "name": "label", "value": "PL-2" }, { "name": "label", "value": "PL-02", "class": "sp800-53a" }, { "name": "sort-id", "value": "pl-02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#30eb758a-2707-4bca-90ad-949a74d4eb16", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#61ccf0f4-d3e7-42db-9796-ce6cb1c85989", "rel": "reference" }, { "href": "#ac-2", "rel": "related" }, { "href": "#ac-6", "rel": "related" }, { "href": "#ac-14", "rel": "related" }, { "href": "#ac-17", "rel": "related" }, { "href": "#ac-20", "rel": "related" }, { "href": "#ca-2", "rel": "related" }, { "href": "#ca-3", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#cm-9", "rel": "related" }, { "href": "#cm-13", "rel": "related" }, { "href": "#cp-2", "rel": "related" }, { "href": "#cp-4", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-8", "rel": "related" }, { "href": "#ma-4", "rel": "related" }, { "href": "#ma-5", "rel": "related" }, { "href": "#mp-4", "rel": "related" }, { "href": "#mp-5", "rel": "related" }, { "href": "#pl-7", "rel": "related" }, { "href": "#pl-8", "rel": "related" }, { "href": "#pl-10", "rel": "related" }, { "href": "#pl-11", "rel": "related" }, { "href": "#pm-1", "rel": "related" }, { "href": "#pm-7", "rel": "related" }, { "href": "#pm-8", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-10", "rel": "related" }, { "href": "#pm-11", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#ra-8", "rel": "related" }, { "href": "#ra-9", "rel": "related" }, { "href": "#sa-5", "rel": "related" }, { "href": "#sa-17", "rel": "related" }, { "href": "#sa-22", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#sr-2", "rel": "related" }, { "href": "#sr-4", "rel": "related" } ], "parts": [ { "id": "pl-2_smt", "name": "statement", "parts": [ { "id": "pl-2_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop security and privacy plans for the system that:", "parts": [ { "id": "pl-2_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Are consistent with the organization’s enterprise architecture;" }, { "id": "pl-2_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Explicitly define the constituent system components;" }, { "id": "pl-2_smt.a.3", "name": "item", "props": [ { "name": "label", "value": "3." } ], "prose": "Describe the operational context of the system in terms of mission and business processes;" }, { "id": "pl-2_smt.a.4", "name": "item", "props": [ { "name": "label", "value": "4." } ], "prose": "Identify the individuals that fulfill system roles and responsibilities;" }, { "id": "pl-2_smt.a.5", "name": "item", "props": [ { "name": "label", "value": "5." } ], "prose": "Identify the information types processed, stored, and transmitted by the system;" }, { "id": "pl-2_smt.a.6", "name": "item", "props": [ { "name": "label", "value": "6." } ], "prose": "Provide the security categorization of the system, including supporting rationale;" }, { "id": "pl-2_smt.a.7", "name": "item", "props": [ { "name": "label", "value": "7." } ], "prose": "Describe any specific threats to the system that are of concern to the organization;" }, { "id": "pl-2_smt.a.8", "name": "item", "props": [ { "name": "label", "value": "8." } ], "prose": "Provide the results of a privacy risk assessment for systems processing personally identifiable information;" }, { "id": "pl-2_smt.a.9", "name": "item", "props": [ { "name": "label", "value": "9." } ], "prose": "Describe the operational environment for the system and any dependencies on or connections to other systems or system components;" }, { "id": "pl-2_smt.a.10", "name": "item", "props": [ { "name": "label", "value": "10." } ], "prose": "Provide an overview of the security and privacy requirements for the system;" }, { "id": "pl-2_smt.a.11", "name": "item", "props": [ { "name": "label", "value": "11." } ], "prose": "Identify any relevant control baselines or overlays, if applicable;" }, { "id": "pl-2_smt.a.12", "name": "item", "props": [ { "name": "label", "value": "12." } ], "prose": "Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions;" }, { "id": "pl-2_smt.a.13", "name": "item", "props": [ { "name": "label", "value": "13." } ], "prose": "Include risk determinations for security and privacy architecture and design decisions;" }, { "id": "pl-2_smt.a.14", "name": "item", "props": [ { "name": "label", "value": "14." } ], "prose": "Include security- and privacy-related activities affecting the system that require planning and coordination with {{ insert: param, pl-02_odp.01 }} ; and" }, { "id": "pl-2_smt.a.15", "name": "item", "props": [ { "name": "label", "value": "15." } ], "prose": "Are reviewed and approved by the authorizing official or designated representative prior to plan implementation." } ] }, { "id": "pl-2_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Distribute copies of the plans and communicate subsequent changes to the plans to {{ insert: param, pl-02_odp.02 }};" }, { "id": "pl-2_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review the plans {{ insert: param, pl-02_odp.03 }};" }, { "id": "pl-2_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments; and" }, { "id": "pl-2_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Protect the plans from unauthorized disclosure and modification." } ] }, { "id": "pl-2_gdn", "name": "guidance", "prose": "System security and privacy plans are scoped to the system and system components within the defined authorization boundary and contain an overview of the security and privacy requirements for the system and the controls selected to satisfy the requirements. The plans describe the intended application of each selected control in the context of the system with a sufficient level of detail to correctly implement the control and to subsequently assess the effectiveness of the control. The control documentation describes how system-specific and hybrid controls are implemented and the plans and expectations regarding the functionality of the system. System security and privacy plans can also be used in the design and development of systems in support of life cycle-based security and privacy engineering processes. System security and privacy plans are living documents that are updated and adapted throughout the system development life cycle (e.g., during capability determination, analysis of alternatives, requests for proposal, and design reviews). [Section 2.1](#c3397cc9-83c6-4459-adb2-836739dc1b94) describes the different types of requirements that are relevant to organizations during the system development life cycle and the relationship between requirements and controls.\n\nOrganizations may develop a single, integrated security and privacy plan or maintain separate plans. Security and privacy plans relate security and privacy requirements to a set of controls and control enhancements. The plans describe how the controls and control enhancements meet the security and privacy requirements but do not provide detailed, technical descriptions of the design or implementation of the controls and control enhancements. Security and privacy plans contain sufficient information (including specifications of control parameter values for selection and assignment operations explicitly or by reference) to enable a design and implementation that is unambiguously compliant with the intent of the plans and subsequent determinations of risk to organizational operations and assets, individuals, other organizations, and the Nation if the plan is implemented.\n\nSecurity and privacy plans need not be single documents. The plans can be a collection of various documents, including documents that already exist. Effective security and privacy plans make extensive use of references to policies, procedures, and additional documents, including design and implementation specifications where more detailed information can be obtained. The use of references helps reduce the documentation associated with security and privacy programs and maintains the security- and privacy-related information in other established management and operational areas, including enterprise architecture, system development life cycle, systems engineering, and acquisition. Security and privacy plans need not contain detailed contingency plan or incident response plan information but can instead provide—explicitly or by reference—sufficient information to define what needs to be accomplished by those plans.\n\nSecurity- and privacy-related activities that may require coordination and planning with other individuals or groups within the organization include assessments, audits, inspections, hardware and software maintenance, acquisition and supply chain risk management, patch management, and contingency plan testing. Planning and coordination include emergency and nonemergency (i.e., planned or non-urgent unplanned) situations. The process defined by organizations to plan and coordinate security- and privacy-related activities can also be included in other documents, as appropriate." }, { "id": "pl-2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.01", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.01[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that is consistent with the organization’s enterprise architecture;", "links": [ { "href": "#pl-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.01[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that is consistent with the organization’s enterprise architecture;", "links": [ { "href": "#pl-2_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.02", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.02[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that explicitly defines the constituent system components;", "links": [ { "href": "#pl-2_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.02[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that explicitly defines the constituent system components;", "links": [ { "href": "#pl-2_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.03", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.3-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.03[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes;", "links": [ { "href": "#pl-2_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.3-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.03[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes;", "links": [ { "href": "#pl-2_smt.a.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.04", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.4-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.04[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;", "links": [ { "href": "#pl-2_smt.a.4", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.4-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.04[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;", "links": [ { "href": "#pl-2_smt.a.4", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.4", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.05", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.5-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.05[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;", "links": [ { "href": "#pl-2_smt.a.5", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.5-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.05[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;", "links": [ { "href": "#pl-2_smt.a.5", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.5", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.06", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.6-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.06[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that provides the security categorization of the system, including supporting rationale;", "links": [ { "href": "#pl-2_smt.a.6", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.6-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.06[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale;", "links": [ { "href": "#pl-2_smt.a.6", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.6", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.7", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.07", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.7-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.07[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization;", "links": [ { "href": "#pl-2_smt.a.7", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.7-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.07[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization;", "links": [ { "href": "#pl-2_smt.a.7", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.7", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.8", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.08", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.8-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.08[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;", "links": [ { "href": "#pl-2_smt.a.8", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.8-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.08[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;", "links": [ { "href": "#pl-2_smt.a.8", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.8", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.9", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.09", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.9-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.09[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;", "links": [ { "href": "#pl-2_smt.a.9", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.9-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.09[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;", "links": [ { "href": "#pl-2_smt.a.9", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.9", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.10", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.10", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.10-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.10[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that provides an overview of the security requirements for the system;", "links": [ { "href": "#pl-2_smt.a.10", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.10-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.10[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that provides an overview of the privacy requirements for the system;", "links": [ { "href": "#pl-2_smt.a.10", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.10", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.11", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.11", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.11-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.11[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;", "links": [ { "href": "#pl-2_smt.a.11", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.11-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.11[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;", "links": [ { "href": "#pl-2_smt.a.11", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.11", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.12", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.12", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.12-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.12[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions;", "links": [ { "href": "#pl-2_smt.a.12", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.12-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.12[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions;", "links": [ { "href": "#pl-2_smt.a.12", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.12", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.13", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.13", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.13-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.13[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that includes risk determinations for security architecture and design decisions;", "links": [ { "href": "#pl-2_smt.a.13", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.13-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.13[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions;", "links": [ { "href": "#pl-2_smt.a.13", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.13", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.14", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.14", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.14-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.14[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with {{ insert: param, pl-02_odp.01 }};", "links": [ { "href": "#pl-2_smt.a.14", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.14-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.14[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with {{ insert: param, pl-02_odp.01 }};", "links": [ { "href": "#pl-2_smt.a.14", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.14", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.15", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.15", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.a.15-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.15[01]", "class": "sp800-53a" } ], "prose": "a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation;", "links": [ { "href": "#pl-2_smt.a.15", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.a.15-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02a.15[02]", "class": "sp800-53a" } ], "prose": "a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.", "links": [ { "href": "#pl-2_smt.a.15", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a.15", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02b.", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02b.[01]", "class": "sp800-53a" } ], "prose": "copies of the plans are distributed to {{ insert: param, pl-02_odp.02 }};", "links": [ { "href": "#pl-2_smt.b", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02b.[02]", "class": "sp800-53a" } ], "prose": "subsequent changes to the plans are communicated to {{ insert: param, pl-02_odp.02 }};", "links": [ { "href": "#pl-2_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.b", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02c.", "class": "sp800-53a" } ], "prose": "plans are reviewed {{ insert: param, pl-02_odp.03 }};", "links": [ { "href": "#pl-2_smt.c", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02d.", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02d.[01]", "class": "sp800-53a" } ], "prose": "plans are updated to address changes to the system and environment of operations;", "links": [ { "href": "#pl-2_smt.d", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02d.[02]", "class": "sp800-53a" } ], "prose": "plans are updated to address problems identified during the plan implementation;", "links": [ { "href": "#pl-2_smt.d", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.d-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02d.[03]", "class": "sp800-53a" } ], "prose": "plans are updated to address problems identified during control assessments;", "links": [ { "href": "#pl-2_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.d", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02e.", "class": "sp800-53a" } ], "parts": [ { "id": "pl-2_obj.e-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02e.[01]", "class": "sp800-53a" } ], "prose": "plans are protected from unauthorized disclosure;", "links": [ { "href": "#pl-2_smt.e", "rel": "assessment-for" } ] }, { "id": "pl-2_obj.e-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-02e.[02]", "class": "sp800-53a" } ], "prose": "plans are protected from unauthorized modification.", "links": [ { "href": "#pl-2_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-2_smt", "rel": "assessment-for" } ] }, { "id": "pl-2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PL-02-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy planning policy\n\nprocedures addressing system security and privacy plan development and implementation\n\nprocedures addressing security and privacy plan reviews and updates\n\nenterprise architecture documentation\n\nsystem security plan\n\nprivacy plan\n\nrecords of system security and privacy plan reviews and updates\n\nsecurity and privacy architecture and design documentation\n\nrisk assessments\n\nrisk assessment results\n\ncontrol assessment documentation\n\nother relevant documents or records" } ] }, { "id": "pl-2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PL-02-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system security and privacy planning and plan implementation responsibilities\n\nsystem developers\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pl-2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PL-02-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for system security and privacy plan development, review, update, and approval\n\nmechanisms supporting the system security and privacy plan" } ] } ] }, { "id": "pl-4", "class": "SP800-53", "title": "Rules of Behavior", "params": [ { "id": "pl-04_odp.01", "props": [ { "name": "alt-identifier", "value": "pl-4_prm_1" }, { "name": "label", "value": "PL-04_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency for reviewing and updating the rules of behavior is defined;" } ] }, { "id": "pl-04_odp.02", "props": [ { "name": "alt-identifier", "value": "pl-4_prm_2" }, { "name": "label", "value": "PL-04_ODP[02]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ " {{ insert: param, pl-04_odp.03 }} ", "when the rules are revised or updated" ] } }, { "id": "pl-04_odp.03", "props": [ { "name": "alt-identifier", "value": "pl-4_prm_3" }, { "name": "label", "value": "PL-04_ODP[03]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency for individuals to read and re-acknowledge the rules of behavior is defined (if selected);" } ] } ], "props": [ { "name": "label", "value": "PL-04", "class": "zero-padded" }, { "name": "label", "value": "PL-4" }, { "name": "label", "value": "PL-04", "class": "sp800-53a" }, { "name": "sort-id", "value": "pl-04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#30eb758a-2707-4bca-90ad-949a74d4eb16", "rel": "reference" }, { "href": "#ac-2", "rel": "related" }, { "href": "#ac-6", "rel": "related" }, { "href": "#ac-8", "rel": "related" }, { "href": "#ac-9", "rel": "related" }, { "href": "#ac-17", "rel": "related" }, { "href": "#ac-18", "rel": "related" }, { "href": "#ac-19", "rel": "related" }, { "href": "#ac-20", "rel": "related" }, { "href": "#at-2", "rel": "related" }, { "href": "#at-3", "rel": "related" }, { "href": "#cm-11", "rel": "related" }, { "href": "#ia-2", "rel": "related" }, { "href": "#ia-4", "rel": "related" }, { "href": "#ia-5", "rel": "related" }, { "href": "#mp-7", "rel": "related" }, { "href": "#ps-6", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#sa-5", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "pl-4_smt", "name": "statement", "parts": [ { "id": "pl-4_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;" }, { "id": "pl-4_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;" }, { "id": "pl-4_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the rules of behavior {{ insert: param, pl-04_odp.01 }} ; and" }, { "id": "pl-4_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge {{ insert: param, pl-04_odp.02 }}." } ] }, { "id": "pl-4_gdn", "name": "guidance", "prose": "Rules of behavior represent a type of access agreement for organizational users. Other types of access agreements include nondisclosure agreements, conflict-of-interest agreements, and acceptable use agreements (see [PS-6](#ps-6) ). Organizations consider rules of behavior based on individual user roles and responsibilities and differentiate between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users, including individuals who receive information from federal systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for organizational and non-organizational users can also be established in [AC-8](#ac-8) . The related controls section provides a list of controls that are relevant to organizational rules of behavior. [PL-4b](#pl-4_smt.b) , the documented acknowledgment portion of the control, may be satisfied by the literacy training and awareness and role-based training programs conducted by organizations if such training includes rules of behavior. Documented acknowledgements for rules of behavior include electronic or physical signatures and electronic agreement check boxes or radio buttons." }, { "id": "pl-4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04", "class": "sp800-53a" } ], "parts": [ { "id": "pl-4_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04a.", "class": "sp800-53a" } ], "parts": [ { "id": "pl-4_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04a.[01]", "class": "sp800-53a" } ], "prose": "rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system;", "links": [ { "href": "#pl-4_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-4_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04a.[02]", "class": "sp800-53a" } ], "prose": "rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system;", "links": [ { "href": "#pl-4_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-4_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-4_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04b.", "class": "sp800-53a" } ], "prose": "before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received;", "links": [ { "href": "#pl-4_smt.b", "rel": "assessment-for" } ] }, { "id": "pl-4_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04c.", "class": "sp800-53a" } ], "prose": "rules of behavior are reviewed and updated {{ insert: param, pl-04_odp.01 }};", "links": [ { "href": "#pl-4_smt.c", "rel": "assessment-for" } ] }, { "id": "pl-4_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04d.", "class": "sp800-53a" } ], "prose": "individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge {{ insert: param, pl-04_odp.02 }}.", "links": [ { "href": "#pl-4_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-4_smt", "rel": "assessment-for" } ] }, { "id": "pl-4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PL-04-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy planning policy\n\nprocedures addressing rules of behavior for system users\n\nrules of behavior\n\nsigned acknowledgements\n\nrecords for rules of behavior reviews and updates\n\nother relevant documents or records" } ] }, { "id": "pl-4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PL-04-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior\n\norganizational personnel with responsibility for literacy training and awareness and role-based training\n\norganizational personnel who are authorized users of the system and have signed and resigned rules of behavior\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pl-4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PL-04-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for establishing, reviewing, disseminating, and updating rules of behavior\n\nmechanisms supporting and/or implementing the establishment, review, dissemination, and update of rules of behavior" } ] } ], "controls": [ { "id": "pl-4.1", "class": "SP800-53-enhancement", "title": "Social Media and External Site/Application Usage Restrictions", "props": [ { "name": "label", "value": "PL-04(01)", "class": "zero-padded" }, { "name": "label", "value": "PL-4(1)" }, { "name": "label", "value": "PL-04(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "pl-04.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#pl-4", "rel": "required" }, { "href": "#ac-22", "rel": "related" }, { "href": "#au-13", "rel": "related" } ], "parts": [ { "id": "pl-4.1_smt", "name": "statement", "prose": "Include in the rules of behavior, restrictions on:", "parts": [ { "id": "pl-4.1_smt.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Use of social media, social networking sites, and external sites/applications;" }, { "id": "pl-4.1_smt.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Posting organizational information on public websites; and" }, { "id": "pl-4.1_smt.c", "name": "item", "props": [ { "name": "label", "value": "(c)" } ], "prose": "Use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications." } ] }, { "id": "pl-4.1_gdn", "name": "guidance", "prose": "Social media, social networking, and external site/application usage restrictions address rules of behavior related to the use of social media, social networking, and external sites when organizational personnel are using such sites for official duties or in the conduct of official business, when organizational information is involved in social media and social networking transactions, and when personnel access social media and networking sites from organizational systems. Organizations also address specific rules that prevent unauthorized entities from obtaining non-public organizational information from social media and networking sites either directly or through inference. Non-public information includes personally identifiable information and system account information." }, { "id": "pl-4.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04(01)", "class": "sp800-53a" } ], "parts": [ { "id": "pl-4.1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04(01)(a)", "class": "sp800-53a" } ], "prose": "the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications;", "links": [ { "href": "#pl-4.1_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-4.1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04(01)(b)", "class": "sp800-53a" } ], "prose": "the rules of behavior include restrictions on posting organizational information on public websites;", "links": [ { "href": "#pl-4.1_smt.b", "rel": "assessment-for" } ] }, { "id": "pl-4.1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-04(01)(c)", "class": "sp800-53a" } ], "prose": "the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.", "links": [ { "href": "#pl-4.1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-4.1_smt", "rel": "assessment-for" } ] }, { "id": "pl-4.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PL-04(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy planning policy\n\nprocedures addressing rules of behavior for system users\n\nrules of behavior\n\ntraining policy\n\nother relevant documents or records" } ] }, { "id": "pl-4.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PL-04(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior\n\norganizational personnel with responsibility for literacy training and awareness and role-based training\n\norganizational personnel who are authorized users of the system and have signed rules of behavior\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pl-4.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PL-04(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for establishing rules of behavior\n\nmechanisms supporting and/or implementing the establishment of rules of behavior" } ] } ] } ] }, { "id": "pl-8", "class": "SP800-53", "title": "Security and Privacy Architectures", "params": [ { "id": "pl-08_odp", "props": [ { "name": "alt-identifier", "value": "pl-8_prm_1" }, { "name": "label", "value": "PL-08_ODP", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency for review and update to reflect changes in the enterprise architecture;" } ] } ], "props": [ { "name": "label", "value": "PL-08", "class": "zero-padded" }, { "name": "label", "value": "PL-8" }, { "name": "label", "value": "PL-08", "class": "sp800-53a" }, { "name": "sort-id", "value": "pl-08" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#61ccf0f4-d3e7-42db-9796-ce6cb1c85989", "rel": "reference" }, { "href": "#cm-2", "rel": "related" }, { "href": "#cm-6", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pl-7", "rel": "related" }, { "href": "#pl-9", "rel": "related" }, { "href": "#pm-5", "rel": "related" }, { "href": "#pm-7", "rel": "related" }, { "href": "#ra-9", "rel": "related" }, { "href": "#sa-3", "rel": "related" }, { "href": "#sa-5", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-17", "rel": "related" }, { "href": "#sc-7", "rel": "related" } ], "parts": [ { "id": "pl-8_smt", "name": "statement", "parts": [ { "id": "pl-8_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop security and privacy architectures for the system that:", "parts": [ { "id": "pl-8_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;" }, { "id": "pl-8_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;" }, { "id": "pl-8_smt.a.3", "name": "item", "props": [ { "name": "label", "value": "3." } ], "prose": "Describe how the architectures are integrated into and support the enterprise architecture; and" }, { "id": "pl-8_smt.a.4", "name": "item", "props": [ { "name": "label", "value": "4." } ], "prose": "Describe any assumptions about, and dependencies on, external systems and services;" } ] }, { "id": "pl-8_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Review and update the architectures {{ insert: param, pl-08_odp }} to reflect changes in the enterprise architecture; and" }, { "id": "pl-8_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions." } ] }, { "id": "pl-8_gdn", "name": "guidance", "prose": "The security and privacy architectures at the system level are consistent with the organization-wide security and privacy architectures described in [PM-7](#pm-7) , which are integral to and developed as part of the enterprise architecture. The architectures include an architectural description, the allocation of security and privacy functionality (including controls), security- and privacy-related information for external interfaces, information being exchanged across the interfaces, and the protection mechanisms associated with each interface. The architectures can also include other information, such as user roles and the access privileges assigned to each role; security and privacy requirements; types of information processed, stored, and transmitted by the system; supply chain risk management requirements; restoration priorities of information and system services; and other protection needs.\n\n [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) provides guidance on the use of security architectures as part of the system development life cycle process. [OMB M-19-03](#c5e11048-1d38-4af3-b00b-0d88dc26860c) requires the use of the systems security engineering concepts described in [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) for high value assets. Security and privacy architectures are reviewed and updated throughout the system development life cycle, from analysis of alternatives through review of the proposed architecture in the RFP responses to the design reviews before and during implementation (e.g., during preliminary design reviews and critical design reviews).\n\nIn today’s modern computing architectures, it is becoming less common for organizations to control all information resources. There may be key dependencies on external information services and service providers. Describing such dependencies in the security and privacy architectures is necessary for developing a comprehensive mission and business protection strategy. Establishing, developing, documenting, and maintaining under configuration control a baseline configuration for organizational systems is critical to implementing and maintaining effective architectures. The development of the architectures is coordinated with the senior agency information security officer and the senior agency official for privacy to ensure that the controls needed to support security and privacy requirements are identified and effectively implemented. In many circumstances, there may be no distinction between the security and privacy architecture for a system. In other circumstances, security objectives may be adequately satisfied, but privacy objectives may only be partially satisfied by the security requirements. In these cases, consideration of the privacy requirements needed to achieve satisfaction will result in a distinct privacy architecture. The documentation, however, may simply reflect the combined architectures.\n\n [PL-8](#pl-8) is primarily directed at organizations to ensure that architectures are developed for the system and, moreover, that the architectures are integrated with or tightly coupled to the enterprise architecture. In contrast, [SA-17](#sa-17) is primarily directed at the external information technology product and system developers and integrators. [SA-17](#sa-17) , which is complementary to [PL-8](#pl-8) , is selected when organizations outsource the development of systems or components to external entities and when there is a need to demonstrate consistency with the organization’s enterprise architecture and security and privacy architectures." }, { "id": "pl-8_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08", "class": "sp800-53a" } ], "parts": [ { "id": "pl-8_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08a.", "class": "sp800-53a" } ], "parts": [ { "id": "pl-8_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08a.01", "class": "sp800-53a" } ], "prose": "a security architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;", "links": [ { "href": "#pl-8_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08a.02", "class": "sp800-53a" } ], "prose": "a privacy architecture describes the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;", "links": [ { "href": "#pl-8_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.a.3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08a.03", "class": "sp800-53a" } ], "parts": [ { "id": "pl-8_obj.a.3-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08a.03[01]", "class": "sp800-53a" } ], "prose": "a security architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;", "links": [ { "href": "#pl-8_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.a.3-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08a.03[02]", "class": "sp800-53a" } ], "prose": "a privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;", "links": [ { "href": "#pl-8_smt.a.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-8_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.a.4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08a.04", "class": "sp800-53a" } ], "parts": [ { "id": "pl-8_obj.a.4-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08a.04[01]", "class": "sp800-53a" } ], "prose": "a security architecture for the system describes any assumptions about and dependencies on external systems and services;", "links": [ { "href": "#pl-8_smt.a.4", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.a.4-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08a.04[02]", "class": "sp800-53a" } ], "prose": "a privacy architecture for the system describes any assumptions about and dependencies on external systems and services;", "links": [ { "href": "#pl-8_smt.a.4", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-8_smt.a.4", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-8_smt.a", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08b.", "class": "sp800-53a" } ], "prose": "changes in the enterprise architecture are reviewed and updated {{ insert: param, pl-08_odp }} to reflect changes in the enterprise architecture;", "links": [ { "href": "#pl-8_smt.b", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08c.", "class": "sp800-53a" } ], "parts": [ { "id": "pl-8_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08c.[01]", "class": "sp800-53a" } ], "prose": "planned architecture changes are reflected in the security plan;", "links": [ { "href": "#pl-8_smt.c", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08c.[02]", "class": "sp800-53a" } ], "prose": "planned architecture changes are reflected in the privacy plan;", "links": [ { "href": "#pl-8_smt.c", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.c-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08c.[03]", "class": "sp800-53a" } ], "prose": "planned architecture changes are reflected in the Concept of Operations (CONOPS);", "links": [ { "href": "#pl-8_smt.c", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.c-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08c.[04]", "class": "sp800-53a" } ], "prose": "planned architecture changes are reflected in criticality analysis;", "links": [ { "href": "#pl-8_smt.c", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.c-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08c.[05]", "class": "sp800-53a" } ], "prose": "planned architecture changes are reflected in organizational procedures;", "links": [ { "href": "#pl-8_smt.c", "rel": "assessment-for" } ] }, { "id": "pl-8_obj.c-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-08c.[06]", "class": "sp800-53a" } ], "prose": "planned architecture changes are reflected in procurements and acquisitions.", "links": [ { "href": "#pl-8_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-8_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pl-8_smt", "rel": "assessment-for" } ] }, { "id": "pl-8_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PL-08-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy planning policy\n\nprocedures addressing information security and privacy architecture development\n\nprocedures addressing information security and privacy architecture reviews and updates\n\nenterprise architecture documentation\n\ninformation security and privacy architecture documentation\n\nsystem security plan\n\nprivacy plan\n\nsecurity and privacy CONOPS for the system\n\nrecords of information security and privacy architecture reviews and updates\n\nother relevant documents or records" } ] }, { "id": "pl-8_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PL-08-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with security and privacy planning and plan implementation responsibilities\n\norganizational personnel with information security and privacy architecture development responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pl-8_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PL-08-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for developing, reviewing, and updating the information security and privacy architecture\n\nmechanisms supporting and/or implementing the development, review, and update of the information security and privacy architecture" } ] } ] }, { "id": "pl-9", "class": "SP800-53", "title": "Central Management", "params": [ { "id": "pl-09_odp", "props": [ { "name": "alt-identifier", "value": "pl-9_prm_1" }, { "name": "label", "value": "PL-09_ODP", "class": "sp800-53a" } ], "label": "controls and related processes", "guidelines": [ { "prose": "security and privacy controls and related processes to be centrally managed are defined;" } ] } ], "props": [ { "name": "label", "value": "PL-09", "class": "zero-padded" }, { "name": "label", "value": "PL-9" }, { "name": "label", "value": "PL-09", "class": "sp800-53a" }, { "name": "sort-id", "value": "pl-09" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#pl-8", "rel": "related" }, { "href": "#pm-9", "rel": "related" } ], "parts": [ { "id": "pl-9_smt", "name": "statement", "prose": "Centrally manage {{ insert: param, pl-09_odp }}." }, { "id": "pl-9_gdn", "name": "guidance", "prose": "Central management refers to organization-wide management and implementation of selected controls and processes. This includes planning, implementing, assessing, authorizing, and monitoring the organization-defined, centrally managed controls and processes. As the central management of controls is generally associated with the concept of common (inherited) controls, such management promotes and facilitates standardization of control implementations and management and the judicious use of organizational resources. Centrally managed controls and processes may also meet independence requirements for assessments in support of initial and ongoing authorizations to operate and as part of organizational continuous monitoring.\n\nAutomated tools (e.g., security information and event management tools or enterprise security monitoring and management tools) can improve the accuracy, consistency, and availability of information associated with centrally managed controls and processes. Automation can also provide data aggregation and data correlation capabilities; alerting mechanisms; and dashboards to support risk-based decision-making within the organization.\n\nAs part of the control selection processes, organizations determine the controls that may be suitable for central management based on resources and capabilities. It is not always possible to centrally manage every aspect of a control. In such cases, the control can be treated as a hybrid control with the control managed and implemented centrally or at the system level. The controls and control enhancements that are candidates for full or partial central management include but are not limited to: [AC-2(1)](#ac-2.1), [AC-2(2)](#ac-2.2), [AC-2(3)](#ac-2.3), [AC-2(4)](#ac-2.4), [AC-4(all)](#ac-4), [AC-17(1)](#ac-17.1), [AC-17(2)](#ac-17.2), [AC-17(3)](#ac-17.3), [AC-17(9)](#ac-17.9), [AC-18(1)](#ac-18.1), [AC-18(3)](#ac-18.3), [AC-18(4)](#ac-18.4), [AC-18(5)](#ac-18.5), [AC-19(4)](#ac-19.4), [AC-22](#ac-22), [AC-23](#ac-23), [AT-2(1)](#at-2.1), [AT-2(2)](#at-2.2), [AT-3(1)](#at-3.1), [AT-3(2)](#at-3.2), [AT-3(3)](#at-3.3), [AT-4](#at-4), [AU-3](#au-3), [AU-6(1)](#au-6.1), [AU-6(3)](#au-6.3), [AU-6(5)](#au-6.5), [AU-6(6)](#au-6.6), [AU-6(9)](#au-6.9), [AU-7(1)](#au-7.1), [AU-7(2)](#au-7.2), [AU-11](#au-11), [AU-13](#au-13), [AU-16](#au-16), [CA-2(1)](#ca-2.1), [CA-2(2)](#ca-2.2), [CA-2(3)](#ca-2.3), [CA-3(1)](#ca-3.1), [CA-3(2)](#ca-3.2), [CA-3(3)](#ca-3.3), [CA-7(1)](#ca-7.1), [CA-9](#ca-9), [CM-2(2)](#cm-2.2), [CM-3(1)](#cm-3.1), [CM-3(4)](#cm-3.4), [CM-4](#cm-4), [CM-6](#cm-6), [CM-6(1)](#cm-6.1), [CM-7(2)](#cm-7.2), [CM-7(4)](#cm-7.4), [CM-7(5)](#cm-7.5), [CM-8(all)](#cm-8), [CM-9(1)](#cm-9.1), [CM-10](#cm-10), [CM-11](#cm-11), [CP-7(all)](#cp-7), [CP-8(all)](#cp-8), [SC-43](#sc-43), [SI-2](#si-2), [SI-3](#si-3), [SI-4(all)](#si-4), [SI-7](#si-7), [SI-8](#si-8)." }, { "id": "pl-9_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PL-09", "class": "sp800-53a" } ], "prose": " {{ insert: param, pl-09_odp }} are centrally managed.", "links": [ { "href": "#pl-9_smt", "rel": "assessment-for" } ] }, { "id": "pl-9_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PL-09-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy planning policy\n\nprocedures addressing security and privacy plan development and implementation\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pl-9_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PL-09-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with security and privacy planning and plan implementation responsibilities\n\norganizational personnel with responsibilities for planning/implementing central management of controls and related processes\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pl-9_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PL-09-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for the central management of controls and related processes\n\nmechanisms supporting and/or implementing central management of controls and related processes" } ] } ] } ] }, { "id": "pm", "class": "family", "title": "Program Management", "props": [ { "name": "label", "value": "PM" } ], "parts": [ { "id": "pm_ovw", "name": "overview", "title": "Program Management Controls", "prose": " [FISMA](#0c67b2a9-bede-43d2-b86d-5f35b8be36e9), [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) , and [OMB A-130](#27847491-5ce1-4f6a-a1e4-9e483782f0ef) require federal agencies to develop, implement, and provide oversight for organization-wide information security and privacy programs to help ensure the confidentiality, integrity, and availability of federal information processed, stored, and transmitted by federal information systems and to protect individual privacy. The program management (PM) controls described in this section are implemented at the organization level and not directed at individual information systems. The PM controls have been designed to facilitate organizational compliance with applicable federal laws, executive orders, directives, policies, regulations, and standards. The controls are independent of [FIPS 200](#599fb53d-5041-444e-a7fe-640d6d30ad05) impact levels and, therefore, are not associated with the control baselines described in [SP 800-53B](#46d9e201-840e-440e-987c-2c773333c752).\n\nOrganizations document program management controls in the information security and privacy program plans. The organization-wide information security program plan (see [PM-1](#pm-1) ) and privacy program plan (see [PM-18](#pm-18) ) supplement system security and privacy plans (see [PL-2](#pl-2) ) developed for organizational information systems. Together, the system security and privacy plans for the individual information systems and the information security and privacy program plans cover the totality of security and privacy controls employed by the organization." } ], "controls": [ { "id": "pm-3", "class": "SP800-53", "title": "Information Security and Privacy Resources", "props": [ { "name": "label", "value": "PM-03", "class": "zero-padded" }, { "name": "label", "value": "PM-3" }, { "name": "label", "value": "PM-03", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#pm-4", "rel": "related" }, { "href": "#sa-2", "rel": "related" } ], "parts": [ { "id": "pm-3_smt", "name": "statement", "parts": [ { "id": "pm-3_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;" }, { "id": "pm-3_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and" }, { "id": "pm-3_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Make available for expenditure, the planned information security and privacy resources." } ] }, { "id": "pm-3_gdn", "name": "guidance", "prose": "Organizations consider establishing champions for information security and privacy and, as part of including the necessary resources, assign specialized expertise and resources as needed. Organizations may designate and empower an Investment Review Board or similar group to manage and provide oversight for the information security and privacy aspects of the capital planning and investment control process." }, { "id": "pm-3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03", "class": "sp800-53a" } ], "parts": [ { "id": "pm-3_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-3_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03a.[01]", "class": "sp800-53a" } ], "prose": "the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented;", "links": [ { "href": "#pm-3_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-3_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03a.[02]", "class": "sp800-53a" } ], "prose": "the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented;", "links": [ { "href": "#pm-3_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-3_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-3_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-3_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03b.[01]", "class": "sp800-53a" } ], "prose": "the documentation required for addressing the information security program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;", "links": [ { "href": "#pm-3_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-3_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03b.[02]", "class": "sp800-53a" } ], "prose": "the documentation required for addressing the privacy program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;", "links": [ { "href": "#pm-3_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-3_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-3_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03c.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-3_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03c.[01]", "class": "sp800-53a" } ], "prose": "information security resources are made available for expenditure as planned;", "links": [ { "href": "#pm-3_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-3_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-03c.[02]", "class": "sp800-53a" } ], "prose": "privacy resources are made available for expenditure as planned.", "links": [ { "href": "#pm-3_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-3_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-3_smt", "rel": "assessment-for" } ] }, { "id": "pm-3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-03-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nExhibit 300\n\nExhibit 53\n\nbusiness cases for capital planning and investment\n\nprocedures for capital planning and investment\n\ndocumentation of exceptions to capital planning requirements\n\nother relevant documents or records" } ] }, { "id": "pm-3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-03-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security program planning responsibilities\n\norganizational personnel with privacy program planning responsibilities\n\norganizational personnel responsible for capital planning and investment\n\norganizational personnel with information security responsibilities\n\norganizational personnel with privacy responsibilities" } ] }, { "id": "pm-3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-03-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for capital planning and investment\n\norganizational processes for business case, Exhibit 300, and Exhibit 53 development\n\nmechanisms supporting the capital planning and investment process" } ] } ] }, { "id": "pm-4", "class": "SP800-53", "title": "Plan of Action and Milestones Process", "props": [ { "name": "label", "value": "PM-04", "class": "zero-padded" }, { "name": "label", "value": "PM-4" }, { "name": "label", "value": "PM-04", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#ca-5", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#pm-3", "rel": "related" }, { "href": "#ra-7", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "pm-4_smt", "name": "statement", "parts": [ { "id": "pm-4_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:", "parts": [ { "id": "pm-4_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Are developed and maintained;" }, { "id": "pm-4_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and" }, { "id": "pm-4_smt.a.3", "name": "item", "props": [ { "name": "label", "value": "3." } ], "prose": "Are reported in accordance with established reporting requirements." } ] }, { "id": "pm-4_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions." } ] }, { "id": "pm-4_gdn", "name": "guidance", "prose": "The plan of action and milestones is a key organizational document and is subject to reporting requirements established by the Office of Management and Budget. Organizations develop plans of action and milestones with an organization-wide perspective, prioritizing risk response actions and ensuring consistency with the goals and objectives of the organization. Plan of action and milestones updates are based on findings from control assessments and continuous monitoring activities. There can be multiple plans of action and milestones corresponding to the information system level, mission/business process level, and organizational/governance level. While plans of action and milestones are required for federal organizations, other types of organizations can help reduce risk by documenting and tracking planned remediations. Specific guidance on plans of action and milestones at the system level is provided in [CA-5](#ca-5)." }, { "id": "pm-4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04", "class": "sp800-53a" } ], "parts": [ { "id": "pm-4_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-4_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.01", "class": "sp800-53a" } ], "parts": [ { "id": "pm-4_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.01[01]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed;", "links": [ { "href": "#pm-4_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.01[02]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained;", "links": [ { "href": "#pm-4_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.1-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.01[03]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed;", "links": [ { "href": "#pm-4_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.1-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.01[04]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained;", "links": [ { "href": "#pm-4_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.1-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.01[05]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed;", "links": [ { "href": "#pm-4_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.1-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.01[06]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained;", "links": [ { "href": "#pm-4_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-4_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.02", "class": "sp800-53a" } ], "parts": [ { "id": "pm-4_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.02[01]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;", "links": [ { "href": "#pm-4_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.02[02]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;", "links": [ { "href": "#pm-4_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.2-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.02[03]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;", "links": [ { "href": "#pm-4_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-4_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.03", "class": "sp800-53a" } ], "parts": [ { "id": "pm-4_obj.a.3-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.03[01]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements;", "links": [ { "href": "#pm-4_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.3-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.03[02]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements;", "links": [ { "href": "#pm-4_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.a.3-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04a.03[03]", "class": "sp800-53a" } ], "prose": "a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements;", "links": [ { "href": "#pm-4_smt.a.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-4_smt.a.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-4_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-4_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04b.[01]", "class": "sp800-53a" } ], "prose": "plans of action and milestones are reviewed for consistency with the organizational risk management strategy;", "links": [ { "href": "#pm-4_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-4_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-04b.[02]", "class": "sp800-53a" } ], "prose": "plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.", "links": [ { "href": "#pm-4_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-4_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-4_smt", "rel": "assessment-for" } ] }, { "id": "pm-4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-04-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nplans of action and milestones\n\nprocedures addressing plans of action and milestones development and maintenance\n\nprocedures addressing plans of action and milestones reporting\n\nprocedures for reviewing plans of action and milestones for consistency with risk management strategy and risk response priorities\n\nresults of risk assessments associated with plans of action and milestones\n\nOMB FISMA reporting requirements\n\nother relevant documents or records" } ] }, { "id": "pm-4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-04-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for developing, maintaining, reviewing, and reporting plans of action and milestones\n\norganizational personnel with information security responsibilities" } ] }, { "id": "pm-4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-04-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for plan of action and milestones development, review, maintenance, and reporting\n\nmechanisms supporting plans of action and milestones" } ] } ] }, { "id": "pm-5.1", "class": "SP800-53-enhancement", "title": "Inventory of Personally Identifiable Information", "params": [ { "id": "pm-05.01_odp", "props": [ { "name": "alt-identifier", "value": "pm-5.1_prm_1" }, { "name": "label", "value": "PM-05(01)_ODP", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-05(01)", "class": "zero-padded" }, { "name": "label", "value": "PM-5(1)" }, { "name": "label", "value": "PM-05(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-05.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#pm-5", "rel": "required" }, { "href": "#ac-3", "rel": "related" }, { "href": "#cm-8", "rel": "related" }, { "href": "#cm-12", "rel": "related" }, { "href": "#cm-13", "rel": "related" }, { "href": "#pl-8", "rel": "related" }, { "href": "#pm-22", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#pt-5", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#si-18", "rel": "related" } ], "parts": [ { "id": "pm-5.1_smt", "name": "statement", "prose": "Establish, maintain, and update {{ insert: param, pm-05.01_odp }} an inventory of all systems, applications, and projects that process personally identifiable information." }, { "id": "pm-5.1_gdn", "name": "guidance", "prose": "An inventory of systems, applications, and projects that process personally identifiable information supports the mapping of data actions, providing individuals with privacy notices, maintaining accurate personally identifiable information, and limiting the processing of personally identifiable information when such information is not needed for operational purposes. Organizations may use this inventory to ensure that systems only process the personally identifiable information for authorized purposes and that this processing is still relevant and necessary for the purpose specified therein." }, { "id": "pm-5.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-05(01)", "class": "sp800-53a" } ], "parts": [ { "id": "pm-5.1_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-05(01)[01]", "class": "sp800-53a" } ], "prose": "an inventory of all systems, applications, and projects that process personally identifiable information is established;", "links": [ { "href": "#pm-5.1_smt", "rel": "assessment-for" } ] }, { "id": "pm-5.1_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-05(01)[02]", "class": "sp800-53a" } ], "prose": "an inventory of all systems, applications, and projects that process personally identifiable information is maintained;", "links": [ { "href": "#pm-5.1_smt", "rel": "assessment-for" } ] }, { "id": "pm-5.1_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-05(01)[03]", "class": "sp800-53a" } ], "prose": "an inventory of all systems, applications, and projects that process personally identifiable information is updated {{ insert: param, pm-05.01_odp }}.", "links": [ { "href": "#pm-5.1_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-5.1_smt", "rel": "assessment-for" } ] }, { "id": "pm-5.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-05(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Procedures addressing system inventory development, maintenance, and updates\n\nOMB FISMA reporting guidance\n\nprivacy program plan\n\ninformation security program plan\n\npersonally identifiable information processing policy\n\nsystem inventory\n\npersonally identifiable information inventory\n\ndata mapping documentation\n\nother relevant documents or records" } ] }, { "id": "pm-5.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-05(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program planning and plan implementation responsibilities\n\norganizational personnel responsible for developing and maintaining the system inventory\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pm-5.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-05(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for system inventory development, maintenance, and updates\n\nmechanisms supporting the system inventory" } ] } ] }, { "id": "pm-6", "class": "SP800-53", "title": "Measures of Performance", "props": [ { "name": "label", "value": "PM-06", "class": "zero-padded" }, { "name": "label", "value": "PM-6" }, { "name": "label", "value": "PM-06", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-06" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#7798067b-4ed0-4adc-a505-79dad4741693", "rel": "reference" }, { "href": "#067223d8-1ec7-45c5-b21b-c848da6de8fb", "rel": "reference" }, { "href": "#ca-7", "rel": "related" }, { "href": "#pm-9", "rel": "related" } ], "parts": [ { "id": "pm-6_smt", "name": "statement", "prose": "Develop, monitor, and report on the results of information security and privacy measures of performance." }, { "id": "pm-6_gdn", "name": "guidance", "prose": "Measures of performance are outcome-based metrics used by an organization to measure the effectiveness or efficiency of the information security and privacy programs and the controls employed in support of the program. To facilitate security and privacy risk management, organizations consider aligning measures of performance with the organizational risk tolerance as defined in the risk management strategy." }, { "id": "pm-6_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-06", "class": "sp800-53a" } ], "parts": [ { "id": "pm-6_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-06[01]", "class": "sp800-53a" } ], "prose": "information security measures of performance are developed;", "links": [ { "href": "#pm-6_smt", "rel": "assessment-for" } ] }, { "id": "pm-6_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-06[02]", "class": "sp800-53a" } ], "prose": "information security measures of performance are monitored;", "links": [ { "href": "#pm-6_smt", "rel": "assessment-for" } ] }, { "id": "pm-6_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-06[03]", "class": "sp800-53a" } ], "prose": "the results of information security measures of performance are reported;", "links": [ { "href": "#pm-6_smt", "rel": "assessment-for" } ] }, { "id": "pm-6_obj-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-06[04]", "class": "sp800-53a" } ], "prose": "privacy measures of performance are developed;", "links": [ { "href": "#pm-6_smt", "rel": "assessment-for" } ] }, { "id": "pm-6_obj-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-06[05]", "class": "sp800-53a" } ], "prose": "privacy measures of performance are monitored;", "links": [ { "href": "#pm-6_smt", "rel": "assessment-for" } ] }, { "id": "pm-6_obj-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-06[06]", "class": "sp800-53a" } ], "prose": "the results of privacy measures of performance are reported.", "links": [ { "href": "#pm-6_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-6_smt", "rel": "assessment-for" } ] }, { "id": "pm-6_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-06-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\ninformation security measures of performance\n\nprivacy measures of performance\n\nprocedures addressing the development, monitoring, and reporting of information security and privacy measures of performance\n\nrisk management strategy\n\nother relevant documents or records" } ] }, { "id": "pm-6_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-06-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy program planning and plan implementation responsibilities\n\norganizational personnel responsible for developing, monitoring, and reporting information security and privacy measures of performance\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pm-6_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-06-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for developing, monitoring, and reporting information security and privacy measures of performance\n\nmechanisms supporting the development, monitoring, and reporting of information security and privacy measures of performance" } ] } ] }, { "id": "pm-7", "class": "SP800-53", "title": "Enterprise Architecture", "props": [ { "name": "label", "value": "PM-07", "class": "zero-padded" }, { "name": "label", "value": "PM-7" }, { "name": "label", "value": "PM-07", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-07" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#61ccf0f4-d3e7-42db-9796-ce6cb1c85989", "rel": "reference" }, { "href": "#au-6", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pl-8", "rel": "related" }, { "href": "#pm-11", "rel": "related" }, { "href": "#ra-2", "rel": "related" }, { "href": "#sa-3", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-17", "rel": "related" } ], "parts": [ { "id": "pm-7_smt", "name": "statement", "prose": "Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation." }, { "id": "pm-7_gdn", "name": "guidance", "prose": "The integration of security and privacy requirements and controls into the enterprise architecture helps to ensure that security and privacy considerations are addressed throughout the system development life cycle and are explicitly related to the organization’s mission and business processes. The process of security and privacy requirements integration also embeds into the enterprise architecture and the organization’s security and privacy architectures consistent with the organizational risk management strategy. For PM-7, security and privacy architectures are developed at a system-of-systems level, representing all organizational systems. For [PL-8](#pl-8) , the security and privacy architectures are developed at a level that represents an individual system. The system-level architectures are consistent with the security and privacy architectures defined for the organization. Security and privacy requirements and control integration are most effectively accomplished through the rigorous application of the Risk Management Framework [SP 800-37](#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8) and supporting security standards and guidelines." }, { "id": "pm-7_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-07", "class": "sp800-53a" } ], "parts": [ { "id": "pm-7_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-07[01]", "class": "sp800-53a" } ], "prose": "an enterprise architecture is developed with consideration for information security;", "links": [ { "href": "#pm-7_smt", "rel": "assessment-for" } ] }, { "id": "pm-7_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-07[02]", "class": "sp800-53a" } ], "prose": "an enterprise architecture is maintained with consideration for information security;", "links": [ { "href": "#pm-7_smt", "rel": "assessment-for" } ] }, { "id": "pm-7_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-07[03]", "class": "sp800-53a" } ], "prose": "an enterprise architecture is developed with consideration for privacy;", "links": [ { "href": "#pm-7_smt", "rel": "assessment-for" } ] }, { "id": "pm-7_obj-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-07[04]", "class": "sp800-53a" } ], "prose": "an enterprise architecture is maintained with consideration for privacy;", "links": [ { "href": "#pm-7_smt", "rel": "assessment-for" } ] }, { "id": "pm-7_obj-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-07[05]", "class": "sp800-53a" } ], "prose": "an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation;", "links": [ { "href": "#pm-7_smt", "rel": "assessment-for" } ] }, { "id": "pm-7_obj-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-07[06]", "class": "sp800-53a" } ], "prose": "an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.", "links": [ { "href": "#pm-7_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-7_smt", "rel": "assessment-for" } ] }, { "id": "pm-7_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-07-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\nenterprise architecture documentation\n\nprocedures addressing enterprise architecture development\n\nresults of risk assessments of enterprise architecture\n\nother relevant documents or records" } ] }, { "id": "pm-7_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-07-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy program planning and plan implementation responsibilities\n\norganizational personnel responsible for developing enterprise architecture\n\norganizational personnel responsible for risk assessments of enterprise architecture\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pm-7_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-07-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for enterprise architecture development\n\nmechanisms supporting the enterprise architecture and its development" } ] } ] }, { "id": "pm-8", "class": "SP800-53", "title": "Critical Infrastructure Plan", "props": [ { "name": "label", "value": "PM-08", "class": "zero-padded" }, { "name": "label", "value": "PM-8" }, { "name": "label", "value": "PM-08", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-08" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#3406fdc0-d61c-44a9-a5ca-84180544c83a", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#488d6934-00b2-4252-bf23-1b3c2d71eb13", "rel": "reference" }, { "href": "#b9951d04-6385-478c-b1a3-ab68c19d9041", "rel": "reference" }, { "href": "#cp-2", "rel": "related" }, { "href": "#cp-4", "rel": "related" }, { "href": "#pe-18", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-11", "rel": "related" }, { "href": "#pm-18", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "pm-8_smt", "name": "statement", "prose": "Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan." }, { "id": "pm-8_gdn", "name": "guidance", "prose": "Protection strategies are based on the prioritization of critical assets and resources. The requirement and guidance for defining critical infrastructure and key resources and for preparing an associated critical infrastructure protection plan are found in applicable laws, executive orders, directives, policies, regulations, standards, and guidelines." }, { "id": "pm-8_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-08", "class": "sp800-53a" } ], "parts": [ { "id": "pm-8_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-08[01]", "class": "sp800-53a" } ], "prose": "information security issues are addressed in the development of a critical infrastructure and key resources protection plan;", "links": [ { "href": "#pm-8_smt", "rel": "assessment-for" } ] }, { "id": "pm-8_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-08[02]", "class": "sp800-53a" } ], "prose": "information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan;", "links": [ { "href": "#pm-8_smt", "rel": "assessment-for" } ] }, { "id": "pm-8_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-08[03]", "class": "sp800-53a" } ], "prose": "information security issues are addressed in the update of a critical infrastructure and key resources protection plan;", "links": [ { "href": "#pm-8_smt", "rel": "assessment-for" } ] }, { "id": "pm-8_obj-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-08[04]", "class": "sp800-53a" } ], "prose": "privacy issues are addressed in the development of a critical infrastructure and key resources protection plan;", "links": [ { "href": "#pm-8_smt", "rel": "assessment-for" } ] }, { "id": "pm-8_obj-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-08[05]", "class": "sp800-53a" } ], "prose": "privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan;", "links": [ { "href": "#pm-8_smt", "rel": "assessment-for" } ] }, { "id": "pm-8_obj-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-08[06]", "class": "sp800-53a" } ], "prose": "privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.", "links": [ { "href": "#pm-8_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-8_smt", "rel": "assessment-for" } ] }, { "id": "pm-8_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-08-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\ncritical infrastructure and key resources protection plan\n\nprocedures addressing the development, documentation, and updating of the critical infrastructure and key resources protection plan\n\nHSPD 7\n\nNational Infrastructure Protection Plan\n\nother relevant documents or records" } ] }, { "id": "pm-8_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-08-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy program planning and plan implementation responsibilities\n\norganizational personnel responsible for developing, documenting, and updating the critical infrastructure and key resources protection plan\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pm-8_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-08-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for developing, documenting, and updating the critical infrastructure and key resources protection plan\n\nmechanisms supporting the development, documentation, and updating of the critical infrastructure and key resources protection plan" } ] } ] }, { "id": "pm-9", "class": "SP800-53", "title": "Risk Management Strategy", "params": [ { "id": "pm-09_odp", "props": [ { "name": "alt-identifier", "value": "pm-9_prm_1" }, { "name": "label", "value": "PM-09_ODP", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to review and update the risk management strategy is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-09", "class": "zero-padded" }, { "name": "label", "value": "PM-9" }, { "name": "label", "value": "PM-09", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-09" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#e8e84963-14fc-4c3a-be05-b412a5d37cd2", "rel": "reference" }, { "href": "#4c501da5-9d79-4cb6-ba80-97260e1ce327", "rel": "reference" }, { "href": "#ac-1", "rel": "related" }, { "href": "#au-1", "rel": "related" }, { "href": "#at-1", "rel": "related" }, { "href": "#ca-1", "rel": "related" }, { "href": "#ca-2", "rel": "related" }, { "href": "#ca-5", "rel": "related" }, { "href": "#ca-6", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#cm-1", "rel": "related" }, { "href": "#cp-1", "rel": "related" }, { "href": "#ia-1", "rel": "related" }, { "href": "#ir-1", "rel": "related" }, { "href": "#ma-1", "rel": "related" }, { "href": "#mp-1", "rel": "related" }, { "href": "#pe-1", "rel": "related" }, { "href": "#pl-1", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pm-2", "rel": "related" }, { "href": "#pm-8", "rel": "related" }, { "href": "#pm-18", "rel": "related" }, { "href": "#pm-28", "rel": "related" }, { "href": "#pm-30", "rel": "related" }, { "href": "#ps-1", "rel": "related" }, { "href": "#pt-1", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#ra-1", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#ra-9", "rel": "related" }, { "href": "#sa-1", "rel": "related" }, { "href": "#sa-4", "rel": "related" }, { "href": "#sc-1", "rel": "related" }, { "href": "#sc-38", "rel": "related" }, { "href": "#si-1", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#sr-1", "rel": "related" }, { "href": "#sr-2", "rel": "related" } ], "parts": [ { "id": "pm-9_smt", "name": "statement", "parts": [ { "id": "pm-9_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develops a comprehensive strategy to manage:", "parts": [ { "id": "pm-9_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and" }, { "id": "pm-9_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Privacy risk to individuals resulting from the authorized processing of personally identifiable information;" } ] }, { "id": "pm-9_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Implement the risk management strategy consistently across the organization; and" }, { "id": "pm-9_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the risk management strategy {{ insert: param, pm-09_odp }} or as required, to address organizational changes." } ] }, { "id": "pm-9_gdn", "name": "guidance", "prose": "An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization’s risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide. The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in [PM-30](#pm-30) can also provide useful inputs to the organization-wide risk management strategy." }, { "id": "pm-9_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-09", "class": "sp800-53a" } ], "parts": [ { "id": "pm-9_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-09a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-9_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-09a.01", "class": "sp800-53a" } ], "prose": "a comprehensive strategy is developed to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems;", "links": [ { "href": "#pm-9_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-9_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-09a.02", "class": "sp800-53a" } ], "prose": "a comprehensive strategy is developed to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information;", "links": [ { "href": "#pm-9_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-9_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-9_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-09b.", "class": "sp800-53a" } ], "prose": "the risk management strategy is implemented consistently across the organization;", "links": [ { "href": "#pm-9_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-9_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-09c.", "class": "sp800-53a" } ], "prose": "the risk management strategy is reviewed and updated {{ insert: param, pm-09_odp }} or as required to address organizational changes.", "links": [ { "href": "#pm-9_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-9_smt", "rel": "assessment-for" } ] }, { "id": "pm-9_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-09-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\nrisk management strategy\n\nsupply chain risk management strategy\n\nprocedures addressing the development, implementation, review, and update of the risk management strategy\n\nrisk assessment results relevant to the risk management strategy\n\nother relevant documents or records" } ] }, { "id": "pm-9_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-09-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy program planning and plan implementation responsibilities\n\norganizational personnel responsible for the development, implementation, review, and update of the risk management strategy\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pm-9_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-09-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for the development, implementation, review, and update of the risk management strategy\n\nmechanisms supporting the development, implementation, review, and update of the risk management strategy" } ] } ] }, { "id": "pm-10", "class": "SP800-53", "title": "Authorization Process", "props": [ { "name": "label", "value": "PM-10", "class": "zero-padded" }, { "name": "label", "value": "PM-10" }, { "name": "label", "value": "PM-10", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-10" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#276bd50a-7e58-48e5-a405-8c8cb91d7a5f", "rel": "reference" }, { "href": "#ca-6", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#pl-2", "rel": "related" } ], "parts": [ { "id": "pm-10_smt", "name": "statement", "parts": [ { "id": "pm-10_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;" }, { "id": "pm-10_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and" }, { "id": "pm-10_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Integrate the authorization processes into an organization-wide risk management program." } ] }, { "id": "pm-10_gdn", "name": "guidance", "prose": "Authorization processes for organizational systems and environments of operation require the implementation of an organization-wide risk management process and associated security and privacy standards and guidelines. Specific roles for risk management processes include a risk executive (function) and designated authorizing officials for each organizational system and common control provider. The authorization processes for the organization are integrated with continuous monitoring processes to facilitate ongoing understanding and acceptance of security and privacy risks to organizational operations, organizational assets, individuals, other organizations, and the Nation." }, { "id": "pm-10_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-10", "class": "sp800-53a" } ], "parts": [ { "id": "pm-10_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-10a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-10_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-10a.[01]", "class": "sp800-53a" } ], "prose": "the security state of organizational systems and the environments in which those systems operate are managed through authorization processes;", "links": [ { "href": "#pm-10_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-10_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-10a.[02]", "class": "sp800-53a" } ], "prose": "the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes;", "links": [ { "href": "#pm-10_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-10_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-10_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-10b.", "class": "sp800-53a" } ], "prose": "individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;", "links": [ { "href": "#pm-10_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-10_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-10c.", "class": "sp800-53a" } ], "prose": "the authorization processes are integrated into an organization-wide risk management program.", "links": [ { "href": "#pm-10_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-10_smt", "rel": "assessment-for" } ] }, { "id": "pm-10_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-10-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\nprocedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process\n\nassessment, authorization, and monitoring policy\n\nassessment, authorization, and monitoring procedures\n\nsystem authorization documentation\n\nlists or other documentation about authorization process roles and responsibilities\n\nrisk assessment results relevant to the authorization process and the organization-wide risk management program\n\norganizational risk management strategy\n\nother relevant documents or records" } ] }, { "id": "pm-10_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-10-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy program planning and plan implementation responsibilities\n\norganizational personnel responsible for management of the authorization process\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pm-10_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-10-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for authorization\n\nmechanisms supporting the authorization process" } ] } ] }, { "id": "pm-11", "class": "SP800-53", "title": "Mission and Business Process Definition", "params": [ { "id": "pm-11_odp", "props": [ { "name": "alt-identifier", "value": "pm-11_prm_1" }, { "name": "label", "value": "PM-11_ODP", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to review and revise the mission and business processes is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-11", "class": "zero-padded" }, { "name": "label", "value": "PM-11" }, { "name": "label", "value": "PM-11", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-11" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#e72fde0b-6fc2-497e-a9db-d8fce5a11b8a", "rel": "reference" }, { "href": "#9be5d661-421f-41ad-854e-86f98b811891", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#cp-2", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pm-7", "rel": "related" }, { "href": "#pm-8", "rel": "related" }, { "href": "#ra-2", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#ra-9", "rel": "related" }, { "href": "#sa-2", "rel": "related" } ], "parts": [ { "id": "pm-11_smt", "name": "statement", "parts": [ { "id": "pm-11_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and" }, { "id": "pm-11_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and" }, { "id": "pm-11_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and revise the mission and business processes {{ insert: param, pm-11_odp }}." } ] }, { "id": "pm-11_gdn", "name": "guidance", "prose": "Protection needs are technology-independent capabilities that are required to counter threats to organizations, individuals, systems, and the Nation through the compromise of information (i.e., loss of confidentiality, integrity, availability, or privacy). Information protection and personally identifiable information processing needs are derived from the mission and business needs defined by organizational stakeholders, the mission and business processes designed to meet those needs, and the organizational risk management strategy. Information protection and personally identifiable information processing needs determine the required controls for the organization and the systems. Inherent to defining protection and personally identifiable information processing needs is an understanding of the adverse impact that could result if a compromise or breach of information occurs. The categorization process is used to make such potential impact determinations. Privacy risks to individuals can arise from the compromise of personally identifiable information, but they can also arise as unintended consequences or a byproduct of the processing of personally identifiable information at any stage of the information life cycle. Privacy risk assessments are used to prioritize the risks that are created for individuals from system processing of personally identifiable information. These risk assessments enable the selection of the required privacy controls for the organization and systems. Mission and business process definitions and the associated protection requirements are documented in accordance with organizational policies and procedures." }, { "id": "pm-11_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-11", "class": "sp800-53a" } ], "parts": [ { "id": "pm-11_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-11a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-11_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-11a.[01]", "class": "sp800-53a" } ], "prose": "organizational mission and business processes are defined with consideration for information security;", "links": [ { "href": "#pm-11_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-11_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-11a.[02]", "class": "sp800-53a" } ], "prose": "organizational mission and business processes are defined with consideration for privacy;", "links": [ { "href": "#pm-11_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-11_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-11a.[03]", "class": "sp800-53a" } ], "prose": "organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;", "links": [ { "href": "#pm-11_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-11_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-11_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-11b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-11_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-11b.[01]", "class": "sp800-53a" } ], "prose": "information protection needs arising from the defined mission and business processes are determined;", "links": [ { "href": "#pm-11_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-11_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-11b.[02]", "class": "sp800-53a" } ], "prose": "personally identifiable information processing needs arising from the defined mission and business processes are determined;", "links": [ { "href": "#pm-11_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-11_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-11_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-11c.", "class": "sp800-53a" } ], "prose": "the mission and business processes are reviewed and revised {{ insert: param, pm-11_odp }}.", "links": [ { "href": "#pm-11_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-11_smt", "rel": "assessment-for" } ] }, { "id": "pm-11_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-11-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\nrisk management strategy\n\nprocedures for determining mission and business protection needs\n\ninformation security and privacy risk assessment results relevant to the determination of mission and business protection needs\n\npersonally identifiable information processing policy\n\npersonally identifiable information inventory\n\nother relevant documents or records" } ] }, { "id": "pm-11_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-11-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy program planning and plan implementation responsibilities\n\norganizational personnel responsible for enterprise risk management\n\norganizational personnel responsible for determining information protection needs for mission and business processes\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pm-11_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-11-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for defining mission and business processes and their information protection needs" } ] } ] }, { "id": "pm-13", "class": "SP800-53", "title": "Security and Privacy Workforce", "props": [ { "name": "label", "value": "PM-13", "class": "zero-padded" }, { "name": "label", "value": "PM-13" }, { "name": "label", "value": "PM-13", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-13" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#276bd50a-7e58-48e5-a405-8c8cb91d7a5f", "rel": "reference" }, { "href": "#at-2", "rel": "related" }, { "href": "#at-3", "rel": "related" } ], "parts": [ { "id": "pm-13_smt", "name": "statement", "prose": "Establish a security and privacy workforce development and improvement program." }, { "id": "pm-13_gdn", "name": "guidance", "prose": "Security and privacy workforce development and improvement programs include defining the knowledge, skills, and abilities needed to perform security and privacy duties and tasks; developing role-based training programs for individuals assigned security and privacy roles and responsibilities; and providing standards and guidelines for measuring and building individual qualifications for incumbents and applicants for security- and privacy-related positions. Such workforce development and improvement programs can also include security and privacy career paths to encourage security and privacy professionals to advance in the field and fill positions with greater responsibility. The programs encourage organizations to fill security- and privacy-related positions with qualified personnel. Security and privacy workforce development and improvement programs are complementary to organizational security awareness and training programs and focus on developing and institutionalizing the core security and privacy capabilities of personnel needed to protect organizational operations, assets, and individuals." }, { "id": "pm-13_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-13", "class": "sp800-53a" } ], "parts": [ { "id": "pm-13_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-13[01]", "class": "sp800-53a" } ], "prose": "a security workforce development and improvement program is established;", "links": [ { "href": "#pm-13_smt", "rel": "assessment-for" } ] }, { "id": "pm-13_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-13[02]", "class": "sp800-53a" } ], "prose": "a privacy workforce development and improvement program is established.", "links": [ { "href": "#pm-13_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-13_smt", "rel": "assessment-for" } ] }, { "id": "pm-13_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-13-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\ninformation security and privacy workforce development and improvement program documentation\n\nprocedures for the information security and privacy workforce development and improvement program\n\ninformation security and privacy role-based training program documentation\n\nother relevant documents or records" } ] }, { "id": "pm-13_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-13-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy program planning and plan implementation responsibilities\n\norganizational personnel responsible for the information security and privacy workforce development and improvement program\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pm-13_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-13-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for implementing the information security and privacy workforce development and improvement program\n\nmechanisms supporting and/or implementing the information security and privacy workforce development and improvement program" } ] } ] }, { "id": "pm-14", "class": "SP800-53", "title": "Testing, Training, and Monitoring", "props": [ { "name": "label", "value": "PM-14", "class": "zero-padded" }, { "name": "label", "value": "PM-14" }, { "name": "label", "value": "PM-14", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-14" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#a21aef46-7330-48a0-b2e1-c5bb8b2dd11d", "rel": "reference" }, { "href": "#122177fa-c4ed-485d-8345-3082c0fb9a06", "rel": "reference" }, { "href": "#067223d8-1ec7-45c5-b21b-c848da6de8fb", "rel": "reference" }, { "href": "#at-2", "rel": "related" }, { "href": "#at-3", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#cp-4", "rel": "related" }, { "href": "#ir-3", "rel": "related" }, { "href": "#pm-12", "rel": "related" }, { "href": "#si-4", "rel": "related" } ], "parts": [ { "id": "pm-14_smt", "name": "statement", "parts": [ { "id": "pm-14_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:", "parts": [ { "id": "pm-14_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Are developed and maintained; and" }, { "id": "pm-14_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Continue to be executed; and" } ] }, { "id": "pm-14_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions." } ] }, { "id": "pm-14_gdn", "name": "guidance", "prose": "A process for organization-wide security and privacy testing, training, and monitoring helps ensure that organizations provide oversight for testing, training, and monitoring activities and that those activities are coordinated. With the growing importance of continuous monitoring programs, the implementation of information security and privacy across the three levels of the risk management hierarchy and the widespread use of common controls, organizations coordinate and consolidate the testing and monitoring activities that are routinely conducted as part of ongoing assessments supporting a variety of controls. Security and privacy training activities, while focused on individual systems and specific roles, require coordination across all organizational elements. Testing, training, and monitoring plans and activities are informed by current threat and vulnerability assessments." }, { "id": "pm-14_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14", "class": "sp800-53a" } ], "parts": [ { "id": "pm-14_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-14_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14a.01", "class": "sp800-53a" } ], "parts": [ { "id": "pm-14_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14a.01[01]", "class": "sp800-53a" } ], "prose": "a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed;", "links": [ { "href": "#pm-14_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14a.01[02]", "class": "sp800-53a" } ], "prose": "a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained;", "links": [ { "href": "#pm-14_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.a.1-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14a.01[03]", "class": "sp800-53a" } ], "prose": "a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed;", "links": [ { "href": "#pm-14_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.a.1-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14a.01[04]", "class": "sp800-53a" } ], "prose": "a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained;", "links": [ { "href": "#pm-14_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-14_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14a.02", "class": "sp800-53a" } ], "parts": [ { "id": "pm-14_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14a.02[01]", "class": "sp800-53a" } ], "prose": "a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed;", "links": [ { "href": "#pm-14_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14a.02[02]", "class": "sp800-53a" } ], "prose": "a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed;", "links": [ { "href": "#pm-14_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-14_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-14_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-14_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14b.[01]", "class": "sp800-53a" } ], "prose": "testing plans are reviewed for consistency with the organizational risk management strategy;", "links": [ { "href": "#pm-14_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14b.[02]", "class": "sp800-53a" } ], "prose": "training plans are reviewed for consistency with the organizational risk management strategy;", "links": [ { "href": "#pm-14_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.b-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14b.[03]", "class": "sp800-53a" } ], "prose": "monitoring plans are reviewed for consistency with the organizational risk management strategy;", "links": [ { "href": "#pm-14_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.b-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14b.[04]", "class": "sp800-53a" } ], "prose": "testing plans are reviewed for consistency with organization-wide priorities for risk response actions;", "links": [ { "href": "#pm-14_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.b-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14b.[05]", "class": "sp800-53a" } ], "prose": "training plans are reviewed for consistency with organization-wide priorities for risk response actions;", "links": [ { "href": "#pm-14_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-14_obj.b-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-14b.[06]", "class": "sp800-53a" } ], "prose": "monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.", "links": [ { "href": "#pm-14_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-14_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-14_smt", "rel": "assessment-for" } ] }, { "id": "pm-14_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-14-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\nplans for conducting security and privacy testing, training, and monitoring activities\n\norganizational procedures addressing the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities\n\nrisk management strategy\n\nprocedures for the review of plans for conducting security and privacy testing, training, and monitoring activities for consistency with risk management strategy and risk response priorities\n\nresults of risk assessments associated with conducting security and privacy testing, training, and monitoring activities\n\ndocumentation of the timely execution of plans for conducting security and privacy testing, training, and monitoring activities\n\nother relevant documents or records" } ] }, { "id": "pm-14_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-14-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for developing and maintaining plans for conducting security and privacy testing, training, and monitoring activities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pm-14_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-14-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities\n\nmechanisms supporting the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities" } ] } ] }, { "id": "pm-17", "class": "SP800-53", "title": "Protecting Controlled Unclassified Information on External Systems", "params": [ { "id": "pm-17_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-17_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-17_odp.02" } ], "label": "organization-defined frequency" }, { "id": "pm-17_odp.01", "props": [ { "name": "label", "value": "PM-17_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to review and update the policy is defined;" } ] }, { "id": "pm-17_odp.02", "props": [ { "name": "label", "value": "PM-17_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to review and update the procedures is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-17", "class": "zero-padded" }, { "name": "label", "value": "PM-17" }, { "name": "label", "value": "PM-17", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-17" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#91f992fb-f668-4c91-a50f-0f05b95ccee3", "rel": "reference" }, { "href": "#7dbd6d9f-29d6-4d1d-9766-f2d77ff3c849", "rel": "reference" }, { "href": "#f26af0d0-6d72-4a9d-8ecd-01bc21fd4f0e", "rel": "reference" }, { "href": "#c28ae9a8-1121-42a9-a85e-00cfcc9b9a94", "rel": "reference" }, { "href": "#ca-6", "rel": "related" }, { "href": "#pm-10", "rel": "related" } ], "parts": [ { "id": "pm-17_smt", "name": "statement", "parts": [ { "id": "pm-17_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and" }, { "id": "pm-17_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Review and update the policy and procedures {{ insert: param, pm-17_prm_1 }}." } ] }, { "id": "pm-17_gdn", "name": "guidance", "prose": "Controlled unclassified information is defined by the National Archives and Records Administration along with the safeguarding and dissemination requirements for such information and is codified in [32 CFR 2002](#91f992fb-f668-4c91-a50f-0f05b95ccee3) and, specifically for systems external to the federal organization, [32 CFR 2002.14h](https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/xml/CFR-2017-title32-vol6-part2002.xml) . The policy prescribes the specific use and conditions to be implemented in accordance with organizational procedures, including via its contracting processes." }, { "id": "pm-17_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-17", "class": "sp800-53a" } ], "parts": [ { "id": "pm-17_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-17a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-17_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-17a.[01]", "class": "sp800-53a" } ], "prose": "policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;", "links": [ { "href": "#pm-17_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-17_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-17a.[02]", "class": "sp800-53a" } ], "prose": "procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;", "links": [ { "href": "#pm-17_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-17_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-17_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-17b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-17_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-17b.[01]", "class": "sp800-53a" } ], "prose": "policy is reviewed and updated {{ insert: param, pm-17_odp.01 }};", "links": [ { "href": "#pm-17_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-17_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-17b.[02]", "class": "sp800-53a" } ], "prose": "procedures are reviewed and updated {{ insert: param, pm-17_odp.02 }} ", "links": [ { "href": "#pm-17_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-17_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-17_smt", "rel": "assessment-for" } ] }, { "id": "pm-17_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-17-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Controlled unclassified information policy\n\ncontrolled unclassified information procedures\n\nother relevant documents or records." } ] }, { "id": "pm-17_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-17-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with controlled unclassified information responsibilities\n\norganizational personnel with information security responsibilities." } ] } ] }, { "id": "pm-18", "class": "SP800-53", "title": "Privacy Program Plan", "params": [ { "id": "pm-18_odp", "props": [ { "name": "alt-identifier", "value": "pm-18_prm_1" }, { "name": "label", "value": "PM-18_ODP", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency of updates to the privacy program plan is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-18", "class": "zero-padded" }, { "name": "label", "value": "PM-18" }, { "name": "label", "value": "PM-18", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-18" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#pm-8", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-19", "rel": "related" } ], "parts": [ { "id": "pm-18_smt", "name": "statement", "parts": [ { "id": "pm-18_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:", "parts": [ { "id": "pm-18_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;" }, { "id": "pm-18_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;" }, { "id": "pm-18_smt.a.3", "name": "item", "props": [ { "name": "label", "value": "3." } ], "prose": "Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;" }, { "id": "pm-18_smt.a.4", "name": "item", "props": [ { "name": "label", "value": "4." } ], "prose": "Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;" }, { "id": "pm-18_smt.a.5", "name": "item", "props": [ { "name": "label", "value": "5." } ], "prose": "Reflects coordination among organizational entities responsible for the different aspects of privacy; and" }, { "id": "pm-18_smt.a.6", "name": "item", "props": [ { "name": "label", "value": "6." } ], "prose": "Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and" } ] }, { "id": "pm-18_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Update the plan {{ insert: param, pm-18_odp }} and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments." } ] }, { "id": "pm-18_gdn", "name": "guidance", "prose": "A privacy program plan is a formal document that provides an overview of an organization’s privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the senior agency official for privacy and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks. Privacy program plans can be represented in single documents or compilations of documents.\n\nThe senior agency official for privacy is responsible for designating which privacy controls the organization will treat as program management, common, system-specific, and hybrid controls. Privacy program plans provide sufficient information about the privacy program management and common controls (including the specification of parameters and assignment and selection operations explicitly or by reference) to enable control implementations that are unambiguously compliant with the intent of the plans and a determination of the risk incurred if the plans are implemented as intended.\n\nProgram management controls are generally implemented at the organization level and are essential for managing the organization’s privacy program. Program management controls are distinct from common, system-specific, and hybrid controls because program management controls are independent of any particular information system. Together, the privacy plans for individual systems and the organization-wide privacy program plan provide complete coverage for the privacy controls employed within the organization.\n\nCommon controls are documented in an appendix to the organization’s privacy program plan unless the controls are included in a separate privacy plan for a system. The organization-wide privacy program plan indicates which separate privacy plans contain descriptions of privacy controls." }, { "id": "pm-18_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18", "class": "sp800-53a" } ], "parts": [ { "id": "pm-18_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-18_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.[01]", "class": "sp800-53a" } ], "prose": "an organization-wide privacy program plan that provides an overview of the agency’s privacy program is developed;", "links": [ { "href": "#pm-18_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.01", "class": "sp800-53a" } ], "parts": [ { "id": "pm-18_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.01[01]", "class": "sp800-53a" } ], "prose": "the privacy program plan includes a description of the structure of the privacy program;", "links": [ { "href": "#pm-18_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.01[02]", "class": "sp800-53a" } ], "prose": "the privacy program plan includes a description of the resources dedicated to the privacy program;", "links": [ { "href": "#pm-18_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-18_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.02", "class": "sp800-53a" } ], "parts": [ { "id": "pm-18_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.02[01]", "class": "sp800-53a" } ], "prose": "the privacy program plan provides an overview of the requirements for the privacy program;", "links": [ { "href": "#pm-18_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.02[02]", "class": "sp800-53a" } ], "prose": "the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program;", "links": [ { "href": "#pm-18_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.2-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.02[03]", "class": "sp800-53a" } ], "prose": "the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program;", "links": [ { "href": "#pm-18_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-18_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.03", "class": "sp800-53a" } ], "parts": [ { "id": "pm-18_obj.a.3-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.03[01]", "class": "sp800-53a" } ], "prose": "the privacy program plan includes the role of the senior agency official for privacy;", "links": [ { "href": "#pm-18_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.3-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.03[02]", "class": "sp800-53a" } ], "prose": "the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities;", "links": [ { "href": "#pm-18_smt.a.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-18_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.04", "class": "sp800-53a" } ], "parts": [ { "id": "pm-18_obj.a.4-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.04[01]", "class": "sp800-53a" } ], "prose": "the privacy program plan describes management commitment;", "links": [ { "href": "#pm-18_smt.a.4", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.4-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.04[02]", "class": "sp800-53a" } ], "prose": "the privacy program plan describes compliance;", "links": [ { "href": "#pm-18_smt.a.4", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.4-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.04[03]", "class": "sp800-53a" } ], "prose": "the privacy program plan describes the strategic goals and objectives of the privacy program;", "links": [ { "href": "#pm-18_smt.a.4", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-18_smt.a.4", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.05", "class": "sp800-53a" } ], "prose": "the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy;", "links": [ { "href": "#pm-18_smt.a.5", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a.6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.06", "class": "sp800-53a" } ], "prose": "the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;", "links": [ { "href": "#pm-18_smt.a.6", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18a.[02]", "class": "sp800-53a" } ], "prose": "the privacy program plan is disseminated;", "links": [ { "href": "#pm-18_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-18_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-18_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18b.[01]", "class": "sp800-53a" } ], "prose": "the privacy program plan is updated {{ insert: param, pm-18_odp }};", "links": [ { "href": "#pm-18_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18b.[02]", "class": "sp800-53a" } ], "prose": "the privacy program plan is updated to address changes in federal privacy laws and policies;", "links": [ { "href": "#pm-18_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.b-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18b.[03]", "class": "sp800-53a" } ], "prose": "the privacy program plan is updated to address organizational changes;", "links": [ { "href": "#pm-18_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-18_obj.b-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-18b.[04]", "class": "sp800-53a" } ], "prose": "the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.", "links": [ { "href": "#pm-18_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-18_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-18_smt", "rel": "assessment-for" } ] }, { "id": "pm-18_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-18-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Privacy program plan\n\nprocedures addressing program plan development and implementation\n\nprocedures addressing program plan reviews, updates, and approvals\n\nprocedures addressing coordination of the program plan with relevant entities\n\nrecords of program plan reviews, updates, and approvals\n\nother relevant documents or records" } ] }, { "id": "pm-18_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-18-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program planning and plan implementation responsibilities\n\norganizational personnel with privacy responsibilities" } ] } ] }, { "id": "pm-19", "class": "SP800-53", "title": "Privacy Program Leadership Role", "props": [ { "name": "label", "value": "PM-19", "class": "zero-padded" }, { "name": "label", "value": "PM-19" }, { "name": "label", "value": "PM-19", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-19" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#pm-18", "rel": "related" }, { "href": "#pm-20", "rel": "related" }, { "href": "#pm-23", "rel": "related" }, { "href": "#pm-24", "rel": "related" }, { "href": "#pm-27", "rel": "related" } ], "parts": [ { "id": "pm-19_smt", "name": "statement", "prose": "Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program." }, { "id": "pm-19_gdn", "name": "guidance", "prose": "The privacy officer is an organizational official. For federal agencies—as defined by applicable laws, executive orders, directives, regulations, policies, standards, and guidelines—this official is designated as the senior agency official for privacy. Organizations may also refer to this official as the chief privacy officer. The senior agency official for privacy also has roles on the data management board (see [PM-23](#pm-23) ) and the data integrity board (see [PM-24](#pm-24))." }, { "id": "pm-19_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-19", "class": "sp800-53a" } ], "parts": [ { "id": "pm-19_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-19[01]", "class": "sp800-53a" } ], "prose": "a senior agency official for privacy with authority, mission, accountability, and resources is appointed;", "links": [ { "href": "#pm-19_smt", "rel": "assessment-for" } ] }, { "id": "pm-19_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-19[02]", "class": "sp800-53a" } ], "prose": "the senior agency official for privacy coordinates applicable privacy requirements;", "links": [ { "href": "#pm-19_smt", "rel": "assessment-for" } ] }, { "id": "pm-19_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-19[03]", "class": "sp800-53a" } ], "prose": "the senior agency official for privacy develops applicable privacy requirements;", "links": [ { "href": "#pm-19_smt", "rel": "assessment-for" } ] }, { "id": "pm-19_obj-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-19[04]", "class": "sp800-53a" } ], "prose": "the senior agency official for privacy implements applicable privacy requirements;", "links": [ { "href": "#pm-19_smt", "rel": "assessment-for" } ] }, { "id": "pm-19_obj-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-19[05]", "class": "sp800-53a" } ], "prose": "the senior agency official for privacy manages privacy risks through the organization-wide privacy program.", "links": [ { "href": "#pm-19_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-19_smt", "rel": "assessment-for" } ] }, { "id": "pm-19_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-19-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Privacy program documents, including policies, procedures, plans, and reports\n\npublic privacy notices, including Federal Register notices\n\nprivacy impact assessments\n\nprivacy risk assessments\n\nPrivacy Act statements\n\nsystem of records notices\n\ncomputer matching agreements and notices\n\ncontracts, information sharing agreements, and memoranda of understanding\n\ngoverning requirements, including laws, executive orders, regulations, standards, and guidance\n\nother relevant documents or records" } ] }, { "id": "pm-19_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-19-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program planning and plan implementation responsibilities\n\norganizational personnel with privacy responsibilities\n\nsenior agency official for privacy\n\nprivacy officials" } ] } ] }, { "id": "pm-20", "class": "SP800-53", "title": "Dissemination of Privacy Program Information", "props": [ { "name": "label", "value": "PM-20", "class": "zero-padded" }, { "name": "label", "value": "PM-20" }, { "name": "label", "value": "PM-20", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-20" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#206a3284-6a7e-423c-8ea9-25b22542541d", "rel": "reference" }, { "href": "#ac-3", "rel": "related" }, { "href": "#pm-19", "rel": "related" }, { "href": "#pt-5", "rel": "related" }, { "href": "#pt-6", "rel": "related" }, { "href": "#pt-7", "rel": "related" }, { "href": "#ra-8", "rel": "related" } ], "parts": [ { "id": "pm-20_smt", "name": "statement", "prose": "Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that:", "parts": [ { "id": "pm-20_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy;" }, { "id": "pm-20_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Ensures that organizational privacy practices and reports are publicly available; and" }, { "id": "pm-20_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices." } ] }, { "id": "pm-20_gdn", "name": "guidance", "prose": "For federal agencies, the webpage is located at www.[agency].gov/privacy. Federal agencies include public privacy impact assessments, system of records notices, computer matching notices and agreements, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) exemption and implementation rules, privacy reports, privacy policies, instructions for individuals making an access or amendment request, email addresses for questions/complaints, blogs, and periodic publications." }, { "id": "pm-20_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20", "class": "sp800-53a" } ], "parts": [ { "id": "pm-20_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20[01]", "class": "sp800-53a" } ], "prose": "a central resource webpage is maintained on the organization’s principal public website;", "links": [ { "href": "#pm-20_smt", "rel": "assessment-for" } ] }, { "id": "pm-20_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20[02]", "class": "sp800-53a" } ], "prose": "the webpage serves as a central source of information about the organization’s privacy program;", "links": [ { "href": "#pm-20_smt", "rel": "assessment-for" } ] }, { "id": "pm-20_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-20_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20a.[01]", "class": "sp800-53a" } ], "prose": "the webpage ensures that the public has access to information about organizational privacy activities;", "links": [ { "href": "#pm-20_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-20_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20a.[02]", "class": "sp800-53a" } ], "prose": "the webpage ensures that the public can communicate with its senior agency official for privacy;", "links": [ { "href": "#pm-20_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-20_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-20_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-20_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20b.[01]", "class": "sp800-53a" } ], "prose": "the webpage ensures that organizational privacy practices are publicly available;", "links": [ { "href": "#pm-20_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-20_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20b.[02]", "class": "sp800-53a" } ], "prose": "the webpage ensures that organizational privacy reports are publicly available;", "links": [ { "href": "#pm-20_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-20_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-20_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20c.", "class": "sp800-53a" } ], "prose": "the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.", "links": [ { "href": "#pm-20_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-20_smt", "rel": "assessment-for" } ] }, { "id": "pm-20_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-20-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Public website\n\npublicly posted privacy program documents, including policies, procedures, plans, and reports\n\nposition description of the senior agency official for privacy\n\npublic privacy notices, including Federal Register notices\n\nprivacy impact assessments\n\nprivacy risk assessments\n\nPrivacy Act statements and system of records notices\n\ncomputer matching agreements and notices\n\nother relevant documents or records" } ] }, { "id": "pm-20_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-20-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program information dissemination responsibilities\n\norganizational personnel with privacy responsibilities" } ] }, { "id": "pm-20_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-20-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Location, access, availability, and functionality of privacy resource webpage" } ] } ], "controls": [ { "id": "pm-20.1", "class": "SP800-53-enhancement", "title": "Privacy Policies on Websites, Applications, and Digital Services", "props": [ { "name": "label", "value": "PM-20(01)", "class": "zero-padded" }, { "name": "label", "value": "PM-20(1)" }, { "name": "label", "value": "PM-20(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-20.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#pm-20", "rel": "required" } ], "parts": [ { "id": "pm-20.1_smt", "name": "statement", "prose": "Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:", "parts": [ { "id": "pm-20.1_smt.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Are written in plain language and organized in a way that is easy to understand and navigate;" }, { "id": "pm-20.1_smt.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and" }, { "id": "pm-20.1_smt.c", "name": "item", "props": [ { "name": "label", "value": "(c)" } ], "prose": "Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes." } ] }, { "id": "pm-20.1_gdn", "name": "guidance", "prose": "Organizations post privacy policies on all external-facing websites, mobile applications, and other digital services. Organizations post a link to the relevant privacy policy on any known, major entry points to the website, application, or digital service. In addition, organizations provide a link to the privacy policy on any webpage that collects personally identifiable information. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that require the provision of specific information to the public. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements." }, { "id": "pm-20.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)", "class": "sp800-53a" } ], "parts": [ { "id": "pm-20.1_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)[01]", "class": "sp800-53a" } ], "prose": "privacy policies are developed and posted on all external-facing websites;", "links": [ { "href": "#pm-20.1_smt", "rel": "assessment-for" } ] }, { "id": "pm-20.1_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)[02]", "class": "sp800-53a" } ], "prose": "privacy policies are developed and posted on all mobile applications;", "links": [ { "href": "#pm-20.1_smt", "rel": "assessment-for" } ] }, { "id": "pm-20.1_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)[03]", "class": "sp800-53a" } ], "prose": "privacy policies are developed and posted on all other digital services;", "links": [ { "href": "#pm-20.1_smt", "rel": "assessment-for" } ] }, { "id": "pm-20.1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)(a)", "class": "sp800-53a" } ], "parts": [ { "id": "pm-20.1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)(a)[01]", "class": "sp800-53a" } ], "prose": "the privacy policies are written in plain language;", "links": [ { "href": "#pm-20.1_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-20.1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)(a)[02]", "class": "sp800-53a" } ], "prose": "the privacy policies are organized in a way that is easy to understand and navigate;", "links": [ { "href": "#pm-20.1_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-20.1_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-20.1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)(b)", "class": "sp800-53a" } ], "parts": [ { "id": "pm-20.1_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)(b)[01]", "class": "sp800-53a" } ], "prose": "the privacy policies provide the information needed by the public to make an informed decision about whether to interact with the organization;", "links": [ { "href": "#pm-20.1_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-20.1_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)(b)[02]", "class": "sp800-53a" } ], "prose": "the privacy policies provide the information needed by the public to make an informed decision about how to interact with the organization;", "links": [ { "href": "#pm-20.1_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-20.1_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-20.1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)(c)", "class": "sp800-53a" } ], "parts": [ { "id": "pm-20.1_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)(c)[01]", "class": "sp800-53a" } ], "prose": "the privacy policies are updated whenever the organization makes a substantive change to the practices it describes;", "links": [ { "href": "#pm-20.1_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-20.1_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-20(01)(c)[02]", "class": "sp800-53a" } ], "prose": "the privacy policies include a time/date stamp to inform the public of the date of the most recent changes.", "links": [ { "href": "#pm-20.1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-20.1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-20.1_smt", "rel": "assessment-for" } ] }, { "id": "pm-20.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-20(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Privacy program plan\n\nprivacy policies on the agency website, mobile applications, and/or other digital services" } ] }, { "id": "pm-20.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-20(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program information dissemination responsibilities\n\norganizational personnel with privacy responsibilities" } ] }, { "id": "pm-20.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-20(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing\n\norganizational procedures and practices for disseminating privacy program information\n\nmechanisms supporting the dissemination of privacy program information" } ] } ] } ] }, { "id": "pm-21", "class": "SP800-53", "title": "Accounting of Disclosures", "props": [ { "name": "label", "value": "PM-21", "class": "zero-padded" }, { "name": "label", "value": "PM-21" }, { "name": "label", "value": "PM-21", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-21" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#ac-3", "rel": "related" }, { "href": "#au-2", "rel": "related" }, { "href": "#pt-2", "rel": "related" } ], "parts": [ { "id": "pm-21_smt", "name": "statement", "parts": [ { "id": "pm-21_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:", "parts": [ { "id": "pm-21_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Date, nature, and purpose of each disclosure; and" }, { "id": "pm-21_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Name and address, or other contact information of the individual or organization to which the disclosure was made;" } ] }, { "id": "pm-21_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and" }, { "id": "pm-21_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request." } ] }, { "id": "pm-21_gdn", "name": "guidance", "prose": "The purpose of accounting of disclosures is to allow individuals to learn to whom their personally identifiable information has been disclosed, to provide a basis for subsequently advising recipients of any corrected or disputed personally identifiable information, and to provide an audit trail for subsequent reviews of organizational compliance with conditions for disclosures. For federal agencies, keeping an accounting of disclosures is required by the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) ; agencies should consult with their senior agency official for privacy and legal counsel on this requirement and be aware of the statutory exceptions and OMB guidance relating to the provision.\n\nOrganizations can use any system for keeping notations of disclosures, if it can construct from such a system, a document listing of all disclosures along with the required information. Automated mechanisms can be used by organizations to determine when personally identifiable information is disclosed, including commercial services that provide notifications and alerts. Accounting of disclosures may also be used to help organizations verify compliance with applicable privacy statutes and policies governing the disclosure or dissemination of information and dissemination restrictions." }, { "id": "pm-21_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21", "class": "sp800-53a" } ], "parts": [ { "id": "pm-21_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21a.", "class": "sp800-53a" } ], "prose": "an accurate accounting of disclosures of personally identifiable information is developed and maintained;", "parts": [ { "id": "pm-21_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21a.01", "class": "sp800-53a" } ], "parts": [ { "id": "pm-21_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21a.01[01]", "class": "sp800-53a" } ], "prose": "the accounting includes the date of each disclosure;", "links": [ { "href": "#pm-21_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-21_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21a.01[02]", "class": "sp800-53a" } ], "prose": "the accounting includes the nature of each disclosure;", "links": [ { "href": "#pm-21_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-21_obj.a.1-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21a.01[03]", "class": "sp800-53a" } ], "prose": "the accounting includes the purpose of each disclosure;", "links": [ { "href": "#pm-21_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-21_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-21_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21a.02", "class": "sp800-53a" } ], "parts": [ { "id": "pm-21_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21a.02[01]", "class": "sp800-53a" } ], "prose": "the accounting includes the name of the individual or organization to whom the disclosure was made;", "links": [ { "href": "#pm-21_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-21_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21a.02[02]", "class": "sp800-53a" } ], "prose": "the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made;", "links": [ { "href": "#pm-21_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-21_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-21_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-21_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21b.", "class": "sp800-53a" } ], "prose": "the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer;", "links": [ { "href": "#pm-21_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-21_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-21c.", "class": "sp800-53a" } ], "prose": "the accounting of disclosures is made available to the individual to whom the personally identifiable information relates upon request.", "links": [ { "href": "#pm-21_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-21_smt", "rel": "assessment-for" } ] }, { "id": "pm-21_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-21-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Privacy program plan\n\ndisclosure policies and procedures\n\nrecords of disclosures\n\naudit logs\n\nPrivacy Act policies and procedures\n\nsystem of records notice\n\nPrivacy Act exemption rules." } ] }, { "id": "pm-21_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-21-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program responsibilities\n\norganizational personnel with privacy responsibilities." } ] }, { "id": "pm-21_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-21-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for disclosures\n\nmechanisms supporting the accounting of disclosures, including commercial services that provide notifications and alerts." } ] } ] }, { "id": "pm-22", "class": "SP800-53", "title": "Personally Identifiable Information Quality Management", "props": [ { "name": "label", "value": "PM-22", "class": "zero-padded" }, { "name": "label", "value": "PM-22" }, { "name": "label", "value": "PM-22", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-22" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#227063d4-431e-435f-9e8f-009b6dbc20f4", "rel": "reference" }, { "href": "#c15bfc12-a61e-4ca5-bf35-fa9ce3ccb5d2", "rel": "reference" }, { "href": "#pm-23", "rel": "related" }, { "href": "#si-18", "rel": "related" } ], "parts": [ { "id": "pm-22_smt", "name": "statement", "prose": "Develop and document organization-wide policies and procedures for:", "parts": [ { "id": "pm-22_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;" }, { "id": "pm-22_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Correcting or deleting inaccurate or outdated personally identifiable information;" }, { "id": "pm-22_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and" }, { "id": "pm-22_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Appeals of adverse decisions on correction or deletion requests." } ] }, { "id": "pm-22_gdn", "name": "guidance", "prose": "Personally identifiable information quality management includes steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition of personally identifiable information. Organizational policies and procedures for personally identifiable information quality management are important because inaccurate or outdated personally identifiable information maintained by organizations may cause problems for individuals. Organizations consider the quality of personally identifiable information involved in business functions where inaccurate information may result in adverse decisions or the denial of benefits and services, or the disclosure of the information may cause stigmatization. Correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of organizations maintaining the information. Organizations consider creating policies and procedures for the removal of such information.\n\nThe senior agency official for privacy ensures that practical means and mechanisms exist and are accessible for individuals or their authorized representatives to seek the correction or deletion of personally identifiable information. Processes for correcting or deleting data are clearly defined and publicly available. Organizations use discretion in determining whether data is to be deleted or corrected based on the scope of requests, the changes sought, and the impact of the changes. Additionally, processes include the provision of responses to individuals of decisions to deny requests for correction or deletion. The responses include the reasons for the decisions, a means to record individual objections to the decisions, and a means of requesting reviews of the initial determinations.\n\nOrganizations notify individuals or their designated representatives when their personally identifiable information is corrected or deleted to provide transparency and confirm the completed action. Due to the complexity of data flows and storage, other entities may need to be informed of the correction or deletion. Notice supports the consistent correction and deletion of personally identifiable information across the data ecosystem." }, { "id": "pm-22_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22", "class": "sp800-53a" } ], "parts": [ { "id": "pm-22_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22[01]", "class": "sp800-53a" } ], "prose": "organization-wide policies for personally identifiable information quality management are developed and documented;", "links": [ { "href": "#pm-22_smt", "rel": "assessment-for" } ] }, { "id": "pm-22_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22[02]", "class": "sp800-53a" } ], "prose": "organization-wide procedures for personally identifiable information quality management are developed and documented;", "links": [ { "href": "#pm-22_smt", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-22_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22a.[01]", "class": "sp800-53a" } ], "prose": "the policies address reviewing the accuracy of personally identifiable information across the information life cycle;", "links": [ { "href": "#pm-22_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22a.[02]", "class": "sp800-53a" } ], "prose": "the policies address reviewing the relevance of personally identifiable information across the information life cycle;", "links": [ { "href": "#pm-22_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22a.[03]", "class": "sp800-53a" } ], "prose": "the policies address reviewing the timeliness of personally identifiable information across the information life cycle;", "links": [ { "href": "#pm-22_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22a.[04]", "class": "sp800-53a" } ], "prose": "the policies address reviewing the completeness of personally identifiable information across the information life cycle;", "links": [ { "href": "#pm-22_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22a.[05]", "class": "sp800-53a" } ], "prose": "the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;", "links": [ { "href": "#pm-22_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22a.[06]", "class": "sp800-53a" } ], "prose": "the procedures address reviewing the relevance of personally identifiable information across the information life cycle;", "links": [ { "href": "#pm-22_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22a.[07]", "class": "sp800-53a" } ], "prose": "the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;", "links": [ { "href": "#pm-22_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.a-8", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22a.[08]", "class": "sp800-53a" } ], "prose": "the procedures address reviewing the completeness of personally identifiable information across the information life cycle;", "links": [ { "href": "#pm-22_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-22_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-22_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22b.[01]", "class": "sp800-53a" } ], "prose": "the policies address correcting or deleting inaccurate or outdated personally identifiable information;", "links": [ { "href": "#pm-22_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22b.[02]", "class": "sp800-53a" } ], "prose": "the procedures address correcting or deleting inaccurate or outdated personally identifiable information;", "links": [ { "href": "#pm-22_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-22_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22c.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-22_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22c.[01]", "class": "sp800-53a" } ], "prose": "the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;", "links": [ { "href": "#pm-22_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22c.[02]", "class": "sp800-53a" } ], "prose": "the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;", "links": [ { "href": "#pm-22_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-22_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22d.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-22_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22d.[01]", "class": "sp800-53a" } ], "prose": "the policies address appeals of adverse decisions on correction or deletion requests;", "links": [ { "href": "#pm-22_smt.d", "rel": "assessment-for" } ] }, { "id": "pm-22_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-22d.[02]", "class": "sp800-53a" } ], "prose": "the procedures address appeals of adverse decisions on correction or deletion requests.", "links": [ { "href": "#pm-22_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-22_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-22_smt", "rel": "assessment-for" } ] }, { "id": "pm-22_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-22-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Privacy program plan\n\npolicies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion\n\nrecords of monitoring PII quality management practices\n\ndocumentation of reviews and updates of policies and procedures" } ] }, { "id": "pm-22_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-22-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program information dissemination responsibilities\n\norganizational personnel with privacy responsibilities" } ] }, { "id": "pm-22_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-22-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "[Organizational processes for data quality and personally identifiable information quality management procedures\n\nmechanisms supporting and/or implementing quality management requirements" } ] } ] }, { "id": "pm-24", "class": "SP800-53", "title": "Data Integrity Board", "props": [ { "name": "label", "value": "PM-24", "class": "zero-padded" }, { "name": "label", "value": "PM-24" }, { "name": "label", "value": "PM-24", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-24" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#3671ff20-c17c-44d6-8a88-7de203fa74aa", "rel": "reference" }, { "href": "#ac-4", "rel": "related" }, { "href": "#pm-19", "rel": "related" }, { "href": "#pm-23", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-8", "rel": "related" } ], "parts": [ { "id": "pm-24_smt", "name": "statement", "prose": "Establish a Data Integrity Board to:", "parts": [ { "id": "pm-24_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Review proposals to conduct or participate in a matching program; and" }, { "id": "pm-24_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Conduct an annual review of all matching programs in which the agency has participated." } ] }, { "id": "pm-24_gdn", "name": "guidance", "prose": "A Data Integrity Board is the board of senior officials designated by the head of a federal agency and is responsible for, among other things, reviewing the agency’s proposals to conduct or participate in a matching program and conducting an annual review of all matching programs in which the agency has participated. As a general matter, a matching program is a computerized comparison of records from two or more automated [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) systems of records or an automated system of records and automated records maintained by a non-federal agency (or agent thereof). A matching program either pertains to Federal benefit programs or Federal personnel or payroll records. At a minimum, the Data Integrity Board includes the Inspector General of the agency, if any, and the senior agency official for privacy." }, { "id": "pm-24_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-24", "class": "sp800-53a" } ], "prose": "a Data Integrity Board is established;", "parts": [ { "id": "pm-24_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-24a.", "class": "sp800-53a" } ], "prose": "the Data Integrity Board reviews proposals to conduct or participate in a matching program;", "links": [ { "href": "#pm-24_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-24_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-24b.", "class": "sp800-53a" } ], "prose": "the Data Integrity Board conducts an annual review of all matching programs in which the agency has participated.", "links": [ { "href": "#pm-24_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-24_smt", "rel": "assessment-for" } ] }, { "id": "pm-24_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-24-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Privacy program plan\n\nprivacy program documents relating to the Data Integrity Board, including documents establishing the board, its charter of operations, and any plans and reports\n\ncomputer matching agreements and notices\n\ninformation sharing agreements\n\nmemoranda of understanding\n\nrecords documenting annual reviews\n\ngoverning requirements, including laws, executive orders, regulations, standards, and guidance" } ] }, { "id": "pm-24_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-24-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "members of the Data Integrity Board (e.g., the chief information officer, senior information security officer, senior agency official for privacy, and agency Inspector General)" } ] } ] }, { "id": "pm-25", "class": "SP800-53", "title": "Minimization of Personally Identifiable Information Used in Testing, Training, and Research", "params": [ { "id": "pm-25_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-25_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-25_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-25_odp.03" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-25_odp.04" } ], "label": "organization-defined frequency" }, { "id": "pm-25_odp.01", "props": [ { "name": "label", "value": "PM-25_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research is defined;" } ] }, { "id": "pm-25_odp.02", "props": [ { "name": "label", "value": "PM-25_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research is defined;" } ] }, { "id": "pm-25_odp.03", "props": [ { "name": "label", "value": "PM-25_ODP[03]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research is defined;" } ] }, { "id": "pm-25_odp.04", "props": [ { "name": "label", "value": "PM-25_ODP[04]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-25", "class": "zero-padded" }, { "name": "label", "value": "PM-25" }, { "name": "label", "value": "PM-25", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-25" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#pm-23", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#sa-3", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "pm-25_smt", "name": "statement", "parts": [ { "id": "pm-25_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;" }, { "id": "pm-25_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;" }, { "id": "pm-25_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and" }, { "id": "pm-25_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Review and update policies and procedures {{ insert: param, pm-25_prm_1 }}." } ] }, { "id": "pm-25_gdn", "name": "guidance", "prose": "The use of personally identifiable information in testing, research, and training increases the risk of unauthorized disclosure or misuse of such information. Organizations consult with the senior agency official for privacy and/or legal counsel to ensure that the use of personally identifiable information in testing, training, and research is compatible with the original purpose for which it was collected. When possible, organizations use placeholder data to avoid exposure of personally identifiable information when conducting testing, training, and research." }, { "id": "pm-25_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25", "class": "sp800-53a" } ], "parts": [ { "id": "pm-25_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-25_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[01]", "class": "sp800-53a" } ], "prose": "policies that address the use of personally identifiable information for internal testing are developed and documented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[02]", "class": "sp800-53a" } ], "prose": "policies that address the use of personally identifiable information for internal training are developed and documented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[03]", "class": "sp800-53a" } ], "prose": "policies that address the use of personally identifiable information for internal research are developed and documented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[04]", "class": "sp800-53a" } ], "prose": "procedures that address the use of personally identifiable information for internal testing are developed and documented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[05]", "class": "sp800-53a" } ], "prose": "procedures that address the use of personally identifiable information for internal training are developed and documented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[06]", "class": "sp800-53a" } ], "prose": "procedures that address the use of personally identifiable information for internal research are developed and documented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[07]", "class": "sp800-53a" } ], "prose": "policies that address the use of personally identifiable information for internal testing, are implemented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-8", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[08]", "class": "sp800-53a" } ], "prose": "policies that address the use of personally identifiable information for training are implemented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-9", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[09]", "class": "sp800-53a" } ], "prose": "policies that address the use of personally identifiable information for research are implemented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-10", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[10]", "class": "sp800-53a" } ], "prose": "procedures that address the use of personally identifiable information for internal testing are implemented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-11", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[11]", "class": "sp800-53a" } ], "prose": "procedures that address the use of personally identifiable information for training are implemented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.a-12", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25a.[12]", "class": "sp800-53a" } ], "prose": "procedures that address the use of personally identifiable information for research are implemented;", "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-25_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-25_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25b.[01]", "class": "sp800-53a" } ], "prose": "the amount of personally identifiable information used for internal testing purposes is limited or minimized;", "links": [ { "href": "#pm-25_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25b.[02]", "class": "sp800-53a" } ], "prose": "the amount of personally identifiable information used for internal training purposes is limited or minimized;", "links": [ { "href": "#pm-25_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.b-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25b.[03]", "class": "sp800-53a" } ], "prose": "the amount of personally identifiable information used for internal research purposes is limited or minimized;", "links": [ { "href": "#pm-25_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-25_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25c.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-25_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25c.[01]", "class": "sp800-53a" } ], "prose": "the required use of personally identifiable information for internal testing is authorized;", "links": [ { "href": "#pm-25_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25c.[02]", "class": "sp800-53a" } ], "prose": "the required use of personally identifiable information for internal training is authorized;", "links": [ { "href": "#pm-25_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.c-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25c.[03]", "class": "sp800-53a" } ], "prose": "the required use of personally identifiable information for internal research is authorized;", "links": [ { "href": "#pm-25_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-25_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25d.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-25_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25d.[01]", "class": "sp800-53a" } ], "prose": "policies are reviewed {{ insert: param, pm-25_odp.01 }};", "links": [ { "href": "#pm-25_smt.d", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25d.[02]", "class": "sp800-53a" } ], "prose": "policies are updated {{ insert: param, pm-25_odp.02 }};", "links": [ { "href": "#pm-25_smt.d", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.d-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25d.[03]", "class": "sp800-53a" } ], "prose": "procedures are reviewed {{ insert: param, pm-25_odp.03 }};", "links": [ { "href": "#pm-25_smt.d", "rel": "assessment-for" } ] }, { "id": "pm-25_obj.d-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-25d.[04]", "class": "sp800-53a" } ], "prose": "procedures are updated {{ insert: param, pm-25_odp.04 }}.", "links": [ { "href": "#pm-25_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-25_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-25_smt", "rel": "assessment-for" } ] }, { "id": "pm-25_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-25-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Privacy program plan\n\npolicies and procedures for the minimization of personally identifiable information used in testing, training, and research\n\ndocumentation supporting policy implementation (e.g., templates for testing, training, and research\n\nprivacy threshold analysis\n\nprivacy risk assessment)\n\ndata sets used for testing, training, and research" } ] }, { "id": "pm-25_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-25-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program responsibilities\n\norganizational personnel with privacy responsibilities\n\nsystem developers\n\npersonnel with IRB responsibilities" } ] }, { "id": "pm-25_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-25-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for data quality and personally identifiable information management\n\nmechanisms supporting data quality management and personally identifiable information management to minimize the use of personally identifiable information" } ] } ] }, { "id": "pm-26", "class": "SP800-53", "title": "Complaint Management", "params": [ { "id": "pm-26_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-26_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-26_odp.02" } ], "label": "organization-defined time period" }, { "id": "pm-26_odp.01", "props": [ { "name": "label", "value": "PM-26_ODP[01]", "class": "sp800-53a" } ], "label": "time period", "guidelines": [ { "prose": "the time period in which complaints (including concerns or questions) from individuals are to be reviewed is defined;" } ] }, { "id": "pm-26_odp.02", "props": [ { "name": "label", "value": "PM-26_ODP[02]", "class": "sp800-53a" } ], "label": "time period", "guidelines": [ { "prose": "the time period in which complaints (including concerns or questions) from individuals are to be addressed is defined;" } ] }, { "id": "pm-26_odp.03", "props": [ { "name": "alt-identifier", "value": "pm-26_prm_2" }, { "name": "label", "value": "PM-26_ODP[03]", "class": "sp800-53a" } ], "label": "time period", "guidelines": [ { "prose": "the time period for acknowledging the receipt of complaints is defined;" } ] }, { "id": "pm-26_odp.04", "props": [ { "name": "alt-identifier", "value": "pm-26_prm_3" }, { "name": "label", "value": "PM-26_ODP[04]", "class": "sp800-53a" } ], "label": "time period", "guidelines": [ { "prose": "the time period for responding to complaints is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-26", "class": "zero-padded" }, { "name": "label", "value": "PM-26" }, { "name": "label", "value": "PM-26", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-26" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#ir-7", "rel": "related" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pm-22", "rel": "related" }, { "href": "#si-18", "rel": "related" } ], "parts": [ { "id": "pm-26_smt", "name": "statement", "prose": "Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes:", "parts": [ { "id": "pm-26_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Mechanisms that are easy to use and readily accessible by the public;" }, { "id": "pm-26_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "All information necessary for successfully filing complaints;" }, { "id": "pm-26_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Tracking mechanisms to ensure all complaints received are reviewed and addressed within {{ insert: param, pm-26_prm_1 }};" }, { "id": "pm-26_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Acknowledgement of receipt of complaints, concerns, or questions from individuals within {{ insert: param, pm-26_odp.03 }} ; and" }, { "id": "pm-26_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Response to complaints, concerns, or questions from individuals within {{ insert: param, pm-26_odp.04 }}." } ] }, { "id": "pm-26_gdn", "name": "guidance", "prose": "Complaints, concerns, and questions from individuals can serve as valuable sources of input to organizations and ultimately improve operational models, uses of technology, data collection practices, and controls. Mechanisms that can be used by the public include telephone hotline, email, or web-based forms. The information necessary for successfully filing complaints includes contact information for the senior agency official for privacy or other official designated to receive complaints. Privacy complaints may also include personally identifiable information which is handled in accordance with relevant policies and processes." }, { "id": "pm-26_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26", "class": "sp800-53a" } ], "parts": [ { "id": "pm-26_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26[01]", "class": "sp800-53a" } ], "prose": "a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;", "links": [ { "href": "#pm-26_smt", "rel": "assessment-for" } ] }, { "id": "pm-26_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26[02]", "class": "sp800-53a" } ], "prose": "a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;", "links": [ { "href": "#pm-26_smt", "rel": "assessment-for" } ] }, { "id": "pm-26_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-26_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26a.[01]", "class": "sp800-53a" } ], "prose": "the complaint management process includes mechanisms that are easy to use by the public;", "links": [ { "href": "#pm-26_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-26_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26a.[02]", "class": "sp800-53a" } ], "prose": "the complaint management process includes mechanisms that are readily accessible by the public;", "links": [ { "href": "#pm-26_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-26_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-26_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26b.", "class": "sp800-53a" } ], "prose": "the complaint management process includes all information necessary for successfully filing complaints;", "links": [ { "href": "#pm-26_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-26_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26c.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-26_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26c.[01]", "class": "sp800-53a" } ], "prose": "the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within {{ insert: param, pm-26_odp.01 }};", "links": [ { "href": "#pm-26_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-26_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26c.[02]", "class": "sp800-53a" } ], "prose": "the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within {{ insert: param, pm-26_odp.02 }};", "links": [ { "href": "#pm-26_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-26_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-26_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26d.", "class": "sp800-53a" } ], "prose": "the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within {{ insert: param, pm-26_odp.03 }};", "links": [ { "href": "#pm-26_smt.d", "rel": "assessment-for" } ] }, { "id": "pm-26_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-26e.", "class": "sp800-53a" } ], "prose": "the complaint management process includes responding to complaints, concerns, or questions from individuals within {{ insert: param, pm-26_odp.04 }}.", "links": [ { "href": "#pm-26_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-26_smt", "rel": "assessment-for" } ] }, { "id": "pm-26_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-26-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Privacy program plan\n\nprocedures addressing complaint management\n\ncomplaint documentation\n\nprocedures addressing the reviews of complaints\n\nother relevant documents or records" } ] }, { "id": "pm-26_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-26-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program responsibilities\n\norganizational personnel with privacy responsibilities" } ] }, { "id": "pm-26_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-26-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for complaint management\n\nmechanisms supporting complaint management\n\ntools used by the public to submit complaints, concerns, and questions (e.g., telephone, hotline, email, or web-based forms" } ] } ] }, { "id": "pm-27", "class": "SP800-53", "title": "Privacy Reporting", "params": [ { "id": "pm-27_odp.01", "props": [ { "name": "alt-identifier", "value": "pm-27_prm_1" }, { "name": "label", "value": "PM-27_ODP[01]", "class": "sp800-53a" } ], "label": "privacy reports", "guidelines": [ { "prose": "privacy reports are defined;" } ] }, { "id": "pm-27_odp.02", "props": [ { "name": "alt-identifier", "value": "pm-27_prm_2" }, { "name": "label", "value": "PM-27_ODP[02]", "class": "sp800-53a" } ], "label": "oversight bodies", "guidelines": [ { "prose": "privacy oversight bodies are defined;" } ] }, { "id": "pm-27_odp.03", "props": [ { "name": "alt-identifier", "value": "pm-27_prm_3" }, { "name": "label", "value": "PM-27_ODP[03]", "class": "sp800-53a" } ], "label": "officials", "guidelines": [ { "prose": "officials responsible for monitoring privacy program compliance are defined;" } ] }, { "id": "pm-27_odp.04", "props": [ { "name": "alt-identifier", "value": "pm-27_prm_4" }, { "name": "label", "value": "PM-27_ODP[04]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency for reviewing and updating privacy reports is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-27", "class": "zero-padded" }, { "name": "label", "value": "PM-27" }, { "name": "label", "value": "PM-27", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-27" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#0c67b2a9-bede-43d2-b86d-5f35b8be36e9", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#3671ff20-c17c-44d6-8a88-7de203fa74aa", "rel": "reference" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pm-19", "rel": "related" } ], "parts": [ { "id": "pm-27_smt", "name": "statement", "parts": [ { "id": "pm-27_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop {{ insert: param, pm-27_odp.01 }} and disseminate to:", "parts": [ { "id": "pm-27_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, pm-27_odp.02 }} to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and" }, { "id": "pm-27_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": " {{ insert: param, pm-27_odp.03 }} and other personnel with responsibility for monitoring privacy program compliance; and" } ] }, { "id": "pm-27_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Review and update privacy reports {{ insert: param, pm-27_odp.04 }}." } ] }, { "id": "pm-27_gdn", "name": "guidance", "prose": "Through internal and external reporting, organizations promote accountability and transparency in organizational privacy operations. Reporting can also help organizations to determine progress in meeting privacy compliance requirements and privacy controls, compare performance across the federal government, discover vulnerabilities, identify gaps in policy and implementation, and identify models for success. For federal agencies, privacy reports include annual senior agency official for privacy reports to OMB, reports to Congress required by Implementing Regulations of the 9/11 Commission Act, and other public reports required by law, regulation, or policy, including internal policies of organizations. The senior agency official for privacy consults with legal counsel, where appropriate, to ensure that organizations meet all applicable privacy reporting requirements." }, { "id": "pm-27_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-27", "class": "sp800-53a" } ], "parts": [ { "id": "pm-27_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-27a.", "class": "sp800-53a" } ], "prose": " {{ insert: param, pm-27_odp.01 }} are developed;", "parts": [ { "id": "pm-27_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-27a.01", "class": "sp800-53a" } ], "prose": "the privacy reports are disseminated to {{ insert: param, pm-27_odp.02 }} to demonstrate accountability with statutory, regulatory, and policy privacy mandates;", "links": [ { "href": "#pm-27_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-27_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-27a.02", "class": "sp800-53a" } ], "parts": [ { "id": "pm-27_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-27a.02[01]", "class": "sp800-53a" } ], "prose": "the privacy reports are disseminated to {{ insert: param, pm-27_odp.03 }};", "links": [ { "href": "#pm-27_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-27_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-27a.02[02]", "class": "sp800-53a" } ], "prose": "the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance;", "links": [ { "href": "#pm-27_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-27_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-27_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-27_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-27b.", "class": "sp800-53a" } ], "prose": "the privacy reports are reviewed and updated {{ insert: param, pm-27_odp.04 }}.", "links": [ { "href": "#pm-27_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-27_smt", "rel": "assessment-for" } ] }, { "id": "pm-27_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-27-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Privacy program plan\n\ninternal and external privacy reports\n\nprivacy program plan\n\nannual senior agency official for privacy reports to OMB\n\nreports to Congress required by law, regulation, or policy, including internal policies\n\nrecords documenting the dissemination of reports to oversight bodies and officials responsible for monitoring privacy program compliance\n\nrecords of review and updates of privacy reports." } ] }, { "id": "pm-27_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-27-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with privacy program responsibilities\n\norganizational personnel with privacy responsibilities\n\nlegal counsel." } ] } ] }, { "id": "pm-28", "class": "SP800-53", "title": "Risk Framing", "params": [ { "id": "pm-28_odp.01", "props": [ { "name": "alt-identifier", "value": "pm-28_prm_1" }, { "name": "label", "value": "PM-28_ODP[01]", "class": "sp800-53a" } ], "label": "personnel", "guidelines": [ { "prose": "the personnel to receive the results of risk framing activities is/are defined;" } ] }, { "id": "pm-28_odp.02", "props": [ { "name": "alt-identifier", "value": "pm-28_prm_2" }, { "name": "label", "value": "PM-28_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency for reviewing and updating risk framing considerations is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-28", "class": "zero-padded" }, { "name": "label", "value": "PM-28" }, { "name": "label", "value": "PM-28", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-28" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#ca-7", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#ra-7", "rel": "related" } ], "parts": [ { "id": "pm-28_smt", "name": "statement", "parts": [ { "id": "pm-28_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Identify and document:", "parts": [ { "id": "pm-28_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Assumptions affecting risk assessments, risk responses, and risk monitoring;" }, { "id": "pm-28_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Constraints affecting risk assessments, risk responses, and risk monitoring;" }, { "id": "pm-28_smt.a.3", "name": "item", "props": [ { "name": "label", "value": "3." } ], "prose": "Priorities and trade-offs considered by the organization for managing risk; and" }, { "id": "pm-28_smt.a.4", "name": "item", "props": [ { "name": "label", "value": "4." } ], "prose": "Organizational risk tolerance;" } ] }, { "id": "pm-28_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Distribute the results of risk framing activities to {{ insert: param, pm-28_odp.01 }} ; and" }, { "id": "pm-28_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update risk framing considerations {{ insert: param, pm-28_odp.02 }}." } ] }, { "id": "pm-28_gdn", "name": "guidance", "prose": "Risk framing is most effective when conducted at the organization level and in consultation with stakeholders throughout the organization including mission, business, and system owners. The assumptions, constraints, risk tolerance, priorities, and trade-offs identified as part of the risk framing process inform the risk management strategy, which in turn informs the conduct of risk assessment, risk response, and risk monitoring activities. Risk framing results are shared with organizational personnel, including mission and business owners, information owners or stewards, system owners, authorizing officials, senior agency information security officer, senior agency official for privacy, and senior accountable official for risk management." }, { "id": "pm-28_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28", "class": "sp800-53a" } ], "parts": [ { "id": "pm-28_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-28_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.01", "class": "sp800-53a" } ], "parts": [ { "id": "pm-28_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.01[01]", "class": "sp800-53a" } ], "prose": "assumptions affecting risk assessments are identified and documented;", "links": [ { "href": "#pm-28_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.01[02]", "class": "sp800-53a" } ], "prose": "assumptions affecting risk responses are identified and documented;", "links": [ { "href": "#pm-28_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.a.1-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.01[03]", "class": "sp800-53a" } ], "prose": "assumptions affecting risk monitoring are identified and documented;", "links": [ { "href": "#pm-28_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-28_smt.a.1", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.02", "class": "sp800-53a" } ], "parts": [ { "id": "pm-28_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.02[01]", "class": "sp800-53a" } ], "prose": "constraints affecting risk assessments are identified and documented;", "links": [ { "href": "#pm-28_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.02[02]", "class": "sp800-53a" } ], "prose": "constraints affecting risk responses are identified and documented;", "links": [ { "href": "#pm-28_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.a.2-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.02[03]", "class": "sp800-53a" } ], "prose": "constraints affecting risk monitoring are identified and documented;", "links": [ { "href": "#pm-28_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-28_smt.a.2", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.a.3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.03", "class": "sp800-53a" } ], "parts": [ { "id": "pm-28_obj.a.3-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.03[01]", "class": "sp800-53a" } ], "prose": "priorities considered by the organization for managing risk are identified and documented;", "links": [ { "href": "#pm-28_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.a.3-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.03[02]", "class": "sp800-53a" } ], "prose": "trade-offs considered by the organization for managing risk are identified and documented;", "links": [ { "href": "#pm-28_smt.a.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-28_smt.a.3", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.a.4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28a.04", "class": "sp800-53a" } ], "prose": "organizational risk tolerance is identified and documented;", "links": [ { "href": "#pm-28_smt.a.4", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-28_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28b.", "class": "sp800-53a" } ], "prose": "the results of risk framing activities are distributed to {{ insert: param, pm-28_odp.01 }};", "links": [ { "href": "#pm-28_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-28_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-28c.", "class": "sp800-53a" } ], "prose": "risk framing considerations are reviewed and updated {{ insert: param, pm-28_odp.02 }}.", "links": [ { "href": "#pm-28_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-28_smt", "rel": "assessment-for" } ] }, { "id": "pm-28_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-28-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\nsupply chain risk management strategy\n\ndocumentation of risk framing activities\n\npolicies and procedures for risk framing activities\n\nrisk management strategy" } ] }, { "id": "pm-28_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-28-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel (including mission, business, and system owners or stewards\n\nauthorizing officials\n\nsenior agency information security officer\n\nsenior agency official for privacy\n\nand senior accountable official for risk management)" } ] }, { "id": "pm-28_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-28-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing\n\norganizational processes for risk framing\n\nmechanisms supporting the development, review, update, and approval of risk framing" } ] } ] }, { "id": "pm-31", "class": "SP800-53", "title": "Continuous Monitoring Strategy", "params": [ { "id": "pm-31_prm_4", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-31_odp.04" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-31_odp.05" } ], "label": "organization-defined personnel or roles" }, { "id": "pm-31_prm_5", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-31_odp.06" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pm-31_odp.07" } ], "label": "organization-defined frequency" }, { "id": "pm-31_odp.01", "props": [ { "name": "alt-identifier", "value": "pm-31_prm_1" }, { "name": "label", "value": "PM-31_ODP[01]", "class": "sp800-53a" } ], "label": "metrics", "guidelines": [ { "prose": "the metrics for organization-wide continuous monitoring are defined;" } ] }, { "id": "pm-31_odp.02", "props": [ { "name": "alt-identifier", "value": "pm-31_prm_2" }, { "name": "alt-label", "value": "frequencies", "class": "sp800-53" }, { "name": "label", "value": "PM-31_ODP[02]", "class": "sp800-53a" } ], "label": "monitoring frequencies", "guidelines": [ { "prose": "the frequencies for monitoring are defined;" } ] }, { "id": "pm-31_odp.03", "props": [ { "name": "alt-identifier", "value": "pm-31_prm_3" }, { "name": "alt-label", "value": "frequencies", "class": "sp800-53" }, { "name": "label", "value": "PM-31_ODP[03]", "class": "sp800-53a" } ], "label": "assessment frequencies", "guidelines": [ { "prose": "the frequencies for assessing control effectiveness are defined;" } ] }, { "id": "pm-31_odp.04", "props": [ { "name": "label", "value": "PM-31_ODP[04]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "the personnel or roles for reporting the security status of organizational systems to is/are defined;" } ] }, { "id": "pm-31_odp.05", "props": [ { "name": "label", "value": "PM-31_ODP[05]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "the personnel or roles for reporting the privacy status of organizational systems to is/are defined;" } ] }, { "id": "pm-31_odp.06", "props": [ { "name": "label", "value": "PM-31_ODP[06]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to report the security status of organizational systems is defined;" } ] }, { "id": "pm-31_odp.07", "props": [ { "name": "label", "value": "PM-31_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to report the privacy status of organizational systems is defined;" } ] } ], "props": [ { "name": "label", "value": "PM-31", "class": "zero-padded" }, { "name": "label", "value": "PM-31" }, { "name": "label", "value": "PM-31", "class": "sp800-53a" }, { "name": "sort-id", "value": "pm-31" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#067223d8-1ec7-45c5-b21b-c848da6de8fb", "rel": "reference" }, { "href": "#62ea77ca-e450-4323-b210-e0d75390e785", "rel": "reference" }, { "href": "#ac-2", "rel": "related" }, { "href": "#ac-6", "rel": "related" }, { "href": "#ac-17", "rel": "related" }, { "href": "#at-4", "rel": "related" }, { "href": "#au-6", "rel": "related" }, { "href": "#au-13", "rel": "related" }, { "href": "#ca-2", "rel": "related" }, { "href": "#ca-5", "rel": "related" }, { "href": "#ca-6", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#cm-3", "rel": "related" }, { "href": "#cm-4", "rel": "related" }, { "href": "#cm-6", "rel": "related" }, { "href": "#cm-11", "rel": "related" }, { "href": "#ia-5", "rel": "related" }, { "href": "#ir-5", "rel": "related" }, { "href": "#ma-2", "rel": "related" }, { "href": "#ma-3", "rel": "related" }, { "href": "#ma-4", "rel": "related" }, { "href": "#pe-3", "rel": "related" }, { "href": "#pe-6", "rel": "related" }, { "href": "#pe-14", "rel": "related" }, { "href": "#pe-16", "rel": "related" }, { "href": "#pe-20", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pm-4", "rel": "related" }, { "href": "#pm-6", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-10", "rel": "related" }, { "href": "#pm-12", "rel": "related" }, { "href": "#pm-14", "rel": "related" }, { "href": "#pm-23", "rel": "related" }, { "href": "#pm-28", "rel": "related" }, { "href": "#ps-7", "rel": "related" }, { "href": "#pt-7", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#ra-5", "rel": "related" }, { "href": "#ra-7", "rel": "related" }, { "href": "#sa-9", "rel": "related" }, { "href": "#sa-11", "rel": "related" }, { "href": "#sc-5", "rel": "related" }, { "href": "#sc-7", "rel": "related" }, { "href": "#sc-18", "rel": "related" }, { "href": "#sc-38", "rel": "related" }, { "href": "#sc-43", "rel": "related" }, { "href": "#si-3", "rel": "related" }, { "href": "#si-4", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#sr-2", "rel": "related" }, { "href": "#sr-4", "rel": "related" } ], "parts": [ { "id": "pm-31_smt", "name": "statement", "prose": "Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include:", "parts": [ { "id": "pm-31_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Establishing the following organization-wide metrics to be monitored: {{ insert: param, pm-31_odp.01 }};" }, { "id": "pm-31_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Establishing {{ insert: param, pm-31_odp.02 }} and {{ insert: param, pm-31_odp.03 }} for control effectiveness;" }, { "id": "pm-31_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy;" }, { "id": "pm-31_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Correlation and analysis of information generated by control assessments and monitoring;" }, { "id": "pm-31_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Response actions to address results of the analysis of control assessment and monitoring information; and" }, { "id": "pm-31_smt.f", "name": "item", "props": [ { "name": "label", "value": "f." } ], "prose": "Reporting the security and privacy status of organizational systems to {{ insert: param, pm-31_prm_4 }} {{ insert: param, pm-31_prm_5 }}." } ] }, { "id": "pm-31_gdn", "name": "guidance", "prose": "Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms \"continuous\" and \"ongoing\" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions. To further facilitate security and privacy risk management, organizations consider aligning organization-defined monitoring metrics with organizational risk tolerance as defined in the risk management strategy. Monitoring requirements, including the need for monitoring, may be referenced in other controls and control enhancements such as, [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-2(7)(b)](#ac-2.7_smt.b), [AC-2(7)(c)](#ac-2.7_smt.c), [AC-17(1)](#ac-17.1), [AT-4a](#at-4_smt.a), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CA-7](#ca-7), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [CM-11c](#cm-11_smt.c), [IR-5](#ir-5), [MA-2b](#ma-2_smt.b), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [PE-3d](#pe-3_smt.d), [PE-6](#pe-6), [PE-14b](#pe-14_smt.b), [PE-16](#pe-16), [PE-20](#pe-20), [PM-6](#pm-6), [PM-23](#pm-23), [PS-7e](#ps-7_smt.e), [SA-9c](#sa-9_smt.c), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b), [SI-4](#si-4)." }, { "id": "pm-31_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31", "class": "sp800-53a" } ], "prose": "an organization-wide continuous monitoring strategy is developed;", "parts": [ { "id": "pm-31_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31a.", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that include establishing {{ insert: param, pm-31_odp.01 }} to be monitored;", "links": [ { "href": "#pm-31_smt.a", "rel": "assessment-for" } ] }, { "id": "pm-31_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31b.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-31_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31b.[01]", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that establish {{ insert: param, pm-31_odp.02 }} for monitoring;", "links": [ { "href": "#pm-31_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-31_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31b.[02]", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that establish {{ insert: param, pm-31_odp.03 }} for assessment of control effectiveness;", "links": [ { "href": "#pm-31_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-31_smt.b", "rel": "assessment-for" } ] }, { "id": "pm-31_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31c.", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that include monitoring {{ insert: param, pm-31_odp.01 }} on an ongoing basis in accordance with the continuous monitoring strategy;", "links": [ { "href": "#pm-31_smt.c", "rel": "assessment-for" } ] }, { "id": "pm-31_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31d.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-31_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31d.[01]", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;", "links": [ { "href": "#pm-31_smt.d", "rel": "assessment-for" } ] }, { "id": "pm-31_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31d.[02]", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;", "links": [ { "href": "#pm-31_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-31_smt.d", "rel": "assessment-for" } ] }, { "id": "pm-31_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31e.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-31_obj.e-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31e.[01]", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;", "links": [ { "href": "#pm-31_smt.e", "rel": "assessment-for" } ] }, { "id": "pm-31_obj.e-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31e.[02]", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;", "links": [ { "href": "#pm-31_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-31_smt.e", "rel": "assessment-for" } ] }, { "id": "pm-31_obj.f", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31f.", "class": "sp800-53a" } ], "parts": [ { "id": "pm-31_obj.f-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31f.[01]", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that include reporting the security status of organizational systems to {{ insert: param, pm-31_odp.04 }} {{ insert: param, pm-31_odp.06 }};", "links": [ { "href": "#pm-31_smt.f", "rel": "assessment-for" } ] }, { "id": "pm-31_obj.f-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PM-31f.[02]", "class": "sp800-53a" } ], "prose": "continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to {{ insert: param, pm-31_odp.05 }} {{ insert: param, pm-31_odp.07 }}.", "links": [ { "href": "#pm-31_smt.f", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-31_smt.f", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pm-31_smt", "rel": "assessment-for" } ] }, { "id": "pm-31_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PM-31-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Information security program plan\n\nprivacy program plan\n\nsupply chain risk management plan\n\ncontinuous monitoring strategy\n\nrisk management strategy\n\ninformation security continuous monitoring program documentation, reporting, metrics, and artifacts\n\ninformation security continuous monitoring program assessment documentation, reporting, metrics, and artifacts\n\nassessment and authorization policy\n\nprocedures addressing the continuous monitoring of controls\n\nprivacy program continuous monitoring documentation, reporting, metrics, and artifacts\n\ncontinuous monitoring program records, security, and privacy impact analyses\n\nstatus reports\n\nrisk response documentation\n\nother relevant documents or records." } ] }, { "id": "pm-31_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PM-31-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Senior Accountable Official for Risk Management\n\nchief information officer\n\nsenior agency information security officer\n\nsenior agency official for privacy\n\norganizational personnel with information security, privacy, and supply chain risk management program responsibilities" } ] }, { "id": "pm-31_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PM-31-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational procedures and mechanisms used for information security, privacy, and supply chain continuous monitoring" } ] } ] } ] }, { "id": "ps", "class": "family", "title": "Personnel Security", "props": [ { "name": "label", "value": "PS" } ], "controls": [ { "id": "ps-6", "class": "SP800-53", "title": "Access Agreements", "params": [ { "id": "ps-06_odp.01", "props": [ { "name": "alt-identifier", "value": "ps-6_prm_1" }, { "name": "label", "value": "PS-06_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to review and update access agreements is defined;" } ] }, { "id": "ps-06_odp.02", "props": [ { "name": "alt-identifier", "value": "ps-6_prm_2" }, { "name": "label", "value": "PS-06_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to re-sign access agreements to maintain access to organizational information is defined;" } ] } ], "props": [ { "name": "label", "value": "PS-06", "class": "zero-padded" }, { "name": "label", "value": "PS-6" }, { "name": "label", "value": "PS-06", "class": "sp800-53a" }, { "name": "sort-id", "value": "ps-06" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#ac-17", "rel": "related" }, { "href": "#pe-2", "rel": "related" }, { "href": "#pl-4", "rel": "related" }, { "href": "#ps-2", "rel": "related" }, { "href": "#ps-3", "rel": "related" }, { "href": "#ps-6", "rel": "related" }, { "href": "#ps-7", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#sa-21", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "ps-6_smt", "name": "statement", "parts": [ { "id": "ps-6_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop and document access agreements for organizational systems;" }, { "id": "ps-6_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Review and update the access agreements {{ insert: param, ps-06_odp.01 }} ; and" }, { "id": "ps-6_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Verify that individuals requiring access to organizational information and systems:", "parts": [ { "id": "ps-6_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Sign appropriate access agreements prior to being granted access; and" }, { "id": "ps-6_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or {{ insert: param, ps-06_odp.02 }}." } ] } ] }, { "id": "ps-6_gdn", "name": "guidance", "prose": "Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with organizational systems to which access is authorized. Organizations can use electronic signatures to acknowledge access agreements unless specifically prohibited by organizational policy." }, { "id": "ps-6_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PS-06", "class": "sp800-53a" } ], "parts": [ { "id": "ps-6_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PS-06a.", "class": "sp800-53a" } ], "prose": "access agreements are developed and documented for organizational systems;", "links": [ { "href": "#ps-6_smt.a", "rel": "assessment-for" } ] }, { "id": "ps-6_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PS-06b.", "class": "sp800-53a" } ], "prose": "the access agreements are reviewed and updated {{ insert: param, ps-06_odp.01 }};", "links": [ { "href": "#ps-6_smt.b", "rel": "assessment-for" } ] }, { "id": "ps-6_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PS-06c.", "class": "sp800-53a" } ], "parts": [ { "id": "ps-6_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PS-06c.01", "class": "sp800-53a" } ], "prose": "individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access;", "links": [ { "href": "#ps-6_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ps-6_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PS-06c.02", "class": "sp800-53a" } ], "prose": "individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or {{ insert: param, ps-06_odp.02 }}.", "links": [ { "href": "#ps-6_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ps-6_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ps-6_smt", "rel": "assessment-for" } ] }, { "id": "ps-6_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PS-06-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personnel security policy\n\npersonnel security procedures\n\nprocedures addressing access agreements for organizational information and systems\n\naccess control policy\n\naccess control procedures\n\naccess agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)\n\ndocumentation of access agreement reviews, updates, and re-signing\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ps-6_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PS-06-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personnel security responsibilities\n\norganizational personnel who have signed/resigned access agreements\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "ps-6_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PS-06-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for reviewing, updating, and re-signing access agreements\n\nmechanisms supporting the reviewing, updating, and re-signing of access agreements" } ] } ] } ] }, { "id": "pt", "class": "family", "title": "Personally Identifiable Information Processing and Transparency", "props": [ { "name": "label", "value": "PT" } ], "controls": [ { "id": "pt-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "pt-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pt-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "pt-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "pt-01_odp.01", "props": [ { "name": "label", "value": "PT-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the personally identifiable information processing and transparency policy is to be disseminated is/are defined;" } ] }, { "id": "pt-01_odp.02", "props": [ { "name": "label", "value": "PT-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the personally identifiable information processing and transparency procedures are to be disseminated is/are defined;" } ] }, { "id": "pt-01_odp.03", "props": [ { "name": "alt-identifier", "value": "pt-1_prm_2" }, { "name": "label", "value": "PT-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "pt-01_odp.04", "props": [ { "name": "alt-identifier", "value": "pt-1_prm_3" }, { "name": "label", "value": "PT-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the personally identifiable information processing and transparency policy and procedures is defined;" } ] }, { "id": "pt-01_odp.05", "props": [ { "name": "alt-identifier", "value": "pt-1_prm_4" }, { "name": "label", "value": "PT-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current personally identifiable information processing and transparency policy is reviewed and updated is defined;" } ] }, { "id": "pt-01_odp.06", "props": [ { "name": "alt-identifier", "value": "pt-1_prm_5" }, { "name": "label", "value": "PT-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current personally identifiable information processing and transparency policy to be reviewed and updated are defined;" } ] }, { "id": "pt-01_odp.07", "props": [ { "name": "alt-identifier", "value": "pt-1_prm_6" }, { "name": "label", "value": "PT-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current personally identifiable information processing and transparency procedures are reviewed and updated is defined;" } ] }, { "id": "pt-01_odp.08", "props": [ { "name": "alt-identifier", "value": "pt-1_prm_7" }, { "name": "label", "value": "PT-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the personally identifiable information processing and transparency procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "PT-01", "class": "zero-padded" }, { "name": "label", "value": "PT-1" }, { "name": "label", "value": "PT-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" } ], "parts": [ { "id": "pt-1_smt", "name": "statement", "parts": [ { "id": "pt-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, pt-1_prm_1 }}:", "parts": [ { "id": "pt-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy that:", "parts": [ { "id": "pt-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "pt-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "pt-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls;" } ] }, { "id": "pt-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, pt-01_odp.04 }} to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and" }, { "id": "pt-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current personally identifiable information processing and transparency:", "parts": [ { "id": "pt-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, pt-01_odp.05 }} and following {{ insert: param, pt-01_odp.06 }} ; and" }, { "id": "pt-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, pt-01_odp.07 }} and following {{ insert: param, pt-01_odp.08 }}." } ] } ] }, { "id": "pt-1_gdn", "name": "guidance", "prose": "Personally identifiable information processing and transparency policy and procedures address the controls in the PT family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of personally identifiable information processing and transparency policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to personally identifiable information processing and transparency policy and procedures include assessment or audit findings, breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "pt-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01", "class": "sp800-53a" } ], "parts": [ { "id": "pt-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "pt-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.[01]", "class": "sp800-53a" } ], "prose": "a personally identifiable information processing and transparency policy is developed and documented;", "links": [ { "href": "#pt-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.[02]", "class": "sp800-53a" } ], "prose": "the personally identifiable information processing and transparency policy is disseminated to {{ insert: param, pt-01_odp.01 }};", "links": [ { "href": "#pt-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.[03]", "class": "sp800-53a" } ], "prose": "personally identifiable information processing and transparency procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and associated personally identifiable information processing and transparency controls are developed and documented;", "links": [ { "href": "#pt-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.[04]", "class": "sp800-53a" } ], "prose": "the personally identifiable information processing and transparency procedures are disseminated to {{ insert: param, pt-01_odp.02 }};", "links": [ { "href": "#pt-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "pt-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "pt-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy addresses purpose;", "links": [ { "href": "#pt-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy addresses scope;", "links": [ { "href": "#pt-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy addresses roles;", "links": [ { "href": "#pt-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy addresses responsibilities;", "links": [ { "href": "#pt-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy addresses management commitment;", "links": [ { "href": "#pt-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy addresses coordination among organizational entities;", "links": [ { "href": "#pt-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy addresses compliance;", "links": [ { "href": "#pt-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#pt-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-1_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures;", "links": [ { "href": "#pt-1_smt.b", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "pt-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "pt-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current personally identifiable information processing and transparency policy is reviewed and updated {{ insert: param, pt-01_odp.05 }};", "links": [ { "href": "#pt-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current personally identifiable information processing and transparency policy is reviewed and updated following {{ insert: param, pt-01_odp.06 }};", "links": [ { "href": "#pt-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "pt-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current personally identifiable information processing and transparency procedures are reviewed and updated {{ insert: param, pt-01_odp.07 }};", "links": [ { "href": "#pt-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "pt-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current personally identifiable information processing and transparency procedures are reviewed and updated following {{ insert: param, pt-01_odp.08 }}.", "links": [ { "href": "#pt-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-1_smt", "rel": "assessment-for" } ] }, { "id": "pt-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy plan\n\nprivacy program plan\n\nother relevant documents or records" } ] }, { "id": "pt-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "pt-2", "class": "SP800-53", "title": "Authority to Process Personally Identifiable Information", "params": [ { "id": "pt-02_odp.01", "props": [ { "name": "alt-identifier", "value": "pt-2_prm_1" }, { "name": "label", "value": "PT-02_ODP[01]", "class": "sp800-53a" } ], "label": "authority", "guidelines": [ { "prose": "the authority to permit the processing (defined in PT-02_ODP[02]) of personally identifiable information is defined;" } ] }, { "id": "pt-02_odp.02", "props": [ { "name": "alt-identifier", "value": "pt-2_prm_2" }, { "name": "label", "value": "PT-02_ODP[02]", "class": "sp800-53a" } ], "label": "processing", "guidelines": [ { "prose": "the type of processing of personally identifiable information is defined;" } ] }, { "id": "pt-02_odp.03", "props": [ { "name": "alt-identifier", "value": "pt-2_prm_3" }, { "name": "label", "value": "PT-02_ODP[03]", "class": "sp800-53a" } ], "label": "processing", "guidelines": [ { "prose": "the type of processing of personally identifiable information to be restricted is defined;" } ] } ], "props": [ { "name": "label", "value": "PT-02", "class": "zero-padded" }, { "name": "label", "value": "PT-2" }, { "name": "label", "value": "PT-02", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#a2590922-82f3-4277-83c0-ca5bee06dba4", "rel": "reference" }, { "href": "#ac-2", "rel": "related" }, { "href": "#ac-3", "rel": "related" }, { "href": "#cm-13", "rel": "related" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-24", "rel": "related" }, { "href": "#pt-1", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#pt-5", "rel": "related" }, { "href": "#pt-6", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#ra-8", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#si-18", "rel": "related" } ], "parts": [ { "id": "pt-2_smt", "name": "statement", "parts": [ { "id": "pt-2_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Determine and document the {{ insert: param, pt-02_odp.01 }} that permits the {{ insert: param, pt-02_odp.02 }} of personally identifiable information; and" }, { "id": "pt-2_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Restrict the {{ insert: param, pt-02_odp.03 }} of personally identifiable information to only that which is authorized." } ] }, { "id": "pt-2_gdn", "name": "guidance", "prose": "The processing of personally identifiable information is an operation or set of operations that the information system or organization performs with respect to personally identifiable information across the information life cycle. Processing includes but is not limited to creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Processing operations also include logging, generation, and transformation, as well as analysis techniques, such as data mining.\n\nOrganizations may be subject to laws, executive orders, directives, regulations, or policies that establish the organization’s authority and thereby limit certain types of processing of personally identifiable information or establish other requirements related to the processing. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such authority, particularly if the organization is subject to multiple jurisdictions or sources of authority. For organizations whose processing is not determined according to legal authorities, the organization’s policies and determinations govern how they process personally identifiable information. While processing of personally identifiable information may be legally permissible, privacy risks may still arise. Privacy risk assessments can identify the privacy risks associated with the authorized processing of personally identifiable information and support solutions to manage such risks.\n\nOrganizations consider applicable requirements and organizational policies to determine how to document this authority. For federal agencies, the authority to process personally identifiable information is documented in privacy policies and notices, system of records notices, privacy impact assessments, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, computer matching agreements and notices, contracts, information sharing agreements, memoranda of understanding, and other documentation.\n\nOrganizations take steps to ensure that personally identifiable information is only processed for authorized purposes, including training organizational personnel on the authorized processing of personally identifiable information and monitoring and auditing organizational use of personally identifiable information." }, { "id": "pt-2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-02", "class": "sp800-53a" } ], "parts": [ { "id": "pt-2_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-02a.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-02_odp.01 }} that permits the {{ insert: param, pt-02_odp.02 }} of personally identifiable information is determined and documented;", "links": [ { "href": "#pt-2_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-2_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-02b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-02_odp.03 }} of personally identifiable information is restricted to only that which is authorized.", "links": [ { "href": "#pt-2_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-2_smt", "rel": "assessment-for" } ] }, { "id": "pt-2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-02-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-02-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-02-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for authorizing the processing of personally identifiable information\n\nmechanisms supporting and/or implementing the restriction of personally identifiable information processing" } ] } ] }, { "id": "pt-3", "class": "SP800-53", "title": "Personally Identifiable Information Processing Purposes", "params": [ { "id": "pt-03_odp.01", "props": [ { "name": "alt-identifier", "value": "pt-3_prm_1" }, { "name": "label", "value": "PT-03_ODP[01]", "class": "sp800-53a" } ], "label": "purpose(s)", "guidelines": [ { "prose": "the purpose(s) for processing personally identifiable information is/are defined;" } ] }, { "id": "pt-03_odp.02", "props": [ { "name": "alt-identifier", "value": "pt-3_prm_2" }, { "name": "label", "value": "PT-03_ODP[02]", "class": "sp800-53a" } ], "label": "processing", "guidelines": [ { "prose": "the processing of personally identifiable information to be restricted is defined;" } ] }, { "id": "pt-03_odp.03", "props": [ { "name": "alt-identifier", "value": "pt-3_prm_3" }, { "name": "label", "value": "PT-03_ODP[03]", "class": "sp800-53a" } ], "label": "mechanisms", "guidelines": [ { "prose": "mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements are defined;" } ] }, { "id": "pt-03_odp.04", "props": [ { "name": "alt-identifier", "value": "pt-3_prm_4" }, { "name": "label", "value": "PT-03_ODP[04]", "class": "sp800-53a" } ], "label": "requirements", "guidelines": [ { "prose": "requirements for changing the processing of personally identifiable information are defined;" } ] } ], "props": [ { "name": "label", "value": "PT-03", "class": "zero-padded" }, { "name": "label", "value": "PT-3" }, { "name": "label", "value": "PT-03", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#a2590922-82f3-4277-83c0-ca5bee06dba4", "rel": "reference" }, { "href": "#ac-2", "rel": "related" }, { "href": "#ac-3", "rel": "related" }, { "href": "#at-3", "rel": "related" }, { "href": "#cm-13", "rel": "related" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-25", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-5", "rel": "related" }, { "href": "#pt-6", "rel": "related" }, { "href": "#pt-7", "rel": "related" }, { "href": "#ra-8", "rel": "related" }, { "href": "#sc-43", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#si-18", "rel": "related" } ], "parts": [ { "id": "pt-3_smt", "name": "statement", "parts": [ { "id": "pt-3_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Identify and document the {{ insert: param, pt-03_odp.01 }} for processing personally identifiable information;" }, { "id": "pt-3_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Describe the purpose(s) in the public privacy notices and policies of the organization;" }, { "id": "pt-3_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Restrict the {{ insert: param, pt-03_odp.02 }} of personally identifiable information to only that which is compatible with the identified purpose(s); and" }, { "id": "pt-3_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Monitor changes in processing personally identifiable information and implement {{ insert: param, pt-03_odp.03 }} to ensure that any changes are made in accordance with {{ insert: param, pt-03_odp.04 }}." } ] }, { "id": "pt-3_gdn", "name": "guidance", "prose": "Identifying and documenting the purpose for processing provides organizations with a basis for understanding why personally identifiable information may be processed. The term \"process\" includes every step of the information life cycle, including creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Identifying and documenting the purpose of processing is a prerequisite to enabling owners and operators of the system and individuals whose information is processed by the system to understand how the information will be processed. This enables individuals to make informed decisions about their engagement with information systems and organizations and to manage their privacy interests. Once the specific processing purpose has been identified, the purpose is described in the organization’s privacy notices, policies, and any related privacy compliance documentation, including privacy impact assessments, system of records notices, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, computer matching notices, and other applicable Federal Register notices.\n\nOrganizations take steps to help ensure that personally identifiable information is processed only for identified purposes, including training organizational personnel and monitoring and auditing organizational processing of personally identifiable information.\n\nOrganizations monitor for changes in personally identifiable information processing. Organizational personnel consult with the senior agency official for privacy and legal counsel to ensure that any new purposes that arise from changes in processing are compatible with the purpose for which the information was collected, or if the new purpose is not compatible, implement mechanisms in accordance with defined requirements to allow for the new processing, if appropriate. Mechanisms may include obtaining consent from individuals, revising privacy policies, or other measures to manage privacy risks that arise from changes in personally identifiable information processing purposes." }, { "id": "pt-3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-03", "class": "sp800-53a" } ], "parts": [ { "id": "pt-3_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-03a.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-03_odp.01 }} for processing personally identifiable information is/are identified and documented;", "links": [ { "href": "#pt-3_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-3_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-03b.", "class": "sp800-53a" } ], "parts": [ { "id": "pt-3_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-03b.[01]", "class": "sp800-53a" } ], "prose": "the purpose(s) is/are described in the public privacy notices of the organization;", "links": [ { "href": "#pt-3_smt.b", "rel": "assessment-for" } ] }, { "id": "pt-3_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-03b.[02]", "class": "sp800-53a" } ], "prose": "the purpose(s) is/are described in the policies of the organization;", "links": [ { "href": "#pt-3_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-3_smt.b", "rel": "assessment-for" } ] }, { "id": "pt-3_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-03c.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-03_odp.02 }} of personally identifiable information are restricted to only that which is compatible with the identified purpose(s);", "links": [ { "href": "#pt-3_smt.c", "rel": "assessment-for" } ] }, { "id": "pt-3_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-03d.", "class": "sp800-53a" } ], "parts": [ { "id": "pt-3_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-03d.[01]", "class": "sp800-53a" } ], "prose": "changes in the processing of personally identifiable information are monitored;", "links": [ { "href": "#pt-3_smt.d", "rel": "assessment-for" } ] }, { "id": "pt-3_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-03d.[02]", "class": "sp800-53a" } ], "prose": " {{ insert: param, pt-03_odp.03 }} are implemented to ensure that any changes are made in accordance with {{ insert: param, pt-03_odp.04 }}.", "links": [ { "href": "#pt-3_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-3_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-3_smt", "rel": "assessment-for" } ] }, { "id": "pt-3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-03-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nconfiguration management plan\n\norganizational privacy notices\n\norganizational policies\n\nPrivacy Act statements\n\ncomputer matching notices\n\napplicable Federal Register notices\n\ndocumented requirements for enforcing and monitoring the processing of personally identifiable information\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-03-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-03-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for authorizing the processing of personally identifiable information\n\nmechanisms supporting and/or implementing the management of authorized personally identifiable information processing\n\norganizational processes for monitoring changes in processing personally identifiable information" } ] } ] }, { "id": "pt-4", "class": "SP800-53", "title": "Consent", "params": [ { "id": "pt-04_odp", "props": [ { "name": "alt-identifier", "value": "pt-4_prm_1" }, { "name": "label", "value": "PT-04_ODP", "class": "sp800-53a" } ], "label": "tools or mechanisms", "guidelines": [ { "prose": "the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information are defined;" } ] } ], "props": [ { "name": "label", "value": "PT-04", "class": "zero-padded" }, { "name": "label", "value": "PT-4" }, { "name": "label", "value": "PT-04", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#737513fa-6758-403f-831d-5ddab5e23cb3", "rel": "reference" }, { "href": "#ac-16", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-5", "rel": "related" } ], "parts": [ { "id": "pt-4_smt", "name": "statement", "prose": "Implement {{ insert: param, pt-04_odp }} for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making." }, { "id": "pt-4_gdn", "name": "guidance", "prose": "Consent allows individuals to participate in making decisions about the processing of their information and transfers some of the risk that arises from the processing of personally identifiable information from the organization to an individual. Consent may be required by applicable laws, executive orders, directives, regulations, policies, standards, or guidelines. Otherwise, when selecting consent as a control, organizations consider whether individuals can be reasonably expected to understand and accept the privacy risks that arise from their authorization. Organizations consider whether other controls may more effectively mitigate privacy risk either alone or in conjunction with consent. Organizations also consider any demographic or contextual factors that may influence the understanding or behavior of individuals with respect to the processing carried out by the system or organization. When soliciting consent from individuals, organizations consider the appropriate mechanism for obtaining consent, including the type of consent (e.g., opt-in, opt-out), how to properly authenticate and identity proof individuals and how to obtain consent through electronic means. In addition, organizations consider providing a mechanism for individuals to revoke consent once it has been provided, as appropriate. Finally, organizations consider usability factors to help individuals understand the risks being accepted when providing consent, including the use of plain language and avoiding technical jargon." }, { "id": "pt-4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-04", "class": "sp800-53a" } ], "prose": "the {{ insert: param, pt-04_odp }} are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.", "links": [ { "href": "#pt-4_smt", "rel": "assessment-for" } ] }, { "id": "pt-4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-04-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nconsent policies and procedures\n\nconsent tools and mechanisms\n\nconsent presentation or display (user interface)\n\nevidence of individuals’ consent\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-04-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-04-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for the collection of personally identifiable information\n\nconsent tools or mechanisms for users to authorize the processing of their personally identifiable information\n\nmechanisms implementing consent" } ] } ] }, { "id": "pt-5", "class": "SP800-53", "title": "Privacy Notice", "params": [ { "id": "pt-05_odp.01", "props": [ { "name": "alt-identifier", "value": "pt-5_prm_1" }, { "name": "label", "value": "PT-05_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which a notice is provided to individuals after initial interaction with an organization is defined;" } ] }, { "id": "pt-05_odp.02", "props": [ { "name": "alt-identifier", "value": "pt-5_prm_2" }, { "name": "label", "value": "PT-05_ODP[02]", "class": "sp800-53a" } ], "label": "information", "guidelines": [ { "prose": "information to be included with the notice about the processing of personally identifiable information is defined;" } ] } ], "props": [ { "name": "label", "value": "PT-05", "class": "zero-padded" }, { "name": "label", "value": "PT-5" }, { "name": "label", "value": "PT-05", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-05" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#3671ff20-c17c-44d6-8a88-7de203fa74aa", "rel": "reference" }, { "href": "#pm-20", "rel": "related" }, { "href": "#pm-22", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#pt-4", "rel": "related" }, { "href": "#pt-7", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#sc-42", "rel": "related" }, { "href": "#si-18", "rel": "related" } ], "parts": [ { "id": "pt-5_smt", "name": "statement", "prose": "Provide notice to individuals about the processing of personally identifiable information that:", "parts": [ { "id": "pt-5_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Is available to individuals upon first interacting with an organization, and subsequently at {{ insert: param, pt-05_odp.01 }};" }, { "id": "pt-5_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language;" }, { "id": "pt-5_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Identifies the authority that authorizes the processing of personally identifiable information;" }, { "id": "pt-5_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Identifies the purposes for which personally identifiable information is to be processed; and" }, { "id": "pt-5_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Includes {{ insert: param, pt-05_odp.02 }}." } ] }, { "id": "pt-5_gdn", "name": "guidance", "prose": "Privacy notices help inform individuals about how their personally identifiable information is being processed by the system or organization. Organizations use privacy notices to inform individuals about how, under what authority, and for what purpose their personally identifiable information is processed, as well as other information such as choices individuals might have with respect to that processing and other parties with whom information is shared. Laws, executive orders, directives, regulations, or policies may require that privacy notices include specific elements or be provided in specific formats. Federal agency personnel consult with the senior agency official for privacy and legal counsel regarding when and where to provide privacy notices, as well as elements to include in privacy notices and required formats. In circumstances where laws or government-wide policies do not require privacy notices, organizational policies and determinations may require privacy notices and may serve as a source of the elements to include in privacy notices.\n\nPrivacy risk assessments identify the privacy risks associated with the processing of personally identifiable information and may help organizations determine appropriate elements to include in a privacy notice to manage such risks. To help individuals understand how their information is being processed, organizations write materials in plain language and avoid technical jargon." }, { "id": "pt-5_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-05", "class": "sp800-53a" } ], "parts": [ { "id": "pt-5_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-05a.", "class": "sp800-53a" } ], "parts": [ { "id": "pt-5_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-05a.[01]", "class": "sp800-53a" } ], "prose": "a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization;", "links": [ { "href": "#pt-5_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-5_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-05a.[02]", "class": "sp800-53a" } ], "prose": "a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals {{ insert: param, pt-05_odp.01 }};", "links": [ { "href": "#pt-5_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-5_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-5_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-05b.", "class": "sp800-53a" } ], "prose": "a notice to individuals about the processing of personally identifiable information is provided that is clear, easy-to-understand, and expresses information about personally identifiable information processing in plain language;", "links": [ { "href": "#pt-5_smt.b", "rel": "assessment-for" } ] }, { "id": "pt-5_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-05c.", "class": "sp800-53a" } ], "prose": "a notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information is provided;", "links": [ { "href": "#pt-5_smt.c", "rel": "assessment-for" } ] }, { "id": "pt-5_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-05d.", "class": "sp800-53a" } ], "prose": "a notice to individuals about the processing of personally identifiable information that identifies the purpose for which personally identifiable information is to be processed is provided;", "links": [ { "href": "#pt-5_smt.d", "rel": "assessment-for" } ] }, { "id": "pt-5_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-05e.", "class": "sp800-53a" } ], "prose": "a notice to individuals about the processing of personally identifiable information which includes {{ insert: param, pt-05_odp.02 }} is provided.", "links": [ { "href": "#pt-5_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-5_smt", "rel": "assessment-for" } ] }, { "id": "pt-5_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-05-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy notice\n\nPrivacy Act statements\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-5_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-05-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with user interface or user experience responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-5_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-05-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes and implementation support or mechanisms for providing notice to individuals regarding the processing of their personally identifiable information" } ] } ], "controls": [ { "id": "pt-5.2", "class": "SP800-53-enhancement", "title": "Privacy Act Statements", "props": [ { "name": "label", "value": "PT-05(02)", "class": "zero-padded" }, { "name": "label", "value": "PT-5(2)" }, { "name": "label", "value": "PT-05(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-05.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#pt-5", "rel": "required" }, { "href": "#pt-6", "rel": "related" } ], "parts": [ { "id": "pt-5.2_smt", "name": "statement", "prose": "Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals." }, { "id": "pt-5.2_gdn", "name": "guidance", "prose": "If a federal agency asks individuals to supply information that will become part of a system of records, the agency is required to provide a [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statement on the form used to collect the information or on a separate form that can be retained by the individual. The agency provides a [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statement in such circumstances regardless of whether the information will be collected on a paper or electronic form, on a website, on a mobile application, over the telephone, or through some other medium. This requirement ensures that the individual is provided with sufficient information about the request for information to make an informed decision on whether or not to respond.\n\n [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements provide formal notice to individuals of the authority that authorizes the solicitation of the information; whether providing the information is mandatory or voluntary; the principal purpose(s) for which the information is to be used; the published routine uses to which the information is subject; the effects on the individual, if any, of not providing all or any part of the information requested; and an appropriate citation and link to the relevant system of records notice. Federal agency personnel consult with the senior agency official for privacy and legal counsel regarding the notice provisions of the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455)." }, { "id": "pt-5.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-05(02)", "class": "sp800-53a" } ], "prose": "Privacy Act statements are included on forms that collect information that will be maintained in a Privacy Act system of records, or Privacy Act statements are provided on separate forms that can be retained by individuals.", "links": [ { "href": "#pt-5.2_smt", "rel": "assessment-for" } ] }, { "id": "pt-5.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-05(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy notice\n\nPrivacy Act system of records\n\nforms that include Privacy Act statements\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-5.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-05(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-5.2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-05(02)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for including Privacy Act statements on forms that collect information or on separate forms that can be retained by individuals" } ] } ] } ] }, { "id": "pt-6", "class": "SP800-53", "title": "System of Records Notice", "props": [ { "name": "label", "value": "PT-06", "class": "zero-padded" }, { "name": "label", "value": "PT-6" }, { "name": "label", "value": "PT-06", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-06" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#3671ff20-c17c-44d6-8a88-7de203fa74aa", "rel": "reference" }, { "href": "#ac-3", "rel": "related" }, { "href": "#pm-20", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#pt-5", "rel": "related" } ], "parts": [ { "id": "pt-6_smt", "name": "statement", "prose": "For systems that process information that will be maintained in a Privacy Act system of records:", "parts": [ { "id": "pt-6_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the OMB and appropriate congressional committees for advance review;" }, { "id": "pt-6_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Publish system of records notices in the Federal Register; and" }, { "id": "pt-6_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Keep system of records notices accurate, up-to-date, and scoped in accordance with policy." } ] }, { "id": "pt-6_gdn", "name": "guidance", "prose": "The [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) requires that federal agencies publish a system of records notice in the Federal Register upon the establishment and/or modification of a [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) system of records. As a general matter, a system of records notice is required when an agency maintains a group of any records under the control of the agency from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifier. The notice describes the existence and character of the system and identifies the system of records, the purpose(s) of the system, the authority for maintenance of the records, the categories of records maintained in the system, the categories of individuals about whom records are maintained, the routine uses to which the records are subject, and additional details about the system as described in [OMB A-108](#3671ff20-c17c-44d6-8a88-7de203fa74aa)." }, { "id": "pt-6_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06", "class": "sp800-53a" } ], "parts": [ { "id": "pt-6_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06a.", "class": "sp800-53a" } ], "parts": [ { "id": "pt-6_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06a.[01]", "class": "sp800-53a" } ], "prose": "system of records notices are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records;", "links": [ { "href": "#pt-6_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-6_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06a.[02]", "class": "sp800-53a" } ], "prose": "new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records;", "links": [ { "href": "#pt-6_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-6_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-6_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06b.", "class": "sp800-53a" } ], "prose": "system of records notices are published in the Federal Register for systems that process information that will be maintained in a Privacy Act system of records;", "links": [ { "href": "#pt-6_smt.b", "rel": "assessment-for" } ] }, { "id": "pt-6_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06c.", "class": "sp800-53a" } ], "prose": "system of records notices are kept accurate, up-to-date, and scoped in accordance with policy for systems that process information that will be maintained in a Privacy Act system of records.", "links": [ { "href": "#pt-6_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-6_smt", "rel": "assessment-for" } ] }, { "id": "pt-6_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-06-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy notice\n\nPrivacy Act system of records\n\nFederal Register notices\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-6_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-06-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-6_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-06-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for Privacy Act system of records maintenance" } ] } ], "controls": [ { "id": "pt-6.1", "class": "SP800-53-enhancement", "title": "Routine Uses", "params": [ { "id": "pt-06.01_odp", "props": [ { "name": "alt-identifier", "value": "pt-6.1_prm_1" }, { "name": "label", "value": "PT-06(01)_ODP", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to review all routine uses published in the system of records notice is defined;" } ] } ], "props": [ { "name": "label", "value": "PT-06(01)", "class": "zero-padded" }, { "name": "label", "value": "PT-6(1)" }, { "name": "label", "value": "PT-06(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-06.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#pt-6", "rel": "required" } ], "parts": [ { "id": "pt-6.1_smt", "name": "statement", "prose": "Review all routine uses published in the system of records notice at {{ insert: param, pt-06.01_odp }} to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected." }, { "id": "pt-6.1_gdn", "name": "guidance", "prose": "A [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) routine use is a particular kind of disclosure of a record outside of the federal agency maintaining the system of records. A routine use is an exception to the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) prohibition on the disclosure of a record in a system of records without the prior written consent of the individual to whom the record pertains. To qualify as a routine use, the disclosure must be for a purpose that is compatible with the purpose for which the information was originally collected. The [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) requires agencies to describe each routine use of the records maintained in the system of records, including the categories of users of the records and the purpose of the use. Agencies may only establish routine uses by explicitly publishing them in the relevant system of records notice." }, { "id": "pt-6.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06(01)", "class": "sp800-53a" } ], "prose": "all routine uses published in the system of records notice are reviewed {{ insert: param, pt-06.01_odp }} to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.", "links": [ { "href": "#pt-6.1_smt", "rel": "assessment-for" } ] }, { "id": "pt-6.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-06(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy notice\n\nPrivacy Act system of records\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-6.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-06(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-6.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-06(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for reviewing system of records notices" } ] } ] }, { "id": "pt-6.2", "class": "SP800-53-enhancement", "title": "Exemption Rules", "params": [ { "id": "pt-06.02_odp", "props": [ { "name": "alt-identifier", "value": "pt-6.2_prm_1" }, { "name": "label", "value": "PT-06(02)_ODP", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined;" } ] } ], "props": [ { "name": "label", "value": "PT-06(02)", "class": "zero-padded" }, { "name": "label", "value": "PT-6(2)" }, { "name": "label", "value": "PT-06(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-06.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#pt-6", "rel": "required" } ], "parts": [ { "id": "pt-6.2_smt", "name": "statement", "prose": "Review all Privacy Act exemptions claimed for the system of records at {{ insert: param, pt-06.02_odp }} to ensure they remain appropriate and necessary in accordance with law, that they have been promulgated as regulations, and that they are accurately described in the system of records notice." }, { "id": "pt-6.2_gdn", "name": "guidance", "prose": "The [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) includes two sets of provisions that allow federal agencies to claim exemptions from certain requirements in the statute. In certain circumstances, these provisions allow agencies to promulgate regulations to exempt a system of records from select provisions of the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) . At a minimum, organizations’ [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) exemption regulations include the specific name(s) of any system(s) of records that will be exempt, the specific provisions of the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) from which the system(s) of records is to be exempted, the reasons for the exemption, and an explanation for why the exemption is both necessary and appropriate." }, { "id": "pt-6.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06(02)", "class": "sp800-53a" } ], "parts": [ { "id": "pt-6.2_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06(02)[01]", "class": "sp800-53a" } ], "prose": "all Privacy Act exemptions claimed for the system of records are reviewed {{ insert: param, pt-06.02_odp }} to ensure that they remain appropriate and necessary in accordance with law;", "links": [ { "href": "#pt-6.2_smt", "rel": "assessment-for" } ] }, { "id": "pt-6.2_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06(02)[02]", "class": "sp800-53a" } ], "prose": "all Privacy Act exemptions claimed for the system of records are reviewed {{ insert: param, pt-06.02_odp }} to ensure that they have been promulgated as regulations;", "links": [ { "href": "#pt-6.2_smt", "rel": "assessment-for" } ] }, { "id": "pt-6.2_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-06(02)[03]", "class": "sp800-53a" } ], "prose": "all Privacy Act exemptions claimed for the system of records are reviewed {{ insert: param, pt-06.02_odp }} to ensure that they are accurately described in the system of records notice.", "links": [ { "href": "#pt-6.2_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-6.2_smt", "rel": "assessment-for" } ] }, { "id": "pt-6.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-06(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy notice\n\nPrivacy Act system of records\n\nPrivacy Act exemptions\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-6.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-06(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-6.2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-06(02)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for Privacy Act system of records maintenance" } ] } ] } ] }, { "id": "pt-7", "class": "SP800-53", "title": "Specific Categories of Personally Identifiable Information", "params": [ { "id": "pt-07_odp", "props": [ { "name": "alt-identifier", "value": "pt-7_prm_1" }, { "name": "label", "value": "PT-07_ODP", "class": "sp800-53a" } ], "label": "processing conditions", "guidelines": [ { "prose": "processing conditions to be applied for specific categories of personally identifiable information are defined;" } ] } ], "props": [ { "name": "label", "value": "PT-07", "class": "zero-padded" }, { "name": "label", "value": "PT-7" }, { "name": "label", "value": "PT-07", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-07" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#3671ff20-c17c-44d6-8a88-7de203fa74aa", "rel": "reference" }, { "href": "#c28ae9a8-1121-42a9-a85e-00cfcc9b9a94", "rel": "reference" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#ra-3", "rel": "related" } ], "parts": [ { "id": "pt-7_smt", "name": "statement", "prose": "Apply {{ insert: param, pt-07_odp }} for specific categories of personally identifiable information." }, { "id": "pt-7_gdn", "name": "guidance", "prose": "Organizations apply any conditions or protections that may be necessary for specific categories of personally identifiable information. These conditions may be required by laws, executive orders, directives, regulations, policies, standards, or guidelines. The requirements may also come from the results of privacy risk assessments that factor in contextual changes that may result in an organizational determination that a particular category of personally identifiable information is particularly sensitive or raises particular privacy risks. Organizations consult with the senior agency official for privacy and legal counsel regarding any protections that may be necessary." }, { "id": "pt-7_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07", "class": "sp800-53a" } ], "prose": " {{ insert: param, pt-07_odp }} are applied for specific categories of personally identifiable information.", "links": [ { "href": "#pt-7_smt", "rel": "assessment-for" } ] }, { "id": "pt-7_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-07-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy notice\n\nPrivacy Act system of records\n\ncomputer matching agreements and notices\n\ncontracts\n\nprivacy information sharing agreements\n\nmemoranda of understanding\n\ngoverning requirements\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-7_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-07-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-7_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-07-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for supporting and/or implementing personally identifiable information processing" } ] } ], "controls": [ { "id": "pt-7.1", "class": "SP800-53-enhancement", "title": "Social Security Numbers", "props": [ { "name": "label", "value": "PT-07(01)", "class": "zero-padded" }, { "name": "label", "value": "PT-7(1)" }, { "name": "label", "value": "PT-07(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-07.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#pt-7", "rel": "required" }, { "href": "#ia-4", "rel": "related" } ], "parts": [ { "id": "pt-7.1_smt", "name": "statement", "prose": "When a system processes Social Security numbers:", "parts": [ { "id": "pt-7.1_smt.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier;" }, { "id": "pt-7.1_smt.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and" }, { "id": "pt-7.1_smt.c", "name": "item", "props": [ { "name": "label", "value": "(c)" } ], "prose": "Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it." } ] }, { "id": "pt-7.1_gdn", "name": "guidance", "prose": "Federal law and policy establish specific requirements for organizations’ processing of Social Security numbers. Organizations take steps to eliminate unnecessary uses of Social Security numbers and other sensitive information and observe any particular requirements that apply." }, { "id": "pt-7.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(01)", "class": "sp800-53a" } ], "parts": [ { "id": "pt-7.1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(01)(a)", "class": "sp800-53a" } ], "parts": [ { "id": "pt-7.1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(01)(a)[01]", "class": "sp800-53a" } ], "prose": "when a system processes Social Security numbers, the unnecessary collection, maintenance, and use of Social Security numbers are eliminated;", "links": [ { "href": "#pt-7.1_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-7.1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(01)(a)[02]", "class": "sp800-53a" } ], "prose": "when a system processes Social Security numbers, alternatives to the use of Social Security Numbers as a personal identifier are explored;", "links": [ { "href": "#pt-7.1_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-7.1_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-7.1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(01)(b)", "class": "sp800-53a" } ], "prose": "when a system processes Social Security numbers, individual rights, benefits, or privileges provided by law are not denied because of an individual’s refusal to disclose their Social Security number;", "links": [ { "href": "#pt-7.1_smt.b", "rel": "assessment-for" } ] }, { "id": "pt-7.1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(01)(c)", "class": "sp800-53a" } ], "parts": [ { "id": "pt-7.1_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(01)(c)[01]", "class": "sp800-53a" } ], "prose": "when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it;", "links": [ { "href": "#pt-7.1_smt.c", "rel": "assessment-for" } ] }, { "id": "pt-7.1_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(01)(c)[02]", "class": "sp800-53a" } ], "prose": "when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed by what statutory or other authority the number is solicited;", "links": [ { "href": "#pt-7.1_smt.c", "rel": "assessment-for" } ] }, { "id": "pt-7.1_obj.c-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(01)(c)[03]", "class": "sp800-53a" } ], "prose": "when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed what uses will be made of it.", "links": [ { "href": "#pt-7.1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-7.1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-7.1_smt", "rel": "assessment-for" } ] }, { "id": "pt-7.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-07(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy notice\n\nPrivacy Act system of records\n\nprivacy notice\n\nseparate notice regarding the use of Social Security numbers\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-7.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-07(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-7.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-07(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for identifying, reviewing, and taking action to control the unnecessary use of Social Security numbers\n\nimplementation of an alternative to Social Security numbers as identifiers" } ] } ] }, { "id": "pt-7.2", "class": "SP800-53-enhancement", "title": "First Amendment Information", "props": [ { "name": "label", "value": "PT-07(02)", "class": "zero-padded" }, { "name": "label", "value": "PT-7(2)" }, { "name": "label", "value": "PT-07(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-07.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#pt-7", "rel": "required" } ], "parts": [ { "id": "pt-7.2_smt", "name": "statement", "prose": "Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity." }, { "id": "pt-7.2_gdn", "name": "guidance", "prose": "The [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) limits agencies’ ability to process information that describes how individuals exercise rights guaranteed by the First Amendment. Organizations consult with the senior agency official for privacy and legal counsel regarding these requirements." }, { "id": "pt-7.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-07(02)", "class": "sp800-53a" } ], "prose": "the processing of information describing how any individual exercises rights guaranteed by the First Amendment is prohibited unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.", "links": [ { "href": "#pt-7.2_smt", "rel": "assessment-for" } ] }, { "id": "pt-7.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-07(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy notice\n\nPrivacy Act system of records\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-7.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-07(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-7.2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-07(02)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for supporting and/or implementing personally identifiable information processing" } ] } ] } ] }, { "id": "pt-8", "class": "SP800-53", "title": "Computer Matching Requirements", "props": [ { "name": "label", "value": "PT-08", "class": "zero-padded" }, { "name": "label", "value": "PT-8" }, { "name": "label", "value": "PT-08", "class": "sp800-53a" }, { "name": "sort-id", "value": "pt-08" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#94c64e1a-456c-457f-86da-83ac0dfc85ac", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#3671ff20-c17c-44d6-8a88-7de203fa74aa", "rel": "reference" }, { "href": "#pm-24", "rel": "related" } ], "parts": [ { "id": "pt-8_smt", "name": "statement", "prose": "When a system or organization processes information for the purpose of conducting a matching program:", "parts": [ { "id": "pt-8_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Obtain approval from the Data Integrity Board to conduct the matching program;" }, { "id": "pt-8_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Develop and enter into a computer matching agreement;" }, { "id": "pt-8_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Publish a matching notice in the Federal Register;" }, { "id": "pt-8_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and" }, { "id": "pt-8_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual." } ] }, { "id": "pt-8_gdn", "name": "guidance", "prose": "The [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) establishes requirements for federal and non-federal agencies if they engage in a matching program. In general, a matching program is a computerized comparison of records from two or more automated [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) systems of records or an automated system of records and automated records maintained by a non-federal agency (or agent thereof). A matching program either pertains to federal benefit programs or federal personnel or payroll records. A federal benefit match is performed to determine or verify eligibility for payments under federal benefit programs or to recoup payments or delinquent debts under federal benefit programs. A matching program involves not just the matching activity itself but also the investigative follow-up and ultimate action, if any." }, { "id": "pt-8_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08", "class": "sp800-53a" } ], "parts": [ { "id": "pt-8_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08a.", "class": "sp800-53a" } ], "prose": "approval to conduct the matching program is obtained from the Data Integrity Board when a system or organization processes information for the purpose of conducting a matching program;", "links": [ { "href": "#pt-8_smt.a", "rel": "assessment-for" } ] }, { "id": "pt-8_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08b.", "class": "sp800-53a" } ], "parts": [ { "id": "pt-8_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08b.[01]", "class": "sp800-53a" } ], "prose": "a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program;", "links": [ { "href": "#pt-8_smt.b", "rel": "assessment-for" } ] }, { "id": "pt-8_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08b.[02]", "class": "sp800-53a" } ], "prose": "a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program;", "links": [ { "href": "#pt-8_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-8_smt.b", "rel": "assessment-for" } ] }, { "id": "pt-8_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08c.", "class": "sp800-53a" } ], "prose": "a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program;", "links": [ { "href": "#pt-8_smt.c", "rel": "assessment-for" } ] }, { "id": "pt-8_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08d.", "class": "sp800-53a" } ], "prose": "the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program;", "links": [ { "href": "#pt-8_smt.d", "rel": "assessment-for" } ] }, { "id": "pt-8_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08e.", "class": "sp800-53a" } ], "parts": [ { "id": "pt-8_obj.e-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08e.[01]", "class": "sp800-53a" } ], "prose": "individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program;", "links": [ { "href": "#pt-8_smt.e", "rel": "assessment-for" } ] }, { "id": "pt-8_obj.e-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "PT-08e.[02]", "class": "sp800-53a" } ], "prose": "individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.", "links": [ { "href": "#pt-8_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-8_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#pt-8_smt", "rel": "assessment-for" } ] }, { "id": "pt-8_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "PT-08-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Personally identifiable information processing and transparency policy and procedures\n\nprivacy notice\n\nPrivacy Act system of records\n\nFederal Register notices\n\nData Integrity Board determinations\n\ncontracts\n\ninformation sharing agreements\n\nmemoranda of understanding\n\ngoverning requirements\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "pt-8_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "PT-08-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with personally identifiable information processing and transparency responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "pt-8_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "PT-08-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for supporting and/or implementing personally identifiable information processing\n\nmatching program" } ] } ] } ] }, { "id": "ra", "class": "family", "title": "Risk Assessment", "props": [ { "name": "label", "value": "RA" } ], "controls": [ { "id": "ra-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "ra-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ra-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "ra-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "ra-01_odp.01", "props": [ { "name": "label", "value": "RA-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the risk assessment policy is to be disseminated is/are defined;" } ] }, { "id": "ra-01_odp.02", "props": [ { "name": "label", "value": "RA-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the risk assessment procedures are to be disseminated is/are defined;" } ] }, { "id": "ra-01_odp.03", "props": [ { "name": "alt-identifier", "value": "ra-1_prm_2" }, { "name": "label", "value": "RA-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "ra-01_odp.04", "props": [ { "name": "alt-identifier", "value": "ra-1_prm_3" }, { "name": "label", "value": "RA-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the risk assessment policy and procedures is defined;" } ] }, { "id": "ra-01_odp.05", "props": [ { "name": "alt-identifier", "value": "ra-1_prm_4" }, { "name": "label", "value": "RA-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current risk assessment policy is reviewed and updated is defined;" } ] }, { "id": "ra-01_odp.06", "props": [ { "name": "alt-identifier", "value": "ra-1_prm_5" }, { "name": "label", "value": "RA-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current risk assessment policy to be reviewed and updated are defined;" } ] }, { "id": "ra-01_odp.07", "props": [ { "name": "alt-identifier", "value": "ra-1_prm_6" }, { "name": "label", "value": "RA-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current risk assessment procedures are reviewed and updated is defined;" } ] }, { "id": "ra-01_odp.08", "props": [ { "name": "alt-identifier", "value": "ra-1_prm_7" }, { "name": "label", "value": "RA-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require risk assessment procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "RA-01", "class": "zero-padded" }, { "name": "label", "value": "RA-1" }, { "name": "label", "value": "RA-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "ra-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "ra-1_smt", "name": "statement", "parts": [ { "id": "ra-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, ra-1_prm_1 }}:", "parts": [ { "id": "ra-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, ra-01_odp.03 }} risk assessment policy that:", "parts": [ { "id": "ra-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "ra-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "ra-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls;" } ] }, { "id": "ra-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, ra-01_odp.04 }} to manage the development, documentation, and dissemination of the risk assessment policy and procedures; and" }, { "id": "ra-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current risk assessment:", "parts": [ { "id": "ra-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, ra-01_odp.05 }} and following {{ insert: param, ra-01_odp.06 }} ; and" }, { "id": "ra-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, ra-01_odp.07 }} and following {{ insert: param, ra-01_odp.08 }}." } ] } ] }, { "id": "ra-1_gdn", "name": "guidance", "prose": "Risk assessment policy and procedures address the controls in the RA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of risk assessment policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies reflecting the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to risk assessment policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "ra-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01", "class": "sp800-53a" } ], "parts": [ { "id": "ra-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "ra-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.[01]", "class": "sp800-53a" } ], "prose": "a risk assessment policy is developed and documented;", "links": [ { "href": "#ra-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.[02]", "class": "sp800-53a" } ], "prose": "the risk assessment policy is disseminated to {{ insert: param, ra-01_odp.01 }};", "links": [ { "href": "#ra-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.[03]", "class": "sp800-53a" } ], "prose": "risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented;", "links": [ { "href": "#ra-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.[04]", "class": "sp800-53a" } ], "prose": "the risk assessment procedures are disseminated to {{ insert: param, ra-01_odp.02 }};", "links": [ { "href": "#ra-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "ra-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "ra-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ra-01_odp.03 }} risk assessment policy addresses purpose;", "links": [ { "href": "#ra-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ra-01_odp.03 }} risk assessment policy addresses scope;", "links": [ { "href": "#ra-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ra-01_odp.03 }} risk assessment policy addresses roles;", "links": [ { "href": "#ra-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ra-01_odp.03 }} risk assessment policy addresses responsibilities;", "links": [ { "href": "#ra-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ra-01_odp.03 }} risk assessment policy addresses management commitment;", "links": [ { "href": "#ra-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ra-01_odp.03 }} risk assessment policy addresses coordination among organizational entities;", "links": [ { "href": "#ra-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ra-01_odp.03 }} risk assessment policy addresses compliance;", "links": [ { "href": "#ra-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ra-01_odp.03 }} risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#ra-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-1_smt.a", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, ra-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures;", "links": [ { "href": "#ra-1_smt.b", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "ra-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "ra-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current risk assessment policy is reviewed and updated {{ insert: param, ra-01_odp.05 }};", "links": [ { "href": "#ra-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current risk assessment policy is reviewed and updated following {{ insert: param, ra-01_odp.06 }};", "links": [ { "href": "#ra-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "ra-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current risk assessment procedures are reviewed and updated {{ insert: param, ra-01_odp.07 }};", "links": [ { "href": "#ra-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "ra-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current risk assessment procedures are reviewed and updated following {{ insert: param, ra-01_odp.08 }}.", "links": [ { "href": "#ra-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-1_smt", "rel": "assessment-for" } ] }, { "id": "ra-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "RA-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Risk assessment policy and procedures\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ra-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "RA-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with risk assessment responsibilities\n\norganizational personnel with security and privacy responsibilities" } ] } ] }, { "id": "ra-3", "class": "SP800-53", "title": "Risk Assessment", "params": [ { "id": "ra-03_odp.01", "props": [ { "name": "alt-identifier", "value": "ra-3_prm_1" }, { "name": "label", "value": "RA-03_ODP[01]", "class": "sp800-53a" } ], "select": { "choice": [ "security and privacy plans", "risk assessment report", " {{ insert: param, ra-03_odp.02 }} " ] } }, { "id": "ra-03_odp.02", "props": [ { "name": "alt-identifier", "value": "ra-3_prm_2" }, { "name": "label", "value": "RA-03_ODP[02]", "class": "sp800-53a" } ], "label": "document", "guidelines": [ { "prose": "a document in which risk assessment results are to be documented (if not documented in the security and privacy plans or risk assessment report) is defined (if selected);" } ] }, { "id": "ra-03_odp.03", "props": [ { "name": "alt-identifier", "value": "ra-3_prm_3" }, { "name": "label", "value": "RA-03_ODP[03]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency to review risk assessment results is defined;" } ] }, { "id": "ra-03_odp.04", "props": [ { "name": "alt-identifier", "value": "ra-3_prm_4" }, { "name": "label", "value": "RA-03_ODP[04]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom risk assessment results are to be disseminated is/are defined;" } ] }, { "id": "ra-03_odp.05", "props": [ { "name": "alt-identifier", "value": "ra-3_prm_5" }, { "name": "label", "value": "RA-03_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency to update the risk assessment is defined;" } ] } ], "props": [ { "name": "label", "value": "RA-03", "class": "zero-padded" }, { "name": "label", "value": "RA-3" }, { "name": "label", "value": "RA-03", "class": "sp800-53a" }, { "name": "sort-id", "value": "ra-03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#e8e84963-14fc-4c3a-be05-b412a5d37cd2", "rel": "reference" }, { "href": "#4c501da5-9d79-4cb6-ba80-97260e1ce327", "rel": "reference" }, { "href": "#98d415ca-7281-4064-9931-0c366637e324", "rel": "reference" }, { "href": "#38ff38f0-1366-4f50-a4c9-26a39aacee16", "rel": "reference" }, { "href": "#ca-3", "rel": "related" }, { "href": "#ca-6", "rel": "related" }, { "href": "#cm-4", "rel": "related" }, { "href": "#cm-13", "rel": "related" }, { "href": "#cp-6", "rel": "related" }, { "href": "#cp-7", "rel": "related" }, { "href": "#ia-8", "rel": "related" }, { "href": "#ma-5", "rel": "related" }, { "href": "#pe-3", "rel": "related" }, { "href": "#pe-8", "rel": "related" }, { "href": "#pe-18", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pl-10", "rel": "related" }, { "href": "#pl-11", "rel": "related" }, { "href": "#pm-8", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#pm-28", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-7", "rel": "related" }, { "href": "#ra-2", "rel": "related" }, { "href": "#ra-5", "rel": "related" }, { "href": "#ra-7", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-9", "rel": "related" }, { "href": "#sc-38", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "ra-3_smt", "name": "statement", "parts": [ { "id": "ra-3_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Conduct a risk assessment, including:", "parts": [ { "id": "ra-3_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Identifying threats to and vulnerabilities in the system;" }, { "id": "ra-3_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and" }, { "id": "ra-3_smt.a.3", "name": "item", "props": [ { "name": "label", "value": "3." } ], "prose": "Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;" } ] }, { "id": "ra-3_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;" }, { "id": "ra-3_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Document risk assessment results in {{ insert: param, ra-03_odp.01 }};" }, { "id": "ra-3_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Review risk assessment results {{ insert: param, ra-03_odp.03 }};" }, { "id": "ra-3_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Disseminate risk assessment results to {{ insert: param, ra-03_odp.04 }} ; and" }, { "id": "ra-3_smt.f", "name": "item", "props": [ { "name": "label", "value": "f." } ], "prose": "Update the risk assessment {{ insert: param, ra-03_odp.05 }} or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system." } ] }, { "id": "ra-3_gdn", "name": "guidance", "prose": "Risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations and assets, individuals, other organizations, and the Nation. Risk assessments also consider risk from external parties, including contractors who operate systems on behalf of the organization, individuals who access organizational systems, service providers, and outsourcing entities.\n\nOrganizations can conduct risk assessments at all three levels in the risk management hierarchy (i.e., organization level, mission/business process level, or information system level) and at any stage in the system development life cycle. Risk assessments can also be conducted at various steps in the Risk Management Framework, including preparation, categorization, control selection, control implementation, control assessment, authorization, and control monitoring. Risk assessment is an ongoing activity carried out throughout the system development life cycle.\n\nRisk assessments can also address information related to the system, including system design, the intended use of the system, testing results, and supply chain-related information or artifacts. Risk assessments can play an important role in control selection processes, particularly during the application of tailoring guidance and in the earliest phases of capability determination." }, { "id": "ra-3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03", "class": "sp800-53a" } ], "parts": [ { "id": "ra-3_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03a.", "class": "sp800-53a" } ], "parts": [ { "id": "ra-3_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03a.01", "class": "sp800-53a" } ], "prose": "a risk assessment is conducted to identify threats to and vulnerabilities in the system;", "links": [ { "href": "#ra-3_smt.a.1", "rel": "assessment-for" } ] }, { "id": "ra-3_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03a.02", "class": "sp800-53a" } ], "prose": "a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information;", "links": [ { "href": "#ra-3_smt.a.2", "rel": "assessment-for" } ] }, { "id": "ra-3_obj.a.3", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03a.03", "class": "sp800-53a" } ], "prose": "a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;", "links": [ { "href": "#ra-3_smt.a.3", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-3_smt.a", "rel": "assessment-for" } ] }, { "id": "ra-3_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03b.", "class": "sp800-53a" } ], "prose": "risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments;", "links": [ { "href": "#ra-3_smt.b", "rel": "assessment-for" } ] }, { "id": "ra-3_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03c.", "class": "sp800-53a" } ], "prose": "risk assessment results are documented in {{ insert: param, ra-03_odp.01 }};", "links": [ { "href": "#ra-3_smt.c", "rel": "assessment-for" } ] }, { "id": "ra-3_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03d.", "class": "sp800-53a" } ], "prose": "risk assessment results are reviewed {{ insert: param, ra-03_odp.03 }};", "links": [ { "href": "#ra-3_smt.d", "rel": "assessment-for" } ] }, { "id": "ra-3_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03e.", "class": "sp800-53a" } ], "prose": "risk assessment results are disseminated to {{ insert: param, ra-03_odp.04 }};", "links": [ { "href": "#ra-3_smt.e", "rel": "assessment-for" } ] }, { "id": "ra-3_obj.f", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-03f.", "class": "sp800-53a" } ], "prose": "the risk assessment is updated {{ insert: param, ra-03_odp.05 }} or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.", "links": [ { "href": "#ra-3_smt.f", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-3_smt", "rel": "assessment-for" } ] }, { "id": "ra-3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "RA-03-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Risk assessment policy\n\nrisk assessment procedures\n\nsecurity and privacy planning policy and procedures\n\nprocedures addressing organizational assessments of risk\n\nrisk assessment\n\nrisk assessment results\n\nrisk assessment reviews\n\nrisk assessment updates\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ra-3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "RA-03-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with risk assessment responsibilities\n\norganizational personnel with security and privacy responsibilities" } ] }, { "id": "ra-3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "RA-03-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for risk assessment\n\nmechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment" } ] } ] }, { "id": "ra-7", "class": "SP800-53", "title": "Risk Response", "props": [ { "name": "label", "value": "RA-07", "class": "zero-padded" }, { "name": "label", "value": "RA-7" }, { "name": "label", "value": "RA-07", "class": "sp800-53a" }, { "name": "sort-id", "value": "ra-07" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#599fb53d-5041-444e-a7fe-640d6d30ad05", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#ca-5", "rel": "related" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pm-4", "rel": "related" }, { "href": "#pm-28", "rel": "related" }, { "href": "#ra-2", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#sr-2", "rel": "related" } ], "parts": [ { "id": "ra-7_smt", "name": "statement", "prose": "Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance." }, { "id": "ra-7_gdn", "name": "guidance", "prose": "Organizations have many options for responding to risk including mitigating risk by implementing new controls or strengthening existing controls, accepting risk with appropriate justification or rationale, sharing or transferring risk, or avoiding risk. The risk tolerance of the organization influences risk response decisions and actions. Risk response addresses the need to determine an appropriate response to risk before generating a plan of action and milestones entry. For example, the response may be to accept risk or reject risk, or it may be possible to mitigate the risk immediately so that a plan of action and milestones entry is not needed. However, if the risk response is to mitigate the risk, and the mitigation cannot be completed immediately, a plan of action and milestones entry is generated." }, { "id": "ra-7_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-07", "class": "sp800-53a" } ], "parts": [ { "id": "ra-7_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-07[01]", "class": "sp800-53a" } ], "prose": "findings from security assessments are responded to in accordance with organizational risk tolerance;", "links": [ { "href": "#ra-7_smt", "rel": "assessment-for" } ] }, { "id": "ra-7_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-07[02]", "class": "sp800-53a" } ], "prose": "findings from privacy assessments are responded to in accordance with organizational risk tolerance;", "links": [ { "href": "#ra-7_smt", "rel": "assessment-for" } ] }, { "id": "ra-7_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-07[03]", "class": "sp800-53a" } ], "prose": "findings from monitoring are responded to in accordance with organizational risk tolerance;", "links": [ { "href": "#ra-7_smt", "rel": "assessment-for" } ] }, { "id": "ra-7_obj-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-07[04]", "class": "sp800-53a" } ], "prose": "findings from audits are responded to in accordance with organizational risk tolerance.", "links": [ { "href": "#ra-7_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-7_smt", "rel": "assessment-for" } ] }, { "id": "ra-7_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "RA-07-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Risk assessment policy\n\nassessment reports\n\naudit records/event logs\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ra-7_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "RA-07-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with assessment and auditing responsibilities\n\nsystem/network administrators\n\norganizational personnel with security and privacy responsibilities" } ] }, { "id": "ra-7_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "RA-07-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for assessments and audits\n\nmechanisms/tools supporting and/or implementing assessments and auditing" } ] } ] }, { "id": "ra-8", "class": "SP800-53", "title": "Privacy Impact Assessments", "props": [ { "name": "label", "value": "RA-08", "class": "zero-padded" }, { "name": "label", "value": "RA-8" }, { "name": "label", "value": "RA-08", "class": "sp800-53a" }, { "name": "sort-id", "value": "ra-08" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#7b0b9634-741a-4335-b6fa-161228c3a76e", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#d229ae60-51dd-4d7b-a8bf-1f7195cc7561", "rel": "reference" }, { "href": "#cm-4", "rel": "related" }, { "href": "#cm-9", "rel": "related" }, { "href": "#cm-13", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#pt-5", "rel": "related" }, { "href": "#ra-1", "rel": "related" }, { "href": "#ra-2", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#ra-7", "rel": "related" } ], "parts": [ { "id": "ra-8_smt", "name": "statement", "prose": "Conduct privacy impact assessments for systems, programs, or other activities before:", "parts": [ { "id": "ra-8_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Developing or procuring information technology that processes personally identifiable information; and" }, { "id": "ra-8_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Initiating a new collection of personally identifiable information that:", "parts": [ { "id": "ra-8_smt.b.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Will be processed using information technology; and" }, { "id": "ra-8_smt.b.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government." } ] } ] }, { "id": "ra-8_gdn", "name": "guidance", "prose": "A privacy impact assessment is an analysis of how personally identifiable information is handled to ensure that handling conforms to applicable privacy requirements, determine the privacy risks associated with an information system or activity, and evaluate ways to mitigate privacy risks. A privacy impact assessment is both an analysis and a formal document that details the process and the outcome of the analysis.\n\nOrganizations conduct and develop a privacy impact assessment with sufficient clarity and specificity to demonstrate that the organization fully considered privacy and incorporated appropriate privacy protections from the earliest stages of the organization’s activity and throughout the information life cycle. In order to conduct a meaningful privacy impact assessment, the organization’s senior agency official for privacy works closely with program managers, system owners, information technology experts, security officials, counsel, and other relevant organization personnel. Moreover, a privacy impact assessment is not a time-restricted activity that is limited to a particular milestone or stage of the information system or personally identifiable information life cycles. Rather, the privacy analysis continues throughout the system and personally identifiable information life cycles. Accordingly, a privacy impact assessment is a living document that organizations update whenever changes to the information technology, changes to the organization’s practices, or other factors alter the privacy risks associated with the use of such information technology.\n\nTo conduct the privacy impact assessment, organizations can use security and privacy risk assessments. Organizations may also use other related processes that may have different names, including privacy threshold analyses. A privacy impact assessment can also serve as notice to the public regarding the organization’s practices with respect to privacy. Although conducting and publishing privacy impact assessments may be required by law, organizations may develop such policies in the absence of applicable laws. For federal agencies, privacy impact assessments may be required by [EGOV](#7b0b9634-741a-4335-b6fa-161228c3a76e) ; agencies should consult with their senior agency official for privacy and legal counsel on this requirement and be aware of the statutory exceptions and OMB guidance relating to the provision." }, { "id": "ra-8_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-08", "class": "sp800-53a" } ], "parts": [ { "id": "ra-8_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-08a.", "class": "sp800-53a" } ], "prose": "privacy impact assessments are conducted for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information;", "links": [ { "href": "#ra-8_smt.a", "rel": "assessment-for" } ] }, { "id": "ra-8_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-08b.", "class": "sp800-53a" } ], "parts": [ { "id": "ra-8_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-08b.[01]", "class": "sp800-53a" } ], "prose": "privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that will be processed using information technology;", "links": [ { "href": "#ra-8_smt.b", "rel": "assessment-for" } ] }, { "id": "ra-8_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "RA-08b.[02]", "class": "sp800-53a" } ], "prose": "privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.", "links": [ { "href": "#ra-8_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-8_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#ra-8_smt", "rel": "assessment-for" } ] }, { "id": "ra-8_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "RA-08-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Risk assessment policy\n\nsecurity and privacy risk assessment reports\n\nacquisitions documents\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "ra-8_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "RA-08-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with assessment and auditing responsibilities\n\nsystem/network administrators\n\nsystem developers\n\nprogram managers\n\nlegal counsel\n\norganizational personnel with security and privacy responsibilities" } ] }, { "id": "ra-8_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "RA-08-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for assessments and audits\n\nmechanisms/tools supporting and/or implementing assessments and auditing" } ] } ] } ] }, { "id": "sa", "class": "family", "title": "System and Services Acquisition", "props": [ { "name": "label", "value": "SA" } ], "controls": [ { "id": "sa-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "sa-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "sa-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "sa-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "sa-01_odp.01", "props": [ { "name": "label", "value": "SA-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the system and services acquisition policy is to be disseminated is/are defined;" } ] }, { "id": "sa-01_odp.02", "props": [ { "name": "label", "value": "SA-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the system and services acquisition procedures are to be disseminated is/are defined;" } ] }, { "id": "sa-01_odp.03", "props": [ { "name": "alt-identifier", "value": "sa-1_prm_2" }, { "name": "label", "value": "SA-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "sa-01_odp.04", "props": [ { "name": "alt-identifier", "value": "sa-1_prm_3" }, { "name": "label", "value": "SA-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the system and services acquisition policy and procedures is defined;" } ] }, { "id": "sa-01_odp.05", "props": [ { "name": "alt-identifier", "value": "sa-1_prm_4" }, { "name": "label", "value": "SA-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current system and services acquisition policy is reviewed and updated is defined;" } ] }, { "id": "sa-01_odp.06", "props": [ { "name": "alt-identifier", "value": "sa-1_prm_5" }, { "name": "label", "value": "SA-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current system and services acquisition policy to be reviewed and updated are defined;" } ] }, { "id": "sa-01_odp.07", "props": [ { "name": "alt-identifier", "value": "sa-1_prm_6" }, { "name": "label", "value": "SA-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current system and services acquisition procedures are reviewed and updated is defined;" } ] }, { "id": "sa-01_odp.08", "props": [ { "name": "alt-identifier", "value": "sa-1_prm_7" }, { "name": "label", "value": "SA-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the system and services acquisition procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "SA-01", "class": "zero-padded" }, { "name": "label", "value": "SA-1" }, { "name": "label", "value": "SA-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "sa-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "sa-1_smt", "name": "statement", "parts": [ { "id": "sa-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, sa-1_prm_1 }}:", "parts": [ { "id": "sa-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, sa-01_odp.03 }} system and services acquisition policy that:", "parts": [ { "id": "sa-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "sa-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "sa-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the system and services acquisition policy and the associated system and services acquisition controls;" } ] }, { "id": "sa-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, sa-01_odp.04 }} to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; and" }, { "id": "sa-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current system and services acquisition:", "parts": [ { "id": "sa-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, sa-01_odp.05 }} and following {{ insert: param, sa-01_odp.06 }} ; and" }, { "id": "sa-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, sa-01_odp.07 }} and following {{ insert: param, sa-01_odp.08 }}." } ] } ] }, { "id": "sa-1_gdn", "name": "guidance", "prose": "System and services acquisition policy and procedures address the controls in the SA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of system and services acquisition policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to system and services acquisition policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "sa-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01", "class": "sp800-53a" } ], "parts": [ { "id": "sa-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.[01]", "class": "sp800-53a" } ], "prose": "a system and services acquisition policy is developed and documented;", "links": [ { "href": "#sa-1_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.[02]", "class": "sp800-53a" } ], "prose": "the system and services acquisition policy is disseminated to {{ insert: param, sa-01_odp.01 }};", "links": [ { "href": "#sa-1_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.[03]", "class": "sp800-53a" } ], "prose": "system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented;", "links": [ { "href": "#sa-1_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.[04]", "class": "sp800-53a" } ], "prose": "the system and services acquisition procedures are disseminated to {{ insert: param, sa-01_odp.02 }};", "links": [ { "href": "#sa-1_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "sa-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "sa-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, sa-01_odp.03 }} system and services acquisition policy addresses purpose;", "links": [ { "href": "#sa-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, sa-01_odp.03 }} system and services acquisition policy addresses scope;", "links": [ { "href": "#sa-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, sa-01_odp.03 }} system and services acquisition policy addresses roles;", "links": [ { "href": "#sa-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, sa-01_odp.03 }} system and services acquisition policy addresses responsibilities;", "links": [ { "href": "#sa-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, sa-01_odp.03 }} system and services acquisition policy addresses management commitment;", "links": [ { "href": "#sa-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, sa-01_odp.03 }} system and services acquisition policy addresses coordination among organizational entities;", "links": [ { "href": "#sa-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, sa-01_odp.03 }} system and services acquisition policy addresses compliance;", "links": [ { "href": "#sa-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, sa-01_odp.03 }} system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#sa-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-1_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, sa-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures;", "links": [ { "href": "#sa-1_smt.b", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "sa-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01c.01[01]", "class": "sp800-53a" } ], "prose": "the system and services acquisition policy is reviewed and updated {{ insert: param, sa-01_odp.05 }};", "links": [ { "href": "#sa-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current system and services acquisition policy is reviewed and updated following {{ insert: param, sa-01_odp.06 }};", "links": [ { "href": "#sa-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "sa-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current system and services acquisition procedures are reviewed and updated {{ insert: param, sa-01_odp.07 }};", "links": [ { "href": "#sa-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "sa-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current system and services acquisition procedures are reviewed and updated following {{ insert: param, sa-01_odp.08 }}.", "links": [ { "href": "#sa-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-1_smt", "rel": "assessment-for" } ] }, { "id": "sa-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SA-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and services acquisition policy\n\nsystem and services acquisition procedures\n\nsupply chain risk management policy\n\nsupply chain risk management procedures\n\nsupply chain risk management plan\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "sa-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SA-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system and services acquisition responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\norganizational personnel with supply chain risk management responsibilities" } ] } ] }, { "id": "sa-2", "class": "SP800-53", "title": "Allocation of Resources", "props": [ { "name": "label", "value": "SA-02", "class": "zero-padded" }, { "name": "label", "value": "SA-2" }, { "name": "label", "value": "SA-02", "class": "sp800-53a" }, { "name": "sort-id", "value": "sa-02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#pl-7", "rel": "related" }, { "href": "#pm-3", "rel": "related" }, { "href": "#pm-11", "rel": "related" }, { "href": "#sa-9", "rel": "related" }, { "href": "#sr-3", "rel": "related" }, { "href": "#sr-5", "rel": "related" } ], "parts": [ { "id": "sa-2_smt", "name": "statement", "parts": [ { "id": "sa-2_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning;" }, { "id": "sa-2_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and" }, { "id": "sa-2_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation." } ] }, { "id": "sa-2_gdn", "name": "guidance", "prose": "Resource allocation for information security and privacy includes funding for system and services acquisition, sustainment, and supply chain-related risks throughout the system development life cycle." }, { "id": "sa-2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02", "class": "sp800-53a" } ], "parts": [ { "id": "sa-2_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02a.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-2_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02a.[01]", "class": "sp800-53a" } ], "prose": "the high-level information security requirements for the system or system service are determined in mission and business process planning;", "links": [ { "href": "#sa-2_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-2_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02a.[02]", "class": "sp800-53a" } ], "prose": "the high-level privacy requirements for the system or system service are determined in mission and business process planning;", "links": [ { "href": "#sa-2_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-2_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-2_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02b.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-2_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02b.[01]", "class": "sp800-53a" } ], "prose": "the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process;", "links": [ { "href": "#sa-2_smt.b", "rel": "assessment-for" } ] }, { "id": "sa-2_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02b.[02]", "class": "sp800-53a" } ], "prose": "the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process;", "links": [ { "href": "#sa-2_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-2_smt.b", "rel": "assessment-for" } ] }, { "id": "sa-2_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02c.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-2_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02c.[01]", "class": "sp800-53a" } ], "prose": "a discrete line item for information security is established in organizational programming and budgeting documentation;", "links": [ { "href": "#sa-2_smt.c", "rel": "assessment-for" } ] }, { "id": "sa-2_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-02c.[02]", "class": "sp800-53a" } ], "prose": "a discrete line item for privacy is established in organizational programming and budgeting documentation.", "links": [ { "href": "#sa-2_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-2_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-2_smt", "rel": "assessment-for" } ] }, { "id": "sa-2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SA-02-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and services acquisition policy\n\nsystem and services acquisition procedures\n\nsystem and services acquisition strategy and plans\n\nprocedures addressing the allocation of resources to information security and privacy requirements\n\nprocedures addressing capital planning and investment control\n\norganizational programming and budgeting documentation\n\nsystem security plan\n\nprivacy plan\n\nsupply chain risk management policy\n\nother relevant documents or records" } ] }, { "id": "sa-2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SA-02-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with capital planning, investment control, organizational programming, and budgeting responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\norganizational personnel with supply chain risk management responsibilities" } ] }, { "id": "sa-2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SA-02-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for determining information security and privacy requirements\n\norganizational processes for capital planning, programming, and budgeting\n\nmechanisms supporting and/or implementing organizational capital planning, programming, and budgeting" } ] } ] }, { "id": "sa-3", "class": "SP800-53", "title": "System Development Life Cycle", "params": [ { "id": "sa-03_odp", "props": [ { "name": "alt-identifier", "value": "sa-3_prm_1" }, { "name": "alt-label", "value": "system development life cycle", "class": "sp800-53" }, { "name": "label", "value": "SA-03_ODP", "class": "sp800-53a" } ], "label": "system-development life cycle", "guidelines": [ { "prose": "system development life cycle is defined;" } ] } ], "props": [ { "name": "label", "value": "SA-03", "class": "zero-padded" }, { "name": "label", "value": "SA-3" }, { "name": "label", "value": "SA-03", "class": "sp800-53a" }, { "name": "sort-id", "value": "sa-03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#7dbd6d9f-29d6-4d1d-9766-f2d77ff3c849", "rel": "reference" }, { "href": "#f26af0d0-6d72-4a9d-8ecd-01bc21fd4f0e", "rel": "reference" }, { "href": "#at-3", "rel": "related" }, { "href": "#pl-8", "rel": "related" }, { "href": "#pm-7", "rel": "related" }, { "href": "#sa-4", "rel": "related" }, { "href": "#sa-5", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-11", "rel": "related" }, { "href": "#sa-15", "rel": "related" }, { "href": "#sa-17", "rel": "related" }, { "href": "#sa-22", "rel": "related" }, { "href": "#sr-3", "rel": "related" }, { "href": "#sr-4", "rel": "related" }, { "href": "#sr-5", "rel": "related" }, { "href": "#sr-9", "rel": "related" } ], "parts": [ { "id": "sa-3_smt", "name": "statement", "parts": [ { "id": "sa-3_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Acquire, develop, and manage the system using {{ insert: param, sa-03_odp }} that incorporates information security and privacy considerations;" }, { "id": "sa-3_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Define and document information security and privacy roles and responsibilities throughout the system development life cycle;" }, { "id": "sa-3_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Identify individuals having information security and privacy roles and responsibilities; and" }, { "id": "sa-3_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Integrate the organizational information security and privacy risk management process into system development life cycle activities." } ] }, { "id": "sa-3_gdn", "name": "guidance", "prose": "A system development life cycle process provides the foundation for the successful development, implementation, and operation of organizational systems. The integration of security and privacy considerations early in the system development life cycle is a foundational principle of systems security engineering and privacy engineering. To apply the required controls within the system development life cycle requires a basic understanding of information security and privacy, threats, vulnerabilities, adverse impacts, and risk to critical mission and business functions. The security engineering principles in [SA-8](#sa-8) help individuals properly design, code, and test systems and system components. Organizations include qualified personnel (e.g., senior agency information security officers, senior agency officials for privacy, security and privacy architects, and security and privacy engineers) in system development life cycle processes to ensure that established security and privacy requirements are incorporated into organizational systems. Role-based security and privacy training programs can ensure that individuals with key security and privacy roles and responsibilities have the experience, skills, and expertise to conduct assigned system development life cycle activities.\n\nThe effective integration of security and privacy requirements into enterprise architecture also helps to ensure that important security and privacy considerations are addressed throughout the system life cycle and that those considerations are directly related to organizational mission and business processes. This process also facilitates the integration of the information security and privacy architectures into the enterprise architecture, consistent with the risk management strategy of the organization. Because the system development life cycle involves multiple organizations, (e.g., external suppliers, developers, integrators, service providers), acquisition and supply chain risk management functions and controls play significant roles in the effective management of the system during the life cycle." }, { "id": "sa-3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03", "class": "sp800-53a" } ], "parts": [ { "id": "sa-3_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03a.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-3_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03a.[01]", "class": "sp800-53a" } ], "prose": "the system is acquired, developed, and managed using {{ insert: param, sa-03_odp }} that incorporates information security considerations;", "links": [ { "href": "#sa-3_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-3_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03a.[02]", "class": "sp800-53a" } ], "prose": "the system is acquired, developed, and managed using {{ insert: param, sa-03_odp }} that incorporates privacy considerations;", "links": [ { "href": "#sa-3_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-3_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-3_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03b.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-3_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03b.[01]", "class": "sp800-53a" } ], "prose": "information security roles and responsibilities are defined and documented throughout the system development life cycle;", "links": [ { "href": "#sa-3_smt.b", "rel": "assessment-for" } ] }, { "id": "sa-3_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03b.[02]", "class": "sp800-53a" } ], "prose": "privacy roles and responsibilities are defined and documented throughout the system development life cycle;", "links": [ { "href": "#sa-3_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-3_smt.b", "rel": "assessment-for" } ] }, { "id": "sa-3_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03c.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-3_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03c.[01]", "class": "sp800-53a" } ], "prose": "individuals with information security roles and responsibilities are identified;", "links": [ { "href": "#sa-3_smt.c", "rel": "assessment-for" } ] }, { "id": "sa-3_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03c.[02]", "class": "sp800-53a" } ], "prose": "individuals with privacy roles and responsibilities are identified;", "links": [ { "href": "#sa-3_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-3_smt.c", "rel": "assessment-for" } ] }, { "id": "sa-3_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03d.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-3_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03d.[01]", "class": "sp800-53a" } ], "prose": "organizational information security risk management processes are integrated into system development life cycle activities;", "links": [ { "href": "#sa-3_smt.d", "rel": "assessment-for" } ] }, { "id": "sa-3_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-03d.[02]", "class": "sp800-53a" } ], "prose": "organizational privacy risk management processes are integrated into system development life cycle activities.", "links": [ { "href": "#sa-3_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-3_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-3_smt", "rel": "assessment-for" } ] }, { "id": "sa-3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SA-03-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and services acquisition policy\n\nsystem and services acquisition procedures\n\nprocedures addressing the integration of information security and privacy and supply chain risk management into the system development life cycle process\n\nsystem development life cycle documentation\n\norganizational risk management strategy\n\ninformation security and privacy risk management strategy documentation\n\nsystem security plan\n\nprivacy plan\n\nprivacy program plan\n\nenterprise architecture documentation\n\nrole-based security and privacy training program documentation\n\ndata mapping documentation\n\nother relevant documents or records" } ] }, { "id": "sa-3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SA-03-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy responsibilities\n\norganizational personnel with system life cycle development responsibilities\n\norganizational personnel with supply chain risk management responsibilities" } ] }, { "id": "sa-3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SA-03-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for defining and documenting the system development life cycle\n\norganizational processes for identifying system development life cycle roles and responsibilities\n\norganizational processes for integrating information security and privacy and supply chain risk management into the system development life cycle\n\nmechanisms supporting and/or implementing the system development life cycle" } ] } ] }, { "id": "sa-4", "class": "SP800-53", "title": "Acquisition Process", "params": [ { "id": "sa-04_odp.01", "props": [ { "name": "alt-identifier", "value": "sa-4_prm_1" }, { "name": "label", "value": "SA-04_ODP[01]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "standardized contract language", " {{ insert: param, sa-04_odp.02 }} " ] } }, { "id": "sa-04_odp.02", "props": [ { "name": "alt-identifier", "value": "sa-4_prm_2" }, { "name": "label", "value": "SA-04_ODP[02]", "class": "sp800-53a" } ], "label": "contract language", "guidelines": [ { "prose": "contract language is defined (if selected);" } ] } ], "props": [ { "name": "label", "value": "SA-04", "class": "zero-padded" }, { "name": "label", "value": "SA-4" }, { "name": "label", "value": "SA-04", "class": "sp800-53a" }, { "name": "sort-id", "value": "sa-04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#18e71fec-c6fd-475a-925a-5d8495cf8455", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#6afc1b04-c9d6-4023-adbc-f8fbe33a3c73", "rel": "reference" }, { "href": "#87087451-2af5-43d4-88c1-d66ad850f614", "rel": "reference" }, { "href": "#4452efc0-e79e-47b8-aa30-b54f3ef61c2f", "rel": "reference" }, { "href": "#06ce9216-bd54-4054-a422-94f358b50a5d", "rel": "reference" }, { "href": "#678e3d6c-150b-4393-aec5-6e3481eb1e00", "rel": "reference" }, { "href": "#7ba1d91c-3934-4d5a-8532-b32f864ad34c", "rel": "reference" }, { "href": "#77faf0bc-c394-44ad-9154-bbac3b79c8ad", "rel": "reference" }, { "href": "#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "rel": "reference" }, { "href": "#4895b4cd-34c5-4667-bf8a-27d443c12047", "rel": "reference" }, { "href": "#858705be-3c1f-48aa-a328-0ce398d95ef0", "rel": "reference" }, { "href": "#067223d8-1ec7-45c5-b21b-c848da6de8fb", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#e8e84963-14fc-4c3a-be05-b412a5d37cd2", "rel": "reference" }, { "href": "#15dc76ff-b17a-4eeb-8948-8ea8de3ccc2c", "rel": "reference" }, { "href": "#e24b06cc-9129-4998-a76a-65c3d7a576ba", "rel": "reference" }, { "href": "#4b38e961-1125-4a5b-aa35-1d6c02846dad", "rel": "reference" }, { "href": "#604774da-9e1d-48eb-9c62-4e959dc80737", "rel": "reference" }, { "href": "#98d415ca-7281-4064-9931-0c366637e324", "rel": "reference" }, { "href": "#795aff72-3e6c-4b6b-a80a-b14d84b7f544", "rel": "reference" }, { "href": "#3d575737-98cb-459d-b41c-d7e82b73ad78", "rel": "reference" }, { "href": "#cm-6", "rel": "related" }, { "href": "#cm-8", "rel": "related" }, { "href": "#ps-7", "rel": "related" }, { "href": "#sa-3", "rel": "related" }, { "href": "#sa-5", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-11", "rel": "related" }, { "href": "#sa-15", "rel": "related" }, { "href": "#sa-16", "rel": "related" }, { "href": "#sa-17", "rel": "related" }, { "href": "#sa-21", "rel": "related" }, { "href": "#sr-3", "rel": "related" }, { "href": "#sr-5", "rel": "related" } ], "parts": [ { "id": "sa-4_smt", "name": "statement", "prose": "Include the following requirements, descriptions, and criteria, explicitly or by reference, using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service:", "parts": [ { "id": "sa-4_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Security and privacy functional requirements;" }, { "id": "sa-4_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Strength of mechanism requirements;" }, { "id": "sa-4_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Security and privacy assurance requirements;" }, { "id": "sa-4_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Controls needed to satisfy the security and privacy requirements." }, { "id": "sa-4_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Security and privacy documentation requirements;" }, { "id": "sa-4_smt.f", "name": "item", "props": [ { "name": "label", "value": "f." } ], "prose": "Requirements for protecting security and privacy documentation;" }, { "id": "sa-4_smt.g", "name": "item", "props": [ { "name": "label", "value": "g." } ], "prose": "Description of the system development environment and environment in which the system is intended to operate;" }, { "id": "sa-4_smt.h", "name": "item", "props": [ { "name": "label", "value": "h." } ], "prose": "Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and" }, { "id": "sa-4_smt.i", "name": "item", "props": [ { "name": "label", "value": "i." } ], "prose": "Acceptance criteria." } ] }, { "id": "sa-4_gdn", "name": "guidance", "prose": "Security and privacy functional requirements are typically derived from the high-level security and privacy requirements described in [SA-2](#sa-2) . The derived requirements include security and privacy capabilities, functions, and mechanisms. Strength requirements associated with such capabilities, functions, and mechanisms include degree of correctness, completeness, resistance to tampering or bypass, and resistance to direct attack. Assurance requirements include development processes, procedures, and methodologies as well as the evidence from development and assessment activities that provide grounds for confidence that the required functionality is implemented and possesses the required strength of mechanism. [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) describes the process of requirements engineering as part of the system development life cycle.\n\nControls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization and for reflecting the security and privacy requirements of stakeholders. Controls are selected and implemented in order to satisfy system requirements and include developer and organizational responsibilities. Controls can include technical, administrative, and physical aspects. In some cases, the selection and implementation of a control may necessitate additional specification by the organization in the form of derived requirements or instantiated control parameter values. The derived requirements and control parameter values may be necessary to provide the appropriate level of implementation detail for controls within the system development life cycle.\n\nSecurity and privacy documentation requirements address all stages of the system development life cycle. Documentation provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation is based on the security categorization or classification level of the system and the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement.\n\nOrganizations can determine other requirements that support security and operations, to include responsibilities for the organization and developer, and notification and timing requirements for support, maintenance and updates." }, { "id": "sa-4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04", "class": "sp800-53a" } ], "parts": [ { "id": "sa-4_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04a.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-4_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04a.[01]", "class": "sp800-53a" } ], "prose": "security functional requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04a.[02]", "class": "sp800-53a" } ], "prose": "privacy functional requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-4_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04b.", "class": "sp800-53a" } ], "prose": "strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.b", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04c.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-4_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04c.[01]", "class": "sp800-53a" } ], "prose": "security assurance requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.c", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04c.[02]", "class": "sp800-53a" } ], "prose": "privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-4_smt.c", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04d.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-4_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04d.[01]", "class": "sp800-53a" } ], "prose": "controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.d", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04d.[02]", "class": "sp800-53a" } ], "prose": "controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-4_smt.d", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04e.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-4_obj.e-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04e.[01]", "class": "sp800-53a" } ], "prose": "security documentation requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.e", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.e-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04e.[02]", "class": "sp800-53a" } ], "prose": "privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-4_smt.e", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.f", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04f.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-4_obj.f-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04f.[01]", "class": "sp800-53a" } ], "prose": "requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.f", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.f-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04f.[02]", "class": "sp800-53a" } ], "prose": "requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.f", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-4_smt.f", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.g", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04g.", "class": "sp800-53a" } ], "prose": "the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.g", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.h", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04h.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-4_obj.h-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04h.[01]", "class": "sp800-53a" } ], "prose": "the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service;", "links": [ { "href": "#sa-4_smt.h", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.h-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04h.[02]", "class": "sp800-53a" } ], "prose": "the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }};", "links": [ { "href": "#sa-4_smt.h", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.h-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04h.[03]", "class": "sp800-53a" } ], "prose": "the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }};", "links": [ { "href": "#sa-4_smt.h", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-4_smt.h", "rel": "assessment-for" } ] }, { "id": "sa-4_obj.i", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-04i.", "class": "sp800-53a" } ], "prose": "acceptance criteria requirements and descriptions are included explicitly or by reference using {{ insert: param, sa-04_odp.01 }} in the acquisition contract for the system, system component, or system service.", "links": [ { "href": "#sa-4_smt.i", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-4_smt", "rel": "assessment-for" } ] }, { "id": "sa-4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SA-04-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and services acquisition policy\n\nsystem and services acquisition procedures\n\nprocedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process\n\nconfiguration management plan\n\nacquisition contracts for the system, system component, or system service\n\nsystem design documentation\n\nsystem security plan\n\nsupply chain risk management plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "sa-4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SA-04-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with acquisition/contracting responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nsystem/network administrators\n\norganizational personnel with supply chain risk management responsibilities" } ] }, { "id": "sa-4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SA-04-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for determining system security and privacy functional, strength, and assurance requirements\n\norganizational processes for developing acquisition contracts\n\nmechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts" } ] } ] }, { "id": "sa-8.33", "class": "SP800-53-enhancement", "title": "Minimization", "params": [ { "id": "sa-08.33_odp", "props": [ { "name": "alt-identifier", "value": "sa-8.33_prm_1" }, { "name": "label", "value": "SA-08(33)_ODP", "class": "sp800-53a" } ], "label": "processes", "guidelines": [ { "prose": "processes that implement the privacy principle of minimization are defined;" } ] } ], "props": [ { "name": "label", "value": "SA-08(33)", "class": "zero-padded" }, { "name": "label", "value": "SA-8(33)" }, { "name": "label", "value": "SA-08(33)", "class": "sp800-53a" }, { "name": "sort-id", "value": "sa-08.33" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "system" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#sa-8", "rel": "required" }, { "href": "#pe-8", "rel": "related" }, { "href": "#pm-25", "rel": "related" }, { "href": "#sc-42", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "sa-8.33_smt", "name": "statement", "prose": "Implement the privacy principle of minimization using {{ insert: param, sa-08.33_odp }}." }, { "id": "sa-8.33_gdn", "name": "guidance", "prose": "The principle of minimization states that organizations should only process personally identifiable information that is directly relevant and necessary to accomplish an authorized purpose and should only maintain personally identifiable information for as long as is necessary to accomplish the purpose. Organizations have processes in place, consistent with applicable laws and policies, to implement the principle of minimization." }, { "id": "sa-8.33_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-08(33)", "class": "sp800-53a" } ], "prose": "the privacy principle of minimization is implemented using {{ insert: param, sa-08.33_odp }}.", "links": [ { "href": "#sa-8.33_smt", "rel": "assessment-for" } ] }, { "id": "sa-8.33_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SA-08(33)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and services acquisition policy\n\nsystem and services acquisition procedures\n\npersonally identifiable information processing policy\n\nprocedures addressing the minimization of personally identifiable information in system design\n\nsystem design documentation\n\nsystem configuration settings and associated documentation\n\nchange control records\n\ninformation security and privacy requirements and specifications for the system\n\nsystem security and privacy architecture\n\nsystem security plan\n\nprivacy plan\n\nprivacy impact assessment\n\nprivacy risk assessment documentation\n\nother relevant documents or records" } ] }, { "id": "sa-8.33_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SA-08(33)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy responsibilities\n\norganizational personnel with system specification, design, development, implementation, and modification responsibilities\n\nsystem developers" } ] }, { "id": "sa-8.33_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SA-08(33)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for applying the privacy design principle of minimization in system specification, design, development, implementation, and modification\n\nmechanisms supporting the application of the security design principle of sufficient documentation in system specification, design, development, implementation, and modification\n\nmechanisms that enforce security and privacy policy\n\norganizational processes for managing change configuration\n\nmechanisms supporting configuration control" } ] } ] }, { "id": "sa-9", "class": "SP800-53", "title": "External System Services", "params": [ { "id": "sa-09_odp.01", "props": [ { "name": "alt-identifier", "value": "sa-9_prm_1" }, { "name": "label", "value": "SA-09_ODP[01]", "class": "sp800-53a" } ], "label": "controls", "guidelines": [ { "prose": "controls to be employed by external system service providers are defined;" } ] }, { "id": "sa-09_odp.02", "props": [ { "name": "alt-identifier", "value": "sa-9_prm_2" }, { "name": "label", "value": "SA-09_ODP[02]", "class": "sp800-53a" } ], "label": "processes, methods, and techniques", "guidelines": [ { "prose": "processes, methods, and techniques employed to monitor control compliance by external service providers are defined;" } ] } ], "props": [ { "name": "label", "value": "SA-09", "class": "zero-padded" }, { "name": "label", "value": "SA-9" }, { "name": "label", "value": "SA-09", "class": "sp800-53a" }, { "name": "sort-id", "value": "sa-09" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#77faf0bc-c394-44ad-9154-bbac3b79c8ad", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#e8e84963-14fc-4c3a-be05-b412a5d37cd2", "rel": "reference" }, { "href": "#7dbd6d9f-29d6-4d1d-9766-f2d77ff3c849", "rel": "reference" }, { "href": "#ac-20", "rel": "related" }, { "href": "#ca-3", "rel": "related" }, { "href": "#cp-2", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-7", "rel": "related" }, { "href": "#pl-10", "rel": "related" }, { "href": "#pl-11", "rel": "related" }, { "href": "#ps-7", "rel": "related" }, { "href": "#sa-2", "rel": "related" }, { "href": "#sa-4", "rel": "related" }, { "href": "#sr-3", "rel": "related" }, { "href": "#sr-5", "rel": "related" } ], "parts": [ { "id": "sa-9_smt", "name": "statement", "parts": [ { "id": "sa-9_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: {{ insert: param, sa-09_odp.01 }};" }, { "id": "sa-9_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Define and document organizational oversight and user roles and responsibilities with regard to external system services; and" }, { "id": "sa-9_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: {{ insert: param, sa-09_odp.02 }}." } ] }, { "id": "sa-9_gdn", "name": "guidance", "prose": "External system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a certain level of confidence that each provider in the consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust vary based on relationships between organizations and the external providers. Organizations document the basis for the trust relationships so that the relationships can be monitored. External system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define the expectations of performance for implemented controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance." }, { "id": "sa-9_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-09", "class": "sp800-53a" } ], "parts": [ { "id": "sa-9_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-09a.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-9_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-09a.[01]", "class": "sp800-53a" } ], "prose": "providers of external system services comply with organizational security requirements;", "links": [ { "href": "#sa-9_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-9_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-09a.[02]", "class": "sp800-53a" } ], "prose": "providers of external system services comply with organizational privacy requirements;", "links": [ { "href": "#sa-9_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-9_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-09a.[03]", "class": "sp800-53a" } ], "prose": "providers of external system services employ {{ insert: param, sa-09_odp.01 }};", "links": [ { "href": "#sa-9_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-9_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-9_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-09b.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-9_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-09b.[01]", "class": "sp800-53a" } ], "prose": "organizational oversight with regard to external system services are defined and documented;", "links": [ { "href": "#sa-9_smt.b", "rel": "assessment-for" } ] }, { "id": "sa-9_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-09b.[02]", "class": "sp800-53a" } ], "prose": "user roles and responsibilities with regard to external system services are defined and documented;", "links": [ { "href": "#sa-9_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-9_smt.b", "rel": "assessment-for" } ] }, { "id": "sa-9_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-09c.", "class": "sp800-53a" } ], "prose": " {{ insert: param, sa-09_odp.02 }} are employed to monitor control compliance by external service providers on an ongoing basis.", "links": [ { "href": "#sa-9_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-9_smt", "rel": "assessment-for" } ] }, { "id": "sa-9_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SA-09-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and services acquisition policy\n\nsystem and services acquisition procedures\n\nprocedures addressing methods and techniques for monitoring control compliance by external service providers of system services\n\nacquisition documentation\n\ncontracts\n\nservice level agreements\n\ninteragency agreements\n\nlicensing agreements\n\nlist of organizational security and privacy requirements for external provider services\n\ncontrol assessment results or reports from external providers of system services\n\nsystem security plan\n\nprivacy plan\n\nsupply chain risk management plan\n\nother relevant documents or records" } ] }, { "id": "sa-9_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SA-09-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with acquisition responsibilities\n\nexternal providers of system services\n\norganizational personnel with information security and privacy responsibilities\n\norganizational personnel with supply chain risk management responsibilities" } ] }, { "id": "sa-9_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SA-09-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for monitoring security and privacy control compliance by external service providers on an ongoing basis\n\nmechanisms for monitoring security and privacy control compliance by external service providers on an ongoing basis" } ] } ] }, { "id": "sa-11", "class": "SP800-53", "title": "Developer Testing and Evaluation", "params": [ { "id": "sa-11_odp.01", "props": [ { "name": "alt-identifier", "value": "sa-11_prm_1" }, { "name": "label", "value": "SA-11_ODP[01]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "unit", "integration", "system", "regression" ] } }, { "id": "sa-11_odp.02", "props": [ { "name": "alt-identifier", "value": "sa-11_prm_2" }, { "name": "alt-label", "value": "frequency", "class": "sp800-53" }, { "name": "label", "value": "SA-11_ODP[02]", "class": "sp800-53a" } ], "label": "frequency to conduct", "guidelines": [ { "prose": "frequency at which to conduct {{ insert: param, sa-11_odp.01 }} testing/evaluation is defined;" } ] }, { "id": "sa-11_odp.03", "props": [ { "name": "alt-identifier", "value": "sa-11_prm_3" }, { "name": "label", "value": "SA-11_ODP[03]", "class": "sp800-53a" } ], "label": "depth and coverage", "guidelines": [ { "prose": "depth and coverage of {{ insert: param, sa-11_odp.01 }} testing/evaluation is defined;" } ] } ], "props": [ { "name": "label", "value": "SA-11", "class": "zero-padded" }, { "name": "label", "value": "SA-11" }, { "name": "label", "value": "SA-11", "class": "sp800-53a" }, { "name": "sort-id", "value": "sa-11" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#4452efc0-e79e-47b8-aa30-b54f3ef61c2f", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#a21aef46-7330-48a0-b2e1-c5bb8b2dd11d", "rel": "reference" }, { "href": "#708b94e1-3d5e-4b22-ab43-1c69f3a97e37", "rel": "reference" }, { "href": "#e3cc0520-a366-4fc9-abc2-5272db7e3564", "rel": "reference" }, { "href": "#ca-2", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#cm-4", "rel": "related" }, { "href": "#sa-3", "rel": "related" }, { "href": "#sa-4", "rel": "related" }, { "href": "#sa-5", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-15", "rel": "related" }, { "href": "#sa-17", "rel": "related" }, { "href": "#si-2", "rel": "related" }, { "href": "#sr-5", "rel": "related" }, { "href": "#sr-6", "rel": "related" }, { "href": "#sr-7", "rel": "related" } ], "parts": [ { "id": "sa-11_smt", "name": "statement", "prose": "Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:", "parts": [ { "id": "sa-11_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop and implement a plan for ongoing security and privacy control assessments;" }, { "id": "sa-11_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Perform {{ insert: param, sa-11_odp.01 }} testing/evaluation {{ insert: param, sa-11_odp.02 }} at {{ insert: param, sa-11_odp.03 }};" }, { "id": "sa-11_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;" }, { "id": "sa-11_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Implement a verifiable flaw remediation process; and" }, { "id": "sa-11_smt.e", "name": "item", "props": [ { "name": "label", "value": "e." } ], "prose": "Correct flaws identified during testing and evaluation." } ] }, { "id": "sa-11_gdn", "name": "guidance", "prose": "Developmental testing and evaluation confirms that the required controls are implemented correctly, operating as intended, enforcing the desired security and privacy policies, and meeting established security and privacy requirements. Security properties of systems and the privacy of individuals may be affected by the interconnection of system components or changes to those components. The interconnections or changes—including upgrading or replacing applications, operating systems, and firmware—may adversely affect previously implemented controls. Ongoing assessment during development allows for additional types of testing and evaluation that developers can conduct to reduce or eliminate potential flaws. Testing custom software applications may require approaches such as manual code review, security architecture review, and penetration testing, as well as and static analysis, dynamic analysis, binary analysis, or a hybrid of the three analysis approaches.\n\nDevelopers can use the analysis approaches, along with security instrumentation and fuzzing, in a variety of tools and in source code reviews. The security and privacy assessment plans include the specific activities that developers plan to carry out, including the types of analyses, testing, evaluation, and reviews of software and firmware components; the degree of rigor to be applied; the frequency of the ongoing testing and evaluation; and the types of artifacts produced during those processes. The depth of testing and evaluation refers to the rigor and level of detail associated with the assessment process. The coverage of testing and evaluation refers to the scope (i.e., number and type) of the artifacts included in the assessment process. Contracts specify the acceptance criteria for security and privacy assessment plans, flaw remediation processes, and the evidence that the plans and processes have been diligently applied. Methods for reviewing and protecting assessment plans, evidence, and documentation are commensurate with the security category or classification level of the system. Contracts may specify protection requirements for documentation." }, { "id": "sa-11_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11", "class": "sp800-53a" } ], "parts": [ { "id": "sa-11_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11a.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-11_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11a.[01]", "class": "sp800-53a" } ], "prose": "the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments;", "links": [ { "href": "#sa-11_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-11_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11a.[02]", "class": "sp800-53a" } ], "prose": "the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments;", "links": [ { "href": "#sa-11_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-11_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11a.[03]", "class": "sp800-53a" } ], "prose": "the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments;", "links": [ { "href": "#sa-11_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-11_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11a.[04]", "class": "sp800-53a" } ], "prose": "the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments;", "links": [ { "href": "#sa-11_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-11_smt.a", "rel": "assessment-for" } ] }, { "id": "sa-11_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11b.", "class": "sp800-53a" } ], "prose": "the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform {{ insert: param, sa-11_odp.01 }} testing/evaluation {{ insert: param, sa-11_odp.02 }} at {{ insert: param, sa-11_odp.03 }};", "links": [ { "href": "#sa-11_smt.b", "rel": "assessment-for" } ] }, { "id": "sa-11_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11c.", "class": "sp800-53a" } ], "parts": [ { "id": "sa-11_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11c.[01]", "class": "sp800-53a" } ], "prose": "the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce evidence of the execution of the assessment plan;", "links": [ { "href": "#sa-11_smt.c", "rel": "assessment-for" } ] }, { "id": "sa-11_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11c.[02]", "class": "sp800-53a" } ], "prose": "the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce the results of the testing and evaluation;", "links": [ { "href": "#sa-11_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-11_smt.c", "rel": "assessment-for" } ] }, { "id": "sa-11_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11d.", "class": "sp800-53a" } ], "prose": "the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a verifiable flaw remediation process;", "links": [ { "href": "#sa-11_smt.d", "rel": "assessment-for" } ] }, { "id": "sa-11_obj.e", "name": "assessment-objective", "props": [ { "name": "label", "value": "SA-11e.", "class": "sp800-53a" } ], "prose": "the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to correct flaws identified during testing and evaluation.", "links": [ { "href": "#sa-11_smt.e", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sa-11_smt", "rel": "assessment-for" } ] }, { "id": "sa-11_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SA-11-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and services acquisition policy\n\nsystem and services acquisition procedures\n\nprocedures addressing system developer security and privacy testing\n\nprocedures addressing flaw remediation\n\nsolicitation documentation\n\nacquisition documentation\n\nservice level agreements\n\nacquisition contracts for the system, system component, or system service\n\nsecurity and privacy architecture\n\nsystem design documentation\n\nsystem developer security and privacy assessment plans\n\nresults of developer security and privacy assessments for the system, system component, or system service\n\nsecurity and privacy flaw and remediation tracking records\n\nsystem security plan\n\nprivacy plan\n\nprivacy impact assessment\n\nprivacy risk assessment documentation\n\nother relevant documents or records" } ] }, { "id": "sa-11_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SA-11-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system and service acquisition responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\norganizational personnel with developer security and privacy testing responsibilities\n\nsystem developers" } ] }, { "id": "sa-11_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SA-11-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for monitoring developer security testing and evaluation\n\nmechanisms supporting and/or implementing the monitoring of developer security and privacy testing and evaluation" } ] } ] } ] }, { "id": "sc", "class": "family", "title": "System and Communications Protection", "props": [ { "name": "label", "value": "SC" } ], "controls": [ { "id": "sc-7.24", "class": "SP800-53-enhancement", "title": "Personally Identifiable Information", "params": [ { "id": "sc-07.24_odp", "props": [ { "name": "alt-identifier", "value": "sc-7.24_prm_1" }, { "name": "label", "value": "SC-07(24)_ODP", "class": "sp800-53a" } ], "label": "processing rules", "guidelines": [ { "prose": "processing rules for systems that process personally identifiable information are defined;" } ] } ], "props": [ { "name": "label", "value": "SC-07(24)", "class": "zero-padded" }, { "name": "label", "value": "SC-7(24)" }, { "name": "label", "value": "SC-07(24)", "class": "sp800-53a" }, { "name": "sort-id", "value": "sc-07.24" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "system" } ], "links": [ { "href": "#sc-7", "rel": "required" }, { "href": "#pt-2", "rel": "related" }, { "href": "#si-15", "rel": "related" } ], "parts": [ { "id": "sc-7.24_smt", "name": "statement", "prose": "For systems that process personally identifiable information:", "parts": [ { "id": "sc-7.24_smt.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Apply the following processing rules to data elements of personally identifiable information: {{ insert: param, sc-07.24_odp }};" }, { "id": "sc-7.24_smt.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system;" }, { "id": "sc-7.24_smt.c", "name": "item", "props": [ { "name": "label", "value": "(c)" } ], "prose": "Document each processing exception; and" }, { "id": "sc-7.24_smt.d", "name": "item", "props": [ { "name": "label", "value": "(d)" } ], "prose": "Review and remove exceptions that are no longer supported." } ] }, { "id": "sc-7.24_gdn", "name": "guidance", "prose": "Managing the processing of personally identifiable information is an important aspect of protecting an individual’s privacy. Applying, monitoring for, and documenting exceptions to processing rules ensure that personally identifiable information is processed only in accordance with established privacy requirements." }, { "id": "sc-7.24_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SC-07(24)", "class": "sp800-53a" } ], "parts": [ { "id": "sc-7.24_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SC-07(24)(a)", "class": "sp800-53a" } ], "prose": " {{ insert: param, sc-07.24_odp }} are applied to data elements of personally identifiable information on systems that process personally identifiable information;", "links": [ { "href": "#sc-7.24_smt.a", "rel": "assessment-for" } ] }, { "id": "sc-7.24_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SC-07(24)(b)", "class": "sp800-53a" } ], "parts": [ { "id": "sc-7.24_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SC-07(24)(b)[01]", "class": "sp800-53a" } ], "prose": "permitted processing is monitored at the external interfaces to the systems that process personally identifiable information;", "links": [ { "href": "#sc-7.24_smt.b", "rel": "assessment-for" } ] }, { "id": "sc-7.24_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SC-07(24)(b)[02]", "class": "sp800-53a" } ], "prose": "permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information;", "links": [ { "href": "#sc-7.24_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sc-7.24_smt.b", "rel": "assessment-for" } ] }, { "id": "sc-7.24_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "SC-07(24)(c)", "class": "sp800-53a" } ], "prose": "each processing exception is documented for systems that process personally identifiable information;", "links": [ { "href": "#sc-7.24_smt.c", "rel": "assessment-for" } ] }, { "id": "sc-7.24_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "SC-07(24)(d)", "class": "sp800-53a" } ], "parts": [ { "id": "sc-7.24_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SC-07(24)(d)[01]", "class": "sp800-53a" } ], "prose": "exceptions for systems that process personally identifiable information are reviewed;", "links": [ { "href": "#sc-7.24_smt.d", "rel": "assessment-for" } ] }, { "id": "sc-7.24_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SC-07(24)(d)[02]", "class": "sp800-53a" } ], "prose": "exceptions for systems that process personally identifiable information that are no longer supported are removed.", "links": [ { "href": "#sc-7.24_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sc-7.24_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#sc-7.24_smt", "rel": "assessment-for" } ] }, { "id": "sc-7.24_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SC-07(24)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and communications protection policy\n\nprocedures addressing boundary protection\n\npersonally identifiable information processing policies\n\nlist of key internal boundaries of the system\n\nsystem design documentation\n\nsystem configuration settings and associated documentation\n\nenterprise security and privacy architecture documentation\n\nsystem audit records\n\nsystem security plan\n\nprivacy plan\n\npersonally identifiable information inventory documentation\n\ndata mapping documentation\n\nother relevant documents or records" } ] }, { "id": "sc-7.24_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SC-07(24)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System/network administrators\n\norganizational personnel with information security and privacy responsibilities\n\nsystem developer\n\norganizational personnel with boundary protection responsibilities" } ] }, { "id": "sc-7.24_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SC-07(24)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms implementing boundary protection capabilities" } ] } ] } ] }, { "id": "si", "class": "family", "title": "System and Information Integrity", "props": [ { "name": "label", "value": "SI" } ], "controls": [ { "id": "si-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "si-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "si-01_odp.01", "props": [ { "name": "label", "value": "SI-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the system and information integrity policy is to be disseminated is/are defined;" } ] }, { "id": "si-01_odp.02", "props": [ { "name": "label", "value": "SI-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the system and information integrity procedures are to be disseminated is/are defined;" } ] }, { "id": "si-01_odp.03", "props": [ { "name": "alt-identifier", "value": "si-1_prm_2" }, { "name": "label", "value": "SI-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "si-01_odp.04", "props": [ { "name": "alt-identifier", "value": "si-1_prm_3" }, { "name": "label", "value": "SI-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the system and information integrity policy and procedures is defined;" } ] }, { "id": "si-01_odp.05", "props": [ { "name": "alt-identifier", "value": "si-1_prm_4" }, { "name": "label", "value": "SI-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current system and information integrity policy is reviewed and updated is defined;" } ] }, { "id": "si-01_odp.06", "props": [ { "name": "alt-identifier", "value": "si-1_prm_5" }, { "name": "label", "value": "SI-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current system and information integrity policy to be reviewed and updated are defined;" } ] }, { "id": "si-01_odp.07", "props": [ { "name": "alt-identifier", "value": "si-1_prm_6" }, { "name": "label", "value": "SI-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current system and information integrity procedures are reviewed and updated is defined;" } ] }, { "id": "si-01_odp.08", "props": [ { "name": "alt-identifier", "value": "si-1_prm_7" }, { "name": "label", "value": "SI-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the system and information integrity procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "SI-01", "class": "zero-padded" }, { "name": "label", "value": "SI-1" }, { "name": "label", "value": "SI-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "si-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "si-1_smt", "name": "statement", "parts": [ { "id": "si-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, si-1_prm_1 }}:", "parts": [ { "id": "si-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": " {{ insert: param, si-01_odp.03 }} system and information integrity policy that:", "parts": [ { "id": "si-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "si-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "si-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;" } ] }, { "id": "si-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, si-01_odp.04 }} to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and" }, { "id": "si-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current system and information integrity:", "parts": [ { "id": "si-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, si-01_odp.05 }} and following {{ insert: param, si-01_odp.06 }} ; and" }, { "id": "si-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, si-01_odp.07 }} and following {{ insert: param, si-01_odp.08 }}." } ] } ] }, { "id": "si-1_gdn", "name": "guidance", "prose": "System and information integrity policy and procedures address the controls in the SI family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of system and information integrity policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to system and information integrity policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "si-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01", "class": "sp800-53a" } ], "parts": [ { "id": "si-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "si-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.[01]", "class": "sp800-53a" } ], "prose": "a system and information integrity policy is developed and documented;", "links": [ { "href": "#si-1_smt.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.[02]", "class": "sp800-53a" } ], "prose": "the system and information integrity policy is disseminated to {{ insert: param, si-01_odp.01 }};", "links": [ { "href": "#si-1_smt.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.[03]", "class": "sp800-53a" } ], "prose": "system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented;", "links": [ { "href": "#si-1_smt.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.[04]", "class": "sp800-53a" } ], "prose": "the system and information integrity procedures are disseminated to {{ insert: param, si-01_odp.02 }};", "links": [ { "href": "#si-1_smt.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "si-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "si-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, si-01_odp.03 }} system and information integrity policy addresses purpose;", "links": [ { "href": "#si-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, si-01_odp.03 }} system and information integrity policy addresses scope;", "links": [ { "href": "#si-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, si-01_odp.03 }} system and information integrity policy addresses roles;", "links": [ { "href": "#si-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, si-01_odp.03 }} system and information integrity policy addresses responsibilities;", "links": [ { "href": "#si-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, si-01_odp.03 }} system and information integrity policy addresses management commitment;", "links": [ { "href": "#si-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, si-01_odp.03 }} system and information integrity policy addresses coordination among organizational entities;", "links": [ { "href": "#si-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, si-01_odp.03 }} system and information integrity policy addresses compliance;", "links": [ { "href": "#si-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, si-01_odp.03 }} system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#si-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-1_smt.a", "rel": "assessment-for" } ] }, { "id": "si-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, si-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures;", "links": [ { "href": "#si-1_smt.b", "rel": "assessment-for" } ] }, { "id": "si-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "si-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "si-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current system and information integrity policy is reviewed and updated {{ insert: param, si-01_odp.05 }};", "links": [ { "href": "#si-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "si-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current system and information integrity policy is reviewed and updated following {{ insert: param, si-01_odp.06 }};", "links": [ { "href": "#si-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "si-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "si-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current system and information integrity procedures are reviewed and updated {{ insert: param, si-01_odp.07 }};", "links": [ { "href": "#si-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "si-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current system and information integrity procedures are reviewed and updated following {{ insert: param, si-01_odp.08 }}.", "links": [ { "href": "#si-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-1_smt", "rel": "assessment-for" } ] }, { "id": "si-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SI-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and information integrity policy\n\nsystem and information integrity procedures\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "si-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SI-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system and information integrity responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "si-12", "class": "SP800-53", "title": "Information Management and Retention", "props": [ { "name": "label", "value": "SI-12", "class": "zero-padded" }, { "name": "label", "value": "SI-12" }, { "name": "label", "value": "SI-12", "class": "sp800-53a" }, { "name": "sort-id", "value": "si-12" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#e922fc50-b1f9-469f-92ef-ed7d9803611c", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#ac-16", "rel": "related" }, { "href": "#au-5", "rel": "related" }, { "href": "#au-11", "rel": "related" }, { "href": "#ca-2", "rel": "related" }, { "href": "#ca-3", "rel": "related" }, { "href": "#ca-5", "rel": "related" }, { "href": "#ca-6", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#ca-9", "rel": "related" }, { "href": "#cm-5", "rel": "related" }, { "href": "#cm-9", "rel": "related" }, { "href": "#cp-2", "rel": "related" }, { "href": "#ir-8", "rel": "related" }, { "href": "#mp-2", "rel": "related" }, { "href": "#mp-3", "rel": "related" }, { "href": "#mp-4", "rel": "related" }, { "href": "#mp-6", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#pl-4", "rel": "related" }, { "href": "#pm-4", "rel": "related" }, { "href": "#pm-8", "rel": "related" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-2", "rel": "related" }, { "href": "#ps-6", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#ra-2", "rel": "related" }, { "href": "#ra-3", "rel": "related" }, { "href": "#sa-5", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sr-2", "rel": "related" } ], "parts": [ { "id": "si-12_smt", "name": "statement", "prose": "Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements." }, { "id": "si-12_gdn", "name": "guidance", "prose": "Information management and retention requirements cover the full life cycle of information, in some cases extending beyond system disposal. Information to be retained may also include policies, procedures, plans, reports, data output from control implementation, and other types of administrative information. The National Archives and Records Administration (NARA) provides federal policy and guidance on records retention and schedules. If organizations have a records management office, consider coordinating with records management personnel. Records produced from the output of implemented controls that may require management and retention include, but are not limited to: All XX-1, [AC-6(9)](#ac-6.9), [AT-4](#at-4), [AU-12](#au-12), [CA-2](#ca-2), [CA-3](#ca-3), [CA-5](#ca-5), [CA-6](#ca-6), [CA-7](#ca-7), [CA-8](#ca-8), [CA-9](#ca-9), [CM-2](#cm-2), [CM-3](#cm-3), [CM-4](#cm-4), [CM-6](#cm-6), [CM-8](#cm-8), [CM-9](#cm-9), [CM-12](#cm-12), [CM-13](#cm-13), [CP-2](#cp-2), [IR-6](#ir-6), [IR-8](#ir-8), [MA-2](#ma-2), [MA-4](#ma-4), [PE-2](#pe-2), [PE-8](#pe-8), [PE-16](#pe-16), [PE-17](#pe-17), [PL-2](#pl-2), [PL-4](#pl-4), [PL-7](#pl-7), [PL-8](#pl-8), [PM-5](#pm-5), [PM-8](#pm-8), [PM-9](#pm-9), [PM-18](#pm-18), [PM-21](#pm-21), [PM-27](#pm-27), [PM-28](#pm-28), [PM-30](#pm-30), [PM-31](#pm-31), [PS-2](#ps-2), [PS-6](#ps-6), [PS-7](#ps-7), [PT-2](#pt-2), [PT-3](#pt-3), [PT-7](#pt-7), [RA-2](#ra-2), [RA-3](#ra-3), [RA-5](#ra-5), [RA-8](#ra-8), [SA-4](#sa-4), [SA-5](#sa-5), [SA-8](#sa-8), [SA-10](#sa-10), [SI-4](#si-4), [SR-2](#sr-2), [SR-4](#sr-4), [SR-8](#sr-8)." }, { "id": "si-12_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12", "class": "sp800-53a" } ], "parts": [ { "id": "si-12_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12[01]", "class": "sp800-53a" } ], "prose": "information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;", "links": [ { "href": "#si-12_smt", "rel": "assessment-for" } ] }, { "id": "si-12_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12[02]", "class": "sp800-53a" } ], "prose": "information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;", "links": [ { "href": "#si-12_smt", "rel": "assessment-for" } ] }, { "id": "si-12_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12[03]", "class": "sp800-53a" } ], "prose": "information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;", "links": [ { "href": "#si-12_smt", "rel": "assessment-for" } ] }, { "id": "si-12_obj-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12[04]", "class": "sp800-53a" } ], "prose": "information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.", "links": [ { "href": "#si-12_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-12_smt", "rel": "assessment-for" } ] }, { "id": "si-12_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SI-12-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and information integrity policy\n\nsystem and information integrity procedures\n\npersonally identifiable information processing policy\n\nrecords retention and disposition policy\n\nrecords retention and disposition procedures\n\nfederal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information management and retention\n\nmedia protection policy\n\nmedia protection procedures\n\naudit findings\n\nsystem security plan\n\nprivacy plan\n\nprivacy program plan\n\npersonally identifiable information inventory\n\nprivacy impact assessment\n\nprivacy risk assessment documentation\n\nother relevant documents or records" } ] }, { "id": "si-12_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SI-12-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information and records management, retention, and disposition responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nnetwork administrators" } ] }, { "id": "si-12_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SI-12-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for information management, retention, and disposition\n\nautomated mechanisms supporting and/or implementing information management, retention, and disposition" } ] } ], "controls": [ { "id": "si-12.1", "class": "SP800-53-enhancement", "title": "Limit Personally Identifiable Information Elements", "params": [ { "id": "si-12.01_odp", "props": [ { "name": "alt-identifier", "value": "si-12.1_prm_1" }, { "name": "label", "value": "SI-12(01)_ODP", "class": "sp800-53a" } ], "label": "elements of personally identifiable information", "guidelines": [ { "prose": "elements of personally identifiable information being processed in the information life cycle are defined;" } ] } ], "props": [ { "name": "label", "value": "SI-12(01)", "class": "zero-padded" }, { "name": "label", "value": "SI-12(1)" }, { "name": "label", "value": "SI-12(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "si-12.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#si-12", "rel": "required" }, { "href": "#pm-25", "rel": "related" } ], "parts": [ { "id": "si-12.1_smt", "name": "statement", "prose": "Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: {{ insert: param, si-12.01_odp }}." }, { "id": "si-12.1_gdn", "name": "guidance", "prose": "Limiting the use of personally identifiable information throughout the information life cycle when the information is not needed for operational purposes helps to reduce the level of privacy risk created by a system. The information life cycle includes information creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition. Risk assessments as well as applicable laws, regulations, and policies can provide useful inputs to determining which elements of personally identifiable information may create risk." }, { "id": "si-12.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12(01)", "class": "sp800-53a" } ], "prose": "personally identifiable information being processed in the information life cycle is limited to {{ insert: param, si-12.01_odp }}.", "links": [ { "href": "#si-12.1_smt", "rel": "assessment-for" } ] }, { "id": "si-12.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SI-12(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and information integrity policy\n\nsystem and information integrity procedures\n\npersonally identifiable information processing policy\n\npersonally identifiable information processing procedures\n\nrecords retention and disposition policy\n\nrecords retention and disposition procedures\n\nfederal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to limiting personally identifiable information elements\n\npersonally identifiable information inventory\n\nsystem audit records\n\naudit findings\n\nsystem security plan\n\nprivacy plan\n\nprivacy program plan\n\nprivacy impact assessment\n\nprivacy risk assessment documentation\n\ndata mapping documentation\n\nother relevant documents or records" } ] }, { "id": "si-12.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SI-12(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information and records management, retention, and disposition responsibilities\n\norganizational personnel with security and privacy responsibilities\n\nnetwork administrators" } ] }, { "id": "si-12.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SI-12(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for information management and retention (including limiting personally identifiable information processing)\n\nautomated mechanisms supporting and/or implementing limits to personally identifiable information processing" } ] } ] }, { "id": "si-12.2", "class": "SP800-53-enhancement", "title": "Minimize Personally Identifiable Information in Testing, Training, and Research", "params": [ { "id": "si-12.2_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-12.02_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-12.02_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-12.02_odp.03" } ], "label": "organization-defined techniques" }, { "id": "si-12.02_odp.01", "props": [ { "name": "label", "value": "SI-12(02)_ODP[01]", "class": "sp800-53a" } ], "label": "techniques", "guidelines": [ { "prose": "techniques used to minimize the use of personally identifiable information for research are defined;" } ] }, { "id": "si-12.02_odp.02", "props": [ { "name": "label", "value": "SI-12(02)_ODP[02]", "class": "sp800-53a" } ], "label": "techniques", "guidelines": [ { "prose": "techniques used to minimize the use of personally identifiable information for testing are defined;" } ] }, { "id": "si-12.02_odp.03", "props": [ { "name": "label", "value": "SI-12(02)_ODP[03]", "class": "sp800-53a" } ], "label": "techniques", "guidelines": [ { "prose": "techniques used to minimize the use of personally identifiable information for training are defined;" } ] } ], "props": [ { "name": "label", "value": "SI-12(02)", "class": "zero-padded" }, { "name": "label", "value": "SI-12(2)" }, { "name": "label", "value": "SI-12(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "si-12.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#si-12", "rel": "required" }, { "href": "#pm-22", "rel": "related" }, { "href": "#pm-25", "rel": "related" }, { "href": "#si-19", "rel": "related" } ], "parts": [ { "id": "si-12.2_smt", "name": "statement", "prose": "Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: {{ insert: param, si-12.2_prm_1 }}." }, { "id": "si-12.2_gdn", "name": "guidance", "prose": "Organizations can minimize the risk to an individual’s privacy by employing techniques such as de-identification or synthetic data. Limiting the use of personally identifiable information throughout the information life cycle when the information is not needed for research, testing, or training helps reduce the level of privacy risk created by a system. Risk assessments as well as applicable laws, regulations, and policies can provide useful inputs to determining the techniques to use and when to use them." }, { "id": "si-12.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12(02)", "class": "sp800-53a" } ], "parts": [ { "id": "si-12.2_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12(02)[01]", "class": "sp800-53a" } ], "prose": " {{ insert: param, si-12.02_odp.01 }} are used to minimize the use of personally identifiable information for research;", "links": [ { "href": "#si-12.2_smt", "rel": "assessment-for" } ] }, { "id": "si-12.2_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12(02)[02]", "class": "sp800-53a" } ], "prose": " {{ insert: param, si-12.02_odp.02 }} are used to minimize the use of personally identifiable information for testing;", "links": [ { "href": "#si-12.2_smt", "rel": "assessment-for" } ] }, { "id": "si-12.2_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12(02)[03]", "class": "sp800-53a" } ], "prose": " {{ insert: param, si-12.02_odp.03 }} are used to minimize the use of personally identifiable information for training.", "links": [ { "href": "#si-12.2_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-12.2_smt", "rel": "assessment-for" } ] }, { "id": "si-12.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SI-12(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and information integrity policy\n\nsystem and information integrity procedures\n\npersonally identifiable information processing policy\n\npersonally identifiable information processing procedures\n\nfederal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to minimizing the use of personally identifiable information in testing, training, and research\n\npolicy for the minimization of personally identifiable information used in testing, training, and research\n\nprocedures for the minimization of personally identifiable information used in testing, training, and research\n\ndocumentation supporting minimization policy implementation (e.g., templates for testing, training, and research)\n\ndata sets used for testing, training, and research\n\nsystem security plan\n\nprivacy plan\n\nprivacy impact assessment\n\nprivacy risk assessment documentation\n\nother relevant documents or records" } ] }, { "id": "si-12.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SI-12(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information and records management, retention, and disposition responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nnetwork administrators\n\nsystem developers\n\npersonnel with IRB responsibilities" } ] }, { "id": "si-12.2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SI-12(02)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for the minimization of personally identifiable information used in testing, training, and research\n\nautomated mechanisms supporting and/or implementing the minimization of personally identifiable information used in testing, training, and research" } ] } ] }, { "id": "si-12.3", "class": "SP800-53-enhancement", "title": "Information Disposal", "params": [ { "id": "si-12.3_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-12.03_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-12.03_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-12.03_odp.03" } ], "label": "organization-defined techniques" }, { "id": "si-12.03_odp.01", "props": [ { "name": "label", "value": "SI-12(03)_ODP[01]", "class": "sp800-53a" } ], "label": "techniques", "guidelines": [ { "prose": "techniques used to dispose of information following the retention period are defined;" } ] }, { "id": "si-12.03_odp.02", "props": [ { "name": "label", "value": "SI-12(03)_ODP[02]", "class": "sp800-53a" } ], "label": "techniques", "guidelines": [ { "prose": "techniques used to destroy information following the retention period are defined;" } ] }, { "id": "si-12.03_odp.03", "props": [ { "name": "label", "value": "SI-12(03)_ODP[03]", "class": "sp800-53a" } ], "label": "techniques", "guidelines": [ { "prose": "techniques used to erase information following the retention period are defined;" } ] } ], "props": [ { "name": "label", "value": "SI-12(03)", "class": "zero-padded" }, { "name": "label", "value": "SI-12(3)" }, { "name": "label", "value": "SI-12(03)", "class": "sp800-53a" }, { "name": "sort-id", "value": "si-12.03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#si-12", "rel": "required" } ], "parts": [ { "id": "si-12.3_smt", "name": "statement", "prose": "Use the following techniques to dispose of, destroy, or erase information following the retention period: {{ insert: param, si-12.3_prm_1 }}." }, { "id": "si-12.3_gdn", "name": "guidance", "prose": "Organizations can minimize both security and privacy risks by disposing of information when it is no longer needed. The disposal or destruction of information applies to originals as well as copies and archived records, including system logs that may contain personally identifiable information." }, { "id": "si-12.3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12(03)", "class": "sp800-53a" } ], "parts": [ { "id": "si-12.3_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12(03)[01]", "class": "sp800-53a" } ], "prose": " {{ insert: param, si-12.03_odp.01 }} are used to dispose of information following the retention period;", "links": [ { "href": "#si-12.3_smt", "rel": "assessment-for" } ] }, { "id": "si-12.3_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12(03)[02]", "class": "sp800-53a" } ], "prose": " {{ insert: param, si-12.03_odp.02 }} are used to destroy information following the retention period;", "links": [ { "href": "#si-12.3_smt", "rel": "assessment-for" } ] }, { "id": "si-12.3_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-12(03)[03]", "class": "sp800-53a" } ], "prose": " {{ insert: param, si-12.03_odp.03 }} are used to erase information following the retention period.", "links": [ { "href": "#si-12.3_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-12.3_smt", "rel": "assessment-for" } ] }, { "id": "si-12.3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SI-12(03)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and information integrity policy\n\nsystem and information integrity procedures\n\npersonally identifiable information processing policy\n\npersonally identifiable information processing procedures\n\nrecords retention and disposition policy\n\nrecords retention and disposition procedures\n\nlaws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information disposal\n\nmedia protection policy\n\nmedia protection procedures\n\nsystem audit records\n\naudit findings\n\ninformation disposal records\n\nsystem security plan\n\nprivacy plan\n\nprivacy impact assessment\n\nprivacy risk assessment documentation\n\nother relevant documents or records" } ] }, { "id": "si-12.3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SI-12(03)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information and records management, retention, and disposition responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nnetwork administrators" } ] }, { "id": "si-12.3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SI-12(03)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for information disposition\n\nautomated mechanisms supporting and/or implementing information disposition" } ] } ] } ] }, { "id": "si-18", "class": "SP800-53", "title": "Personally Identifiable Information Quality Operations", "params": [ { "id": "si-18_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-18_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-18_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-18_odp.03" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "si-18_odp.04" } ], "label": "organization-defined frequency" }, { "id": "si-18_odp.01", "props": [ { "name": "label", "value": "SI-18_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to check the accuracy of personally identifiable information across the information life cycle is defined;" } ] }, { "id": "si-18_odp.02", "props": [ { "name": "label", "value": "SI-18_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to check the relevance of personally identifiable information across the information life cycle is defined;" } ] }, { "id": "si-18_odp.03", "props": [ { "name": "label", "value": "SI-18_ODP[03]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to check the timeliness of personally identifiable information across the information life cycle is defined;" } ] }, { "id": "si-18_odp.04", "props": [ { "name": "label", "value": "SI-18_ODP[04]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to check the completeness of personally identifiable information across the information life cycle is defined;" } ] } ], "props": [ { "name": "label", "value": "SI-18", "class": "zero-padded" }, { "name": "label", "value": "SI-18" }, { "name": "label", "value": "SI-18", "class": "sp800-53a" }, { "name": "sort-id", "value": "si-18" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "system" } ], "links": [ { "href": "#227063d4-431e-435f-9e8f-009b6dbc20f4", "rel": "reference" }, { "href": "#c15bfc12-a61e-4ca5-bf35-fa9ce3ccb5d2", "rel": "reference" }, { "href": "#a2590922-82f3-4277-83c0-ca5bee06dba4", "rel": "reference" }, { "href": "#pm-22", "rel": "related" }, { "href": "#pm-24", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#si-4", "rel": "related" } ], "parts": [ { "id": "si-18_smt", "name": "statement", "parts": [ { "id": "si-18_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle {{ insert: param, si-18_prm_1 }} ; and" }, { "id": "si-18_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Correct or delete inaccurate or outdated personally identifiable information." } ] }, { "id": "si-18_gdn", "name": "guidance", "prose": "Personally identifiable information quality operations include the steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of personally identifiable information. Personally identifiable information quality operations include editing and validating addresses as they are collected or entered into systems using automated address verification look-up application programming interfaces. Checking personally identifiable information quality includes the tracking of updates or changes to data over time, which enables organizations to know how and what personally identifiable information was changed should erroneous information be identified. The measures taken to protect personally identifiable information quality are based on the nature and context of the personally identifiable information, how it is to be used, how it was obtained, and the potential de-identification methods employed. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals covered under federal programs may be more comprehensive than the measures used to validate personally identifiable information used for less sensitive purposes." }, { "id": "si-18_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-18", "class": "sp800-53a" } ], "parts": [ { "id": "si-18_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-18a.", "class": "sp800-53a" } ], "parts": [ { "id": "si-18_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-18a.[01]", "class": "sp800-53a" } ], "prose": "the accuracy of personally identifiable information across the information life cycle is checked {{ insert: param, si-18_odp.01 }};", "links": [ { "href": "#si-18_smt.a", "rel": "assessment-for" } ] }, { "id": "si-18_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-18a.[02]", "class": "sp800-53a" } ], "prose": "the relevance of personally identifiable information across the information life cycle is checked {{ insert: param, si-18_odp.02 }};", "links": [ { "href": "#si-18_smt.a", "rel": "assessment-for" } ] }, { "id": "si-18_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-18a.[03]", "class": "sp800-53a" } ], "prose": "the timeliness of personally identifiable information across the information life cycle is checked {{ insert: param, si-18_odp.03 }};", "links": [ { "href": "#si-18_smt.a", "rel": "assessment-for" } ] }, { "id": "si-18_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-18a.[04]", "class": "sp800-53a" } ], "prose": "the completeness of personally identifiable information across the information life cycle is checked {{ insert: param, si-18_odp.04 }};", "links": [ { "href": "#si-18_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-18_smt.a", "rel": "assessment-for" } ] }, { "id": "si-18_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-18b.", "class": "sp800-53a" } ], "prose": "inaccurate or outdated personally identifiable information is corrected or deleted.", "links": [ { "href": "#si-18_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-18_smt", "rel": "assessment-for" } ] }, { "id": "si-18_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SI-18-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and information integrity policy\n\nsystem and information integrity procedures\n\npersonally identifiable information processing policy\n\ndocumentation addressing personally identifiable information quality operations\n\nquality reports\n\nmaintenance logs\n\nsystem audit records\n\naudit findings\n\nsystem security plan\n\nprivacy plan\n\nprivacy impact assessment\n\nprivacy risk assessment documentation\n\nother relevant documents or records" } ] }, { "id": "si-18_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SI-18-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel responsible for performing personally identifiable information quality inspections\n\norganizational personnel with information security responsibilities\n\norganizational personnel with privacy responsibilities" } ] }, { "id": "si-18_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SI-18-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for personally identifiable information quality inspection\n\nautomated mechanisms supporting and/or implementing personally identifiable information quality operations" } ] } ], "controls": [ { "id": "si-18.4", "class": "SP800-53-enhancement", "title": "Individual Requests", "props": [ { "name": "label", "value": "SI-18(04)", "class": "zero-padded" }, { "name": "label", "value": "SI-18(4)" }, { "name": "label", "value": "SI-18(04)", "class": "sp800-53a" }, { "name": "sort-id", "value": "si-18.04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "system" } ], "links": [ { "href": "#si-18", "rel": "required" } ], "parts": [ { "id": "si-18.4_smt", "name": "statement", "prose": "Correct or delete personally identifiable information upon request by individuals or their designated representatives." }, { "id": "si-18.4_gdn", "name": "guidance", "prose": "Inaccurate personally identifiable information maintained by organizations may cause problems for individuals, especially in those business functions where inaccurate information may result in inappropriate decisions or the denial of benefits and services to individuals. Even correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of an organization maintaining the information. Organizations use discretion when determining if personally identifiable information is to be corrected or deleted based on the scope of requests, the changes sought, the impact of the changes, and laws, regulations, and policies. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding appropriate instances of correction or deletion." }, { "id": "si-18.4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-18(04)", "class": "sp800-53a" } ], "prose": "personally identifiable information is corrected or deleted upon request by individuals or their designated representatives.", "links": [ { "href": "#si-18.4_smt", "rel": "assessment-for" } ] }, { "id": "si-18.4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SI-18(04)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and information integrity policy\n\nsystem and information integrity procedures\n\npersonally identifiable information processing policy\n\nsystem configuration\n\nindividual requests\n\nrecords of correction or deletion actions performed\n\nsystem audit records\n\nsystem security plan\n\nprivacy plan\n\nprivacy impact assessment\n\nprivacy risk assessment documentation\n\nother relevant documents or records" } ] }, { "id": "si-18.4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SI-18(04)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel responsible for responding to individual requests for personally identifiable information correction or deletion\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "si-18.4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SI-18(04)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Request mechanisms\n\nautomated mechanisms supporting and/or implementing individual requests for correction or deletion" } ] } ] } ] }, { "id": "si-19", "class": "SP800-53", "title": "De-identification", "params": [ { "id": "si-19_odp.01", "props": [ { "name": "alt-identifier", "value": "si-19_prm_1" }, { "name": "alt-label", "value": "elements of personally identifiable information", "class": "sp800-53" }, { "name": "label", "value": "SI-19_ODP[01]", "class": "sp800-53a" } ], "label": "elements", "guidelines": [ { "prose": "elements of personally identifiable information to be removed from datasets are defined;" } ] }, { "id": "si-19_odp.02", "props": [ { "name": "alt-identifier", "value": "si-19_prm_2" }, { "name": "label", "value": "SI-19_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to evaluate the effectiveness of de-identification is defined;" } ] } ], "props": [ { "name": "label", "value": "SI-19", "class": "zero-padded" }, { "name": "label", "value": "SI-19" }, { "name": "label", "value": "SI-19", "class": "sp800-53a" }, { "name": "sort-id", "value": "si-19" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "system" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c15bfc12-a61e-4ca5-bf35-fa9ce3ccb5d2", "rel": "reference" }, { "href": "#mp-6", "rel": "related" }, { "href": "#pm-22", "rel": "related" }, { "href": "#pm-23", "rel": "related" }, { "href": "#pm-24", "rel": "related" }, { "href": "#ra-2", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "si-19_smt", "name": "statement", "parts": [ { "id": "si-19_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Remove the following elements of personally identifiable information from datasets: {{ insert: param, si-19_odp.01 }} ; and" }, { "id": "si-19_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Evaluate {{ insert: param, si-19_odp.02 }} for effectiveness of de-identification." } ] }, { "id": "si-19_gdn", "name": "guidance", "prose": "De-identification is the general term for the process of removing the association between a set of identifying data and the data subject. Many datasets contain information about individuals that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records. Datasets may also contain other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Personally identifiable information is removed from datasets by trained individuals when such information is not (or no longer) necessary to satisfy the requirements envisioned for the data. For example, if the dataset is only used to produce aggregate statistics, the identifiers that are not needed for producing those statistics are removed. Removing identifiers improves privacy protection since information that is removed cannot be inadvertently disclosed or improperly used. Organizations may be subject to specific de-identification definitions or methods under applicable laws, regulations, or policies. Re-identification is a residual risk with de-identified data. Re-identification attacks can vary, including combining new datasets or other improvements in data analytics. Maintaining awareness of potential attacks and evaluating for the effectiveness of the de-identification over time support the management of this residual risk." }, { "id": "si-19_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-19", "class": "sp800-53a" } ], "parts": [ { "id": "si-19_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-19a.", "class": "sp800-53a" } ], "prose": " {{ insert: param, si-19_odp.01 }} are removed from datasets;", "links": [ { "href": "#si-19_smt.a", "rel": "assessment-for" } ] }, { "id": "si-19_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "SI-19b.", "class": "sp800-53a" } ], "prose": "the effectiveness of de-identification is evaluated {{ insert: param, si-19_odp.02 }}.", "links": [ { "href": "#si-19_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#si-19_smt", "rel": "assessment-for" } ] }, { "id": "si-19_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "SI-19-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System and information integrity policy\n\nsystem and information integrity procedures\n\npersonally identifiable information processing policy\n\nde-identification procedures\n\nsystem configuration\n\ndatasets with personally identifiable information removed\n\nsystem security plan\n\nprivacy plan\n\nprivacy impact assessment\n\nprivacy risk assessment documentation\n\nother relevant documents or records" } ] }, { "id": "si-19_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "SI-19-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel responsible for identifying unnecessary identifiers\n\norganizational personnel responsible for removing personally identifiable information from datasets\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "si-19_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "SI-19-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements" } ] } ] } ] } ], "back-matter": { "resources": [ { "uuid": "91f992fb-f668-4c91-a50f-0f05b95ccee3", "title": "32 CFR 2002", "citation": { "text": "Code of Federal Regulations, Title 32, *Controlled Unclassified Information* (32 C.F.R. 2002)." }, "rlinks": [ { "href": "https://www.federalregister.gov/documents/2016/09/14/2016-21665/controlled-unclassified-information" } ] }, { "uuid": "0f963c17-ab5a-432a-a867-91eac550309b", "title": "41 CFR 201", "citation": { "text": " \"Federal Acquisition Supply Chain Security Act; Rule,\" 85 Federal Register 54263 (September 1, 2020), pp 54263-54271." }, "rlinks": [ { "href": "https://www.federalregister.gov/d/2020-18939" } ] }, { "uuid": "94c64e1a-456c-457f-86da-83ac0dfc85ac", "title": "CMPPA", "citation": { "text": "Computer Matching and Privacy Protection Act of 1988 (P.L. 100-503), October 1988." }, "rlinks": [ { "href": "https://www.govinfo.gov/content/pkg/STATUTE-102/pdf/STATUTE-102-Pg2507.pdf" } ] }, { "uuid": "b9951d04-6385-478c-b1a3-ab68c19d9041", "title": "DHS NIPP", "citation": { "text": "Department of Homeland Security, *National Infrastructure Protection Plan (NIPP)* , 2009." }, "rlinks": [ { "href": "https://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf" } ] }, { "uuid": "7b0b9634-741a-4335-b6fa-161228c3a76e", "title": "EGOV", "citation": { "text": "E-Government Act [includes FISMA] (P.L. 107-347), December 2002. " }, "rlinks": [ { "href": "https://www.congress.gov/107/plaws/publ347/PLAW-107publ347.pdf" } ] }, { "uuid": "3406fdc0-d61c-44a9-a5ca-84180544c83a", "title": "EO 13636", "citation": { "text": "Executive Order 13636, *Improving Critical Infrastructure Cybersecurity* , February 2013." }, "rlinks": [ { "href": "https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity" } ] }, { "uuid": "4ff10ed3-d8fe-4246-99e3-443045e27482", "title": "FASC18", "citation": { "text": "Secure Technology Act [includes Federal Acquisition Supply Chain Security Act] (P.L. 115-390), December 2018." }, "rlinks": [ { "href": "https://www.congress.gov/bill/115th-congress/senate-bill/3085" } ] }, { "uuid": "678e3d6c-150b-4393-aec5-6e3481eb1e00", "title": "FIPS 140-3", "citation": { "text": "National Institute of Standards and Technology (2019) Security Requirements for Cryptographic Modules. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 140-3. " }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.FIPS.140-3" } ] }, { "uuid": "628d22a1-6a11-4784-bc59-5cd9497b5445", "title": "FIPS 199", "citation": { "text": "National Institute of Standards and Technology (2004) Standards for Security Categorization of Federal Information and Information Systems. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 199." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.FIPS.199" } ] }, { "uuid": "599fb53d-5041-444e-a7fe-640d6d30ad05", "title": "FIPS 200", "citation": { "text": "National Institute of Standards and Technology (2006) Minimum Security Requirements for Federal Information and Information Systems. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 200." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.FIPS.200" } ] }, { "uuid": "7ba1d91c-3934-4d5a-8532-b32f864ad34c", "title": "FIPS 201-2", "citation": { "text": "National Institute of Standards and Technology (2013) Personal Identity Verification (PIV) of Federal Employees and Contractors. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 201-2." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.FIPS.201-2" } ] }, { "uuid": "0c67b2a9-bede-43d2-b86d-5f35b8be36e9", "title": "FISMA", "citation": { "text": "Federal Information Security Modernization Act (P.L. 113-283), December 2014." }, "rlinks": [ { "href": "https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf" } ] }, { "uuid": "488d6934-00b2-4252-bf23-1b3c2d71eb13", "title": "HSPD 7", "citation": { "text": "Homeland Security Presidential Directive 7, *Critical Infrastructure Identification, Prioritization, and Protection* , December 2003." }, "rlinks": [ { "href": "https://www.dhs.gov/homeland-security-presidential-directive-7" } ] }, { "uuid": "15dc76ff-b17a-4eeb-8948-8ea8de3ccc2c", "title": "IR 7539", "citation": { "text": "Cooper DA, MacGregor WI (2008) Symmetric Key Injection onto Smart Cards. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7539." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.7539" } ] }, { "uuid": "2be7b163-e50a-435c-8906-f1162f2a457a", "title": "IR 7559", "citation": { "text": "Singhal A, Gunestas M, Wijesekera D (2010) Forensics Web Services (FWS). (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7559." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.7559" } ] }, { "uuid": "e24b06cc-9129-4998-a76a-65c3d7a576ba", "title": "IR 7622", "citation": { "text": "Boyens JM, Paulsen C, Bartol N, Shankles S, Moorthy R (2012) Notional Supply Chain Risk Management Practices for Federal Information Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7622." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.7622" } ] }, { "uuid": "4b38e961-1125-4a5b-aa35-1d6c02846dad", "title": "IR 7676", "citation": { "text": "Cooper DA (2010) Maintaining and Using Key History on Personal Identity Verification (PIV) Cards. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7676." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.7676" } ] }, { "uuid": "604774da-9e1d-48eb-9c62-4e959dc80737", "title": "IR 7870", "citation": { "text": "Cooper DA (2012) NIST Test Personal Identity Verification (PIV) Cards. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7870." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.7870" } ] }, { "uuid": "7f473f21-fdbf-4a6c-81a1-0ab95919609d", "title": "IR 7874", "citation": { "text": "Hu VC, Scarfone KA (2012) Guidelines for Access Control System Evaluation Metrics. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7874." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.7874" } ] }, { "uuid": "bbac9fc2-df5b-4f2d-bf99-90d0ade45349", "title": "IR 8011-1", "citation": { "text": "Dempsey KL, Eavy P, Moore G (2017) Automation Support for Security Control Assessments: Volume 1: Overview. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8011, Volume 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.8011-1" } ] }, { "uuid": "4c501da5-9d79-4cb6-ba80-97260e1ce327", "title": "IR 8023", "citation": { "text": "Dempsey KL, Paulsen C (2015) Risk Management for Replication Devices. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8023." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.8023" } ] }, { "uuid": "98d415ca-7281-4064-9931-0c366637e324", "title": "IR 8062", "citation": { "text": "Brooks S, Garcia M, Lefkovitz N, Lightman S, Nadeau E (2017) An Introduction to Privacy Engineering and Risk Management in Federal Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8062." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.8062" } ] }, { "uuid": "a2590922-82f3-4277-83c0-ca5bee06dba4", "title": "IR 8112", "citation": { "text": "Grassi P, Lefkovitz N, Nadeau E, Galluzzo R, Dinh, A (2018) Attribute Metadata: A Proposed Schema for Evaluating Federated Attributes. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8112." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.8112" } ] }, { "uuid": "38ff38f0-1366-4f50-a4c9-26a39aacee16", "title": "IR 8272", "citation": { "text": "Paulsen C, Winkler K, Boyens JM, Ng J, Gimbi J (2020) Impact Analysis Tool for Interdependent Cyber Supply Chain Risks. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8272." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.IR.8272" } ] }, { "uuid": "6afc1b04-c9d6-4023-adbc-f8fbe33a3c73", "title": "ISO 15408-1", "citation": { "text": "International Organization for Standardization/International Electrotechnical Commission 15408-1:2009, *Information technology —Security techniques — Evaluation criteria for IT security — Part 1: Introduction and general model* , April 2017." }, "rlinks": [ { "href": "https://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R5.pdf" } ] }, { "uuid": "87087451-2af5-43d4-88c1-d66ad850f614", "title": "ISO 15408-2", "citation": { "text": "International Organization for Standardization/International Electrotechnical Commission 15408-2:2008, *Information technology —Security techniques — Evaluation criteria for IT security — Part 2: Security functional requirements* , April 2017." }, "rlinks": [ { "href": "https://www.commoncriteriaportal.org/files/ccfiles/CCPART2V3.1R5.pdf" } ] }, { "uuid": "4452efc0-e79e-47b8-aa30-b54f3ef61c2f", "title": "ISO 15408-3", "citation": { "text": "International Organization for Standardization/International Electrotechnical Commission 15408-3:2008, *Information technology—Security techniques — Evaluation criteria for IT security — Part 3: Security assurance requirements* , April 2017." }, "rlinks": [ { "href": "https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R5.pdf" } ] }, { "uuid": "06ce9216-bd54-4054-a422-94f358b50a5d", "title": "ISO 29148", "citation": { "text": "International Organization for Standardization/International Electrotechnical Commission/Institute of Electrical and Electronics Engineers (ISO/IEC/IEEE) 29148:2018, *Systems and software engineering—Life cycle processes—Requirements engineering* , November 2018." }, "rlinks": [ { "href": "https://www.iso.org/standard/72089.html" } ] }, { "uuid": "c28ae9a8-1121-42a9-a85e-00cfcc9b9a94", "title": "NARA CUI", "citation": { "text": "National Archives and Records Administration, Controlled Unclassified Information (CUI) Registry." }, "rlinks": [ { "href": "https://www.archives.gov/cui" } ] }, { "uuid": "795aff72-3e6c-4b6b-a80a-b14d84b7f544", "title": "NIAP CCEVS", "citation": { "text": "National Information Assurance Partnership, *Common Criteria Evaluation and Validation Scheme*." }, "rlinks": [ { "href": "https://www.niap-ccevs.org" } ] }, { "uuid": "3d575737-98cb-459d-b41c-d7e82b73ad78", "title": "NSA CSFC", "citation": { "text": "National Security Agency, *Commercial Solutions for Classified Program (CSfC)*." }, "rlinks": [ { "href": "https://www.nsa.gov/resources/everyone/csfc" } ] }, { "uuid": "df9f87e9-71e7-4c74-9ac3-3cabd4e92f21", "title": "NSA MEDIA", "citation": { "text": "National Security Agency, *Media Destruction Guidance*." }, "rlinks": [ { "href": "https://www.nsa.gov/resources/everyone/media-destruction" } ] }, { "uuid": "89f2a08d-fc49-46d0-856e-bf974c9b1573", "title": "ODNI CTF", "citation": { "text": "Office of the Director of National Intelligence (ODNI) Cyber Threat Framework." }, "rlinks": [ { "href": "https://www.dni.gov/index.php/cyber-threat-framework" } ] }, { "uuid": "3671ff20-c17c-44d6-8a88-7de203fa74aa", "title": "OMB A-108", "citation": { "text": "Office of Management and Budget Memorandum Circular A-108, *Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act* , December 2016." }, "rlinks": [ { "href": "https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A108/omb_circular_a-108.pdf" } ] }, { "uuid": "27847491-5ce1-4f6a-a1e4-9e483782f0ef", "title": "OMB A-130", "citation": { "text": "Office of Management and Budget Memorandum Circular A-130, *Managing Information as a Strategic Resource* , July 2016." }, "rlinks": [ { "href": "https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf" } ] }, { "uuid": "d229ae60-51dd-4d7b-a8bf-1f7195cc7561", "title": "OMB M-03-22", "citation": { "text": "Office of Management and Budget Memorandum M-03-22, *OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002* , September 2003. [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2003/m03_22.pdf](https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2003/m03_22.pdf) " }, "rlinks": [ { "href": "https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2003/m03_22.pdf" } ] }, { "uuid": "206a3284-6a7e-423c-8ea9-25b22542541d", "title": "OMB M-17-06", "citation": { "text": "Office of Management and Budget Memorandum M-17-06, *Policies for Federal Agency Public Websites and Digital Services* , November 2016." }, "rlinks": [ { "href": "https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-06.pdf" } ] }, { "uuid": "5f4705ac-8d17-438c-b23a-ac7f12362ae4", "title": "OMB M-17-12", "citation": { "text": "Office of Management and Budget Memorandum M-17-12, *Preparing for and Responding to a Breach of Personally Identifiable Information* , January 2017." }, "rlinks": [ { "href": "https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2017/m-17-12_0.pdf" } ] }, { "uuid": "c5e11048-1d38-4af3-b00b-0d88dc26860c", "title": "OMB M-19-03", "citation": { "text": "Office of Management and Budget Memorandum M-19-03, *Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program* , December 2018." }, "rlinks": [ { "href": "https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf" } ] }, { "uuid": "227063d4-431e-435f-9e8f-009b6dbc20f4", "title": "OMB M-19-15", "citation": { "text": "Office of Management and Budget Memorandum M-19-15, *Improving Implementation of the Information Quality Act* , April 2019." }, "rlinks": [ { "href": "https://www.whitehouse.gov/wp-content/uploads/2019/04/M-19-15.pdf" } ] }, { "uuid": "18e71fec-c6fd-475a-925a-5d8495cf8455", "title": "PRIVACT", "citation": { "text": "Privacy Act (P.L. 93-579), December 1974." }, "rlinks": [ { "href": "https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf" } ] }, { "uuid": "4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "title": "SP 800-100", "citation": { "text": "Bowen P, Hash J, Wilson M (2006) Information Security Handbook: A Guide for Managers. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-100, Includes updates as of March 7, 2007." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-100" } ] }, { "uuid": "10cf2fad-a216-41f9-bb1a-531b7e3119e3", "title": "SP 800-101", "citation": { "text": "Ayers RP, Brothers S, Jansen W (2014) Guidelines on Mobile Device Forensics. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-101, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-101r1" } ] }, { "uuid": "122177fa-c4ed-485d-8345-3082c0fb9a06", "title": "SP 800-115", "citation": { "text": "Scarfone KA, Souppaya MP, Cody A, Orebaugh AD (2008) Technical Guide to Information Security Testing and Assessment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-115." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-115" } ] }, { "uuid": "0f66be67-85e7-4ca6-bd19-39453e9f4394", "title": "SP 800-124", "citation": { "text": "Souppaya MP, Scarfone KA (2013) Guidelines for Managing the Security of Mobile Devices in the Enterprise. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-124, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-124r1" } ] }, { "uuid": "20db4e66-e257-450c-b2e4-2bb9a62a2c88", "title": "SP 800-128", "citation": { "text": "Johnson LA, Dempsey KL, Ross RS, Gupta S, Bailey D (2011) Guide for Security-Focused Configuration Management of Information Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-128, Includes updates as of October 10, 2019." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-128" } ] }, { "uuid": "c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "title": "SP 800-12", "citation": { "text": "Nieles M, Pillitteri VY, Dempsey KL (2017) An Introduction to Information Security. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-12, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-12r1" } ] }, { "uuid": "62ea77ca-e450-4323-b210-e0d75390e785", "title": "SP 800-137A", "citation": { "text": "Dempsey KL, Pillitteri VY, Baer C, Niemeyer R, Rudman R, Urban S (2020) Assessing Information Security Continuous Monitoring (ISCM) Programs: Developing an ISCM Program Assessment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-137A." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-137A" } ] }, { "uuid": "067223d8-1ec7-45c5-b21b-c848da6de8fb", "title": "SP 800-137", "citation": { "text": "Dempsey KL, Chawla NS, Johnson LA, Johnston R, Jones AC, Orebaugh AD, Scholl MA, Stine KM (2011) Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-137." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-137" } ] }, { "uuid": "9ef4b43c-42a4-4316-87dc-ffaf528bc05c", "title": "SP 800-150", "citation": { "text": "Johnson CS, Waltermire DA, Badger ML, Skorupka C, Snyder J (2016) Guide to Cyber Threat Information Sharing. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-150." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-150" } ] }, { "uuid": "708b94e1-3d5e-4b22-ab43-1c69f3a97e37", "title": "SP 800-154", "citation": { "text": "Souppaya MP, Scarfone KA (2016) Guide to Data-Centric System Threat Modeling. (National Institute of Standards and Technology, Gaithersburg, MD), Draft NIST Special Publication (SP) 800-154." }, "rlinks": [ { "href": "https://csrc.nist.gov/publications/detail/sp/800-154/draft" } ] }, { "uuid": "e3cc0520-a366-4fc9-abc2-5272db7e3564", "title": "SP 800-160-1", "citation": { "text": "Ross RS, Oren JC, McEvilley M (2016) Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-160, Vol. 1, Includes updates as of March 21, 2018." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-160v1" } ] }, { "uuid": "61ccf0f4-d3e7-42db-9796-ce6cb1c85989", "title": "SP 800-160-2", "citation": { "text": "Ross RS, Pillitteri VY, Graubart R, Bodeau D, McQuaid R (2019) Developing Cyber Resilient Systems: A Systems Security Engineering Approach. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-160, Vol. 2." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-160v2" } ] }, { "uuid": "e8e84963-14fc-4c3a-be05-b412a5d37cd2", "title": "SP 800-161", "citation": { "text": "Boyens JM, Paulsen C, Moorthy R, Bartol N (2015) Supply Chain Risk Management Practices for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-161." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-161" } ] }, { "uuid": "7dbd6d9f-29d6-4d1d-9766-f2d77ff3c849", "title": "SP 800-171", "citation": { "text": "Ross RS, Pillitteri VY, Dempsey KL, Riddle M, Guissanie G (2020) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-171, Rev. 2." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-171r2" } ] }, { "uuid": "f26af0d0-6d72-4a9d-8ecd-01bc21fd4f0e", "title": "SP 800-172", "citation": { "text": "Ross RS, Pillitteri VY, Graubart RD, Guissanie G, Wagner R, Bodeau D (2020) Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 (Final Public Draft). (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-172." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-172-draft" } ] }, { "uuid": "276bd50a-7e58-48e5-a405-8c8cb91d7a5f", "title": "SP 800-181", "citation": { "text": "Petersen R, Santos D, Smith MC, Wetzel KA, Witte G (2020) Workforce Framework for Cybersecurity (NICE Framework). (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-181, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-181r1" } ] }, { "uuid": "31ae65ab-3f26-46b7-9d64-f25a4dac5778", "title": "SP 800-184", "citation": { "text": "Bartock M, Scarfone KA, Smith MC, Witte GA, Cichonski JA, Souppaya MP (2016) Guide for Cybersecurity Event Recovery. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-184." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-184" } ] }, { "uuid": "c15bfc12-a61e-4ca5-bf35-fa9ce3ccb5d2", "title": "SP 800-188", "citation": { "text": "Garfinkel S (2016) De-Identifying Government Datasets. (National Institute of Standards and Technology, Gaithersburg, MD), Second Draft NIST Special Publication (SP) 800-188." }, "rlinks": [ { "href": "https://csrc.nist.gov/publications/detail/sp/800-188/draft" } ] }, { "uuid": "30eb758a-2707-4bca-90ad-949a74d4eb16", "title": "SP 800-18", "citation": { "text": "Swanson MA, Hash J, Bowen P (2006) Guide for Developing Security Plans for Federal Information Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-18, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-18r1" } ] }, { "uuid": "08b07465-dbdc-48d6-8a0b-37279602ac16", "title": "SP 800-30", "citation": { "text": "Joint Task Force Transformation Initiative (2012) Guide for Conducting Risk Assessments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-30, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-30r1" } ] }, { "uuid": "77faf0bc-c394-44ad-9154-bbac3b79c8ad", "title": "SP 800-35", "citation": { "text": "Grance T, Hash J, Stevens M, O'Neal K, Bartol N (2003) Guide to Information Technology Security Services. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-35." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-35" } ] }, { "uuid": "482e4c99-9dc4-41ad-bba8-0f3f0032c1f8", "title": "SP 800-37", "citation": { "text": "Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37, Rev. 2." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-37r2" } ] }, { "uuid": "cec037f3-8aba-4c97-84b4-4082f9e515d2", "title": "SP 800-39", "citation": { "text": "Joint Task Force Transformation Initiative (2011) Managing Information Security Risk: Organization, Mission, and Information System View. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-39." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-39" } ] }, { "uuid": "511f6832-23ca-49a3-8c0f-ce493373cab8", "title": "SP 800-50", "citation": { "text": "Wilson M, Hash J (2003) Building an Information Technology Security Awareness and Training Program. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-50." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-50" } ] }, { "uuid": "a21aef46-7330-48a0-b2e1-c5bb8b2dd11d", "title": "SP 800-53A", "citation": { "text": "Joint Task Force Transformation Initiative (2014) Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53A, Rev. 4, Includes updates as of December 18, 2014." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-53Ar4" } ] }, { "uuid": "46d9e201-840e-440e-987c-2c773333c752", "title": "SP 800-53B", "citation": { "text": "Joint Task Force (2020) Control Baselines and Tailoring Guidance for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53B." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-53B" } ] }, { "uuid": "7798067b-4ed0-4adc-a505-79dad4741693", "title": "SP 800-55", "citation": { "text": "Chew E, Swanson MA, Stine KM, Bartol N, Brown A, Robinson W (2008) Performance Measurement Guide for Information Security. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-55, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-55r1" } ] }, { "uuid": "e72fde0b-6fc2-497e-a9db-d8fce5a11b8a", "title": "SP 800-60-1", "citation": { "text": "Stine KM, Kissel RL, Barker WC, Fahlsing J, Gulick J (2008) Guide for Mapping Types of Information and Information Systems to Security Categories. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-60, Vol. 1, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-60v1r1" } ] }, { "uuid": "9be5d661-421f-41ad-854e-86f98b811891", "title": "SP 800-60-2", "citation": { "text": "Stine KM, Kissel RL, Barker WC, Lee A, Fahlsing J (2008) Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-60, Vol. 2, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-60v2r1" } ] }, { "uuid": "49b8aa2d-a88c-4bff-9f20-876ccb8f7dcb", "title": "SP 800-61", "citation": { "text": "Cichonski PR, Millar T, Grance T, Scarfone KA (2012) Computer Security Incident Handling Guide. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-61, Rev. 2." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-61r2" } ] }, { "uuid": "737513fa-6758-403f-831d-5ddab5e23cb3", "title": "SP 800-63-3", "citation": { "text": "Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-3, Includes updates as of March 2, 2020." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-63-3" } ] }, { "uuid": "4895b4cd-34c5-4667-bf8a-27d443c12047", "title": "SP 800-70", "citation": { "text": "Quinn SD, Souppaya MP, Cook MR, Scarfone KA (2018) National Checklist Program for IT Products: Guidelines for Checklist Users and Developers. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-70, Rev. 4." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-70r4" } ] }, { "uuid": "858705be-3c1f-48aa-a328-0ce398d95ef0", "title": "SP 800-73-4", "citation": { "text": "Cooper DA, Ferraiolo H, Mehta KL, Francomacaro S, Chandramouli R, Mohler J (2015) Interfaces for Personal Identity Verification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-73-4, Includes updates as of February 8, 2016." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-73-4" } ] }, { "uuid": "3dd249b0-f57d-44ba-a03e-c3eab1b835ff", "title": "SP 800-83", "citation": { "text": "Souppaya MP, Scarfone KA (2013) Guide to Malware Incident Prevention and Handling for Desktops and Laptops. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-83, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-83r1" } ] }, { "uuid": "53be2fcf-cfd1-4bcb-896b-9a3b65c22098", "title": "SP 800-84", "citation": { "text": "Grance T, Nolan T, Burke K, Dudley R, White G, Good T (2006) Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-84." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-84" } ] }, { "uuid": "cfdb1858-c473-46b3-89f9-a700308d0be2", "title": "SP 800-86", "citation": { "text": "Kent K, Chevalier S, Grance T, Dang H (2006) Guide to Integrating Forensic Techniques into Incident Response. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-86." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-86" } ] }, { "uuid": "a5b1d18d-e670-4586-9e6d-4a88b7ba3df6", "title": "SP 800-88", "citation": { "text": "Kissel RL, Regenscheid AR, Scholl MA, Stine KM (2014) Guidelines for Media Sanitization. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-88, Rev. 1." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-88r1" } ] }, { "uuid": "5eee45d8-3313-4fdc-8d54-1742092bbdd6", "title": "SP 800-92", "citation": { "text": "Kent K, Souppaya MP (2006) Guide to Computer Security Log Management. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-92." }, "rlinks": [ { "href": "https://doi.org/10.6028/NIST.SP.800-92" } ] }, { "uuid": "e922fc50-b1f9-469f-92ef-ed7d9803611c", "title": "USC 2901", "citation": { "text": "United States Code, 2008 Edition, Title 44 - *Public Printing and Documents* , Chapters 29, 31, and 33, January 2012." }, "rlinks": [ { "href": "https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap29-sec2901.pdf" } ] }, { "uuid": "40b78258-c892-480e-9af8-77ac36648301", "title": "USCERT IR", "citation": { "text": "Department of Homeland Security, *US-CERT Federal Incident Notification Guidelines* , April 2017." }, "rlinks": [ { "href": "https://us-cert.cisa.gov/incident-notification-guidelines" } ] }, { "uuid": "c3397cc9-83c6-4459-adb2-836739dc1b94", "title": "NIST Special Publication 800-53, Revision 5: * Security and Privacy Controls for Information Systems and Organizations* (PDF)", "rlinks": [ { "href": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "media-type": "application/pdf" } ] } ] } } }