Compliance, Mapped to Your Cloud

Support the management of system accounts using \[Assignment: organization-defined automated mechanisms\].

Disable accounts within \[Assignment: organization-defined time period\] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for \[Assignment: organization-defined time period\].

Automatically audit account creation, modification, enabling, disabling, and removal actions.

Implement \[Assignment: organization-defined dynamic privilege management capabilities\].

Monitors and reports atypical usage of information system accounts to organization-defined personnel or roles.

d. Specify: 1. Authorized users of the system;personnel termination and transfer processes.

The organization: g. Monitors the use of information system accounts.

i. Authorize access to the system based on: 2. Intended system usage.

The organization: j. Reviews accounts for compliance with account management requirements \[Assignment: organization-defined frequency\].

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Employ an audited override of automated access control mechanisms under \[Assignment: organization-defined conditions\] by \[Assignment: organization-defined roles\].

Enforce dual authorization for \[Assignment: organization-defined privileged commands and/or other organization-defined actions\].

Enforce \[Assignment: organization-defined mandatory access control policy\] over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across the covered subjects and objects within the system; (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (1) Passing the information to unauthorized subjects or objects; (2) Granting its privileges to other subjects; (3) Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components; (4) Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects; and (5) Changing the rules governing access control; and (c) Specifies that \[Assignment: organization-defined subjects\] may explicitly be granted \[Assignment: organization-defined privileges\] such that they are not limited by any defined subset (or all) of the above constraints.

Enforce \[Assignment: organization-defined discretionary access control policy\] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (a) Pass the information to any other subjects or objects; (b) Grant its privileges to other subjects; (c) Change security attributes on subjects, objects, the system, or the system’s components; (d) Choose the security attributes to be associated with newly created or revised objects; or (e) Change the rules governing access control.

Enforce a role-based access control policy over defined subjects and objects and control access based upon \[Assignment: organization-defined roles and users authorized to assume such roles\].

Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on \[Assignment: organization-defined rules governing the timing of revocations of access authorizations\].

Employ an audited override of automated access mechanisms under \[Assignment: organization-defined conditions\] by \[Assignment: organization-defined roles\].

a. Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: \[Assignment: organization-defined system applications and functions\];b. Provide an enforcement mechanism to prevent unauthorized access; and c. Approve access changes after initial installation of the application.

Enforce attribute-based access control policy over defined subjects and objects and control access based upon \[Assignment: organization-defined attributes to assume access permissions\].

a. Enforce \[Assignment: organization-defined mandatory access control policy\] over the set of covered subjects and objects specified in the policy; and b. Enforce \[Assignment: organization-defined discretionary access control policy\] over the set of covered subjects and objects specified in the policy.

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on \[Assignment: organization-defined information flow control policies\].

Separate information flows logically or physically using \[Assignment: organization-defined mechanisms and/or techniques\] to accomplish \[Assignment: organization-defined required separations by types of information\].

Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains.

When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.

When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.

Define system access authorizations to support separation of duties.

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

Require that users of system accounts (or roles) with access to \[Assignment: organization-defined security functions or security-relevant information\] use non-privileged accounts or roles, when accessing nonsecurity functions.

Authorize network access to \[Assignment: organization-defined privileged commands\] only for \[Assignment: organization-defined compelling operational needs\] and document the rationale for such access in the security plan for the system.

Log the execution of privileged functions.

Prevent non-privileged users from executing privileged functions.

a. Allow the use of \[Assignment: organization-defined authentication factors\] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and b. Enforce a limit of \[Assignment: organization-defined number\] consecutive invalid logon attempts through use of the alternative factors by a user during a \[Assignment: organization-defined time period\].

Ensure that the attribute associations are made and retained with the information.

Employ automated mechanisms to monitor and control remote access methods.

Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

a. Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: \[Assignment: organization-defined needs\]; and b. Document the rationale for remote access in the security plan for the system.

Provide the capability to disconnect or disable remote access to the system within \[Assignment: organization-defined time period\].

Provide the capability to disconnect or disable remote access to the system within \[Assignment: organization-defined time period\].

Authorize each type of remote access to the system prior to allowing such connections.

\[Selection: Establish procedures; Implement mechanisms\] to ensure \[Assignment: organization-defined access control decisions\] are applied to each access request prior to access enforcement.

Transmit \[Assignment: organization-defined access authorization information\] using \[Assignment: organization-defined controls\] to \[Assignment: organization-defined systems\] that enforce access control decisions.

Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.

Generate audit records containing the following additional information: \[Assignment: organization-defined additional information\].

Ensure that audit records contain information that establishes the following: a. What type of event occurred.

Ensure that audit records contain information that establishes the following: b. When the event occurred.

Ensure that audit records contain information that establishes the following: c. Where the event occurred.

Ensure that audit records contain information that establishes the following: d. Source of the event.

Ensure that audit records contain information that establishes the following: e. Outcome of the event.

Ensure that audit records contain information that establishes the following: e. Outcome of the event.

Transfer audit logs \[Assignment: organization-defined frequency\] to a different system, system component, or media other than the system or system component conducting the logging.

Integrate audit record review, analysis, and reporting processes using \[Assignment: organization-defined automated mechanisms\].

Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.

Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.

Integrate analysis of audit records with analysis of \[Selection (one or more): vulnerability scanning information; performance data; system monitoring information; \[Assignment: organization-defined data/information collected from other sources\]\] to further enhance the ability to identify inappropriate or unusual activity.

Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.

Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.

Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: \[Assignment: organization-defined fields within audit records\].

Record time stamps for audit records that meet \[Assignment: organization-defined granularity of time measurement\] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.

Store audit records \[Assignment: organization-defined frequency\] in a repository that is part of a physically different system or system component than the system or component being audited.

Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.

Store audit information on a component running a different operating system than the system or component being audited.

Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed \[Assignment: organization-defined actions to be covered by non-repudiation\].

Retain audit records for \[Assignment: organization-defined time period consistent with records retention policy\] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Employ \[Assignment: organization-defined measures\] to ensure that long-term audit records generated by the system can be retrieved.

Compile audit records from \[Assignment: organization-defined system components\] into a system-wide (logical or physical) audit trail that is time-correlated to within \[Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail\].

Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.

Provide and implement the capability for \[Assignment: organization-defined individuals or roles\] to change the logging to be performed on \[Assignment: organization-defined system components\] based on \[Assignment: organization-defined selectable event criteria\] within \[Assignment: organization-defined time thresholds\].

Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.

Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on \[Assignment: organization-defined system components\].

Generate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3.

Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.

Provide and implement the capability for \[Assignment: organization-defined users or roles\] to \[Selection (one or more): record; view; hear; log\] the content of a user session under \[Assignment: organization-defined circumstances\].

Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Employ \[Assignment: organization-defined methods\] for coordinating \[Assignment: organization-defined audit information\] among external organizations when audit information is transmitted across organizational boundaries.

Include as part of control assessments, \[Assignment: organization-defined frequency\], \[Selection: announced; unannounced\], \[Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; \[Assignment: organization-defined other forms of assessment\]\].

Assess the controls in the system and its environment of operation \[Assignment: organization-defined frequency\] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements.

Continuously monitor configuration management processes. Determine security impact, environment and operational risks.

Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: a. Effectiveness monitoring; b. Compliance monitoring; and c. Change monitoring.

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: b. Establishing \[Assignment: organization-defined frequencies\] for monitoring and \[Assignment: organization-defined frequencies\] for assessment of control effectiveness.

Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated.

Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using \[Assignment: organization-defined automated mechanisms\].

Develop, document, and maintain under configuration control, a current baseline configuration of the system.

Review and update the baseline configuration of the system: 1. \[Assignment: organization-defined frequency\]; 2. When required due to \[Assignment: organization-defined circumstances\]; and 3. When system components are installed or upgraded.

Implement changes to the current system baseline and deploy the updated baseline across the installed base using \[Assignment: organization-defined automated mechanisms\].

Determine and document the types of changes to the system that are configuration-controlled.

a. Enforce access restrictions using \[Assignment: organization-defined automated mechanisms\]; and b. Automatically generate audit records of the enforcement actions.

The organization: (i) establishes mandatory configuration settings for information technology products employed within the information system; (ii) configures the security settings of information technology products to the most restrictive mode consistent with operational requirements; (iii) documents the configuration settings; and (iv) enforces the configuration settings in all components of the information system.

Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using \[Assignment: organization-defined common secure configurations\].

Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: \[Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services\].

Update the inventory of system components as part of component installations, removals, and system updates.

Maintain the currency, completeness, accuracy, and availability of the inventory of system components using \[Assignment: organization-defined automated mechanisms\].

The organization: Employs automated mechanisms \[Assignment: organization-defined frequency\] to detect the presence of unauthorized hardware, software, and firmware components within the information system; and Takes the following actions when unauthorized components are detected: \[Selection (one or more): disables network access by such components; isolates the components; notifies \[Assignment: organization-defined personnel or roles\]\].

Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.

Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other system; 4. Is at the level of granularity deemed necessary for tracking and reporting; and 5. Includes the following information to achieve system component accountability: \[Assignment: organization-defined information deemed necessary to achieve effective system component accountability\].

Review and update the system component inventory \[Assignment: organization-defined frequency\].

Develop, document, and implement a configuration management plan for the system that: b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items.

Identify and document the users who have access to the system and system components where the information is processed and stored.

Implement transaction recovery for systems that are transaction-based.

a. Develop, document, and disseminate to \[Assignment: organization-defined personnel or roles\]: 1. \[Selection (one or more): Organization-level; Mission/business process-level; System-level\] contingency planning policy that: a). Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and b). Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls.

a. Develop a contingency plan for the system that: 1. Identifies essential mission and business functions and associated contingency requirements; 2. Provides recovery objectives, restoration priorities, and metrics; 3. Addresses contingency roles, responsibilities, assigned individuals with contact information; 4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6. Addresses the sharing of contingency information; and 7. Is reviewed and approved by \[Assignment: organization-defined personnel or roles\].

Review the contingency plan for the system \[Assignment: organization-defined frequency\]

Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing.

Plan for the continuance of \[Selection: all; essential\] mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at primary processing and/or storage sites.

Plan for the transfer of \[Selection: all; essential\] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to primary processing and/or storage sites.

Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.

Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.

Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information.

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of \[Assignment: organization-defined backup information\].

Conduct backups of user-level information contained in \[Assignment: organization-defined system components\] \[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives\].

Conduct backups of system-level information contained in the system \[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives\].

Conduct backups of system documentation, including security- and privacy-related documentation \[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives\].

Protect the confidentiality, integrity, and availability of backup information.

Provide for the recovery and reconstitution of the system to a known state within \[Assignment: organization-defined time period consistent with recovery time and recovery point objectives\] after a disruption, compromise, or failure.

Implement transaction recovery for systems that are transaction-based.

The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Implement multi-factor authentication for access to privileged accounts.

Implement multi-factor authentication for access to non-privileged accounts.

Implement multi-factor authentication for \[Selection (one or more): local; network; remote\] access to \[Selection (one or more): privileged accounts; non-privileged accounts\] such that: (a) One of the factors is provided by a device separate from the system gaining access; and (b) The device meets \[Assignment: organization-defined strength of mechanism requirements\].

Implement replay-resistant authentication mechanisms for access to \[Selection (one or more): privileged accounts; non-privileged accounts\].

a. Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in accordance with \[Assignment: organization-defined lease information and lease duration\]; and b. Audit lease information when assigned to a device.

Generate pairwise pseudonymous identifiers.

Manage system identifiers by: b. Selecting an identifier that identifies an individual, group, role, service, or device.

Manage system identifiers by: d. Preventing reuse of identifiers for \[Assignment: organization-defined time period\].

Manage individual identifiers by uniquely identifying each individual as \[Assignment: organization-defined characteristic identifying individual status\].

Authenticate users and devices. Automate administrative control. Enforce restrictions. Protect against unauthorized use.

The information system, for password-based authentication that enforces minimum password complexity, stores and transmits only cryptographically-protected passwords, enforces password minimum and maximum lifetime restrictions, prohibits password reuse, allows the use of a temporary password for system logons with an immediate change to a permanent password etc.

Implement \[Assignment: organization-defined security controls\] to manage the risk of compromise due to individuals having accounts on multiple systems.

a. Employ \[Assignment: organization-defined password managers\] to generate and manage passwords; and b. Protect the passwords using \[Assignment: organization-defined controls\].

Manage system authenticators by: b. Establishing initial authenticator content for any authenticators issued by the organization.

Manage system authenticators by: c. Ensuring that authenticators have sufficient strength of mechanism for their intended use.

Manage system authenticators by: d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators.

Manage system authenticators by: f. Changing or refreshing authenticators \[Assignment: organization-defined time period by authenticator type\] or when \[Assignment: organization-defined events\] occur.

Manage system authenticators by: h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators.

Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.

Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.

a. Log \[Assignment: organization-defined audit events\] for nonlocal maintenance and diagnostic sessions; and b. Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.

Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.

Restrict access to \[Assignment: organization-defined types of digital and/or non-digital media\] to \[Assignment: organization-defined personnel or roles\].

Recognize \[Assignment: organization-defined classes or types of intrusions\] and initiate \[Assignment: organization-defined response actions\] using \[Assignment: organization-defined automated mechanisms\].

Monitor physical access to the system in addition to the physical access monitoring of the facility at \[Assignment: organization-defined physical spaces containing one or more components of the system\].

Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes.

a. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: 1. Are developed and maintained.

Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

Review and update the policy and procedures \[Assignment: organization-defined frequency\].

Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a. Establishing the following organization-wide metrics to be monitored: \[Assignment: organization-defined metrics\]; b. Establishing \[Assignment: organization-defined frequencies\] for monitoring and \[Assignment: organization-defined frequencies\] for assessment of control effectiveness; c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy; d. Correlation and analysis of information generated by control assessments and monitoring; e. Response actions to address results of the analysis of control assessment and monitoring information; and f. Reporting the security and privacy status of organizational systems to \[Assignment: organization-defined personnel or roles\] \[Assignment: organization-defined frequency\].

Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existing controls.

Employ the following advanced automation and analytics capabilities to predict and identify risks to \[Assignment: organization-defined systems or system components\]: \[Assignment: organization-defined advanced automation and analytics capabilities\].

a. Conduct a risk assessment, including: 1. Identifying threats to and vulnerabilities in the system.

Determine information about the system that is discoverable and take \[Assignment: organization-defined corrective actions\].

Monitor and scan for vulnerabilities in the system and hosted applications \[Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process\] and when new vulnerabilities potentially affecting the system are identified and reported.

Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existings.

Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.

Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.

Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.

a. Require the developer of the system, system component, or system service to follow a documented development process that: 4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development.

Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: \[Assignment: organization-defined denial-of-service attacks\].

Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding denial-of-service attacks.

a. Employ the following monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system: \[Assignment: organization-defined monitoring tools\]; and b. Monitor the following system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks: \[Assignment: organization-defined system resources\].

\[Selection: Protect against; Limit\] the effects of the following types of denial-of-service events: \[Assignment: organization-defined types of denial-of-service events\].

Employ the following controls to achieve the denial-of-service objective: \[Assignment: organization-defined controls by type of denial-of-service event\].

Protect the availability of resources by allocating \[Assignment: organization-defined resources\] by \[Selection (one or more): priority; quota; \[Assignment: organization-defined controls\]\].

Provide the capability to dynamically isolate \[Assignment: organization-defined system components\] from other system components.

Limit the number of external network connections to the system.

a. Implement a managed interface for each external telecommunication service; b. Establish a traffic flow policy for each managed interface; c. Protect the confidentiality and integrity of the information being transmitted across each interface; d. Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need; e. Review exceptions to the traffic flow policy \[Assignment: organization-defined frequency\] and remove exceptions that are no longer supported by an explicit mission or business need; f. Prevent unauthorized exchange of control plane traffic with external networks; g. Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and h. Filter unauthorized control plane traffic from external networks.

Deny network communications traffic by default and allow network communications traffic by exception \[Selection (one or more): at managed interfaces; for \[Assignment: organization-defined systems\]\].

Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using \[Assignment: organization-defined safeguards\].

a. Detect and deny outgoing communications traffic posing a threat to external systems; and b. Audit the identity of internal users associated with denied communications.

Only allow incoming communications from \[Assignment: organization-defined authorized sources\] to be routed to \[Assignment: organization-defined authorized destinations\].

Implement \[Assignment: organization-defined host-based boundary protection mechanisms\] at \[Assignment: organization-defined system components\].

Prevent the discovery of specific system components that represent a managed interface.

Prevent the discovery of specific system components that represent a managed interface.

Employ boundary protection mechanisms to isolate \[Assignment: organization-defined system components\] supporting \[Assignment: organization-defined missions and/or business functions\].

For systems that process personally identifiable information: a. Apply the following processing rules to data elements of personally identifiable information: \[Assignment: organization-defined processing rules\];b. Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system; c. Document each processing exception; and d. Review and remove exceptions that are no longer supported.

Prohibit the direct connection of \[Assignment: organization-defined unclassified national security system\] to an external network without the use of \[Assignment: organization-defined boundary protection device\].

Prohibit the direct connection of a classified national security system to an external network without the use of \[Assignment: organization-defined boundary protection device\].

Prohibit the direct connection of \[Assignment: organization-defined unclassified non-national security system\] to an external network without the use of \[Assignment: organization-defined boundary protection device\].

Prohibit the direct connection of \[Assignment: organization-defined system\] to a public network.

Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system.

Implement subnetworks for publicly accessible system components that are \[Selection: physically; logically\] separated from internal organizational networks.

Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Protect the \[Selection (one or more): confidentiality; integrity\] of transmitted information.

Implement cryptographic mechanisms to \[Selection (one or more): prevent unauthorized disclosure of information; detect changes to information\] during transmission.

Maintain the \[Selection (one or more): confidentiality; integrity\] of information during preparation for transmission and during reception.

Implement cryptographic mechanisms to protect message externals unless otherwise protected by \[Assignment: organization-defined alternative physical controls\].

Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by \[Assignment: organization-defined alternative physical controls\].

Implement \[Assignment: organization-defined protected distribution system\] to \[Selection (one or more): prevent unauthorized disclosure of information; detect changes to information\] during transmission.

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: \[Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction\].

Produce, control, and distribute symmetric cryptographic keys using \[Selection: NIST FIPS-validated; NSA-approved\] key management technology and processes.

Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.

Determine the \[Assignment: organization-defined cryptographic uses\].

Verify the integrity of transmitted security and privacy attributes.

Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation.

Protect the authenticity of communications sessions.

Generate a unique session identifier for each session with \[Assignment: organization-defined randomness requirements\] and recognize only session identifiers that are system-generated.

Only allow the use of \[Assignment: organization-defined certificate authorities\] for verification of the establishment of protected sessions.

Employ minimal functionality and information storage on the following system components: \[Assignment: organization-defined system components\].

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on \[Assignment: organization-defined system components or media\]: \[Assignment: organization-defined information\].

Remove the following information from online storage and store offline in a secure location: \[Assignment: organization-defined information\].

Distribute the following processing and storage components across multiple \[Selection: physical locations; logical domains\]: \[Assignment: organization-defined processing and storage components\].

Employ polling techniques to identify potential faults, errors, or compromises to the following processing and storage components: \[Assignment: organization-defined distributed processing and storage components\].

Authorize, monitor, and control the use of such components within the system.

Audit the use of the manual override capability.

a. Develop, document, and disseminate to \[Assignment: organization-defined personnel or roles\]: 2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;.

c. Review and update the current system and information integrity: 2. Procedures \[Assignment: organization-defined frequency\] and following \[Assignment: organization-defined events\].

Determine if system components have applicable security-relevant software and firmware updates installed using \[Assignment: organization-defined automated mechanisms\] \[Assignment: organization-defined frequency\].

Install \[Assignment: organization-defined security-relevant software and firmware updates\] automatically to \[Assignment: organization-defined system components\].

Identify, report, and correct system flaws.

Install security-relevant software and firmware updates within \[Assignment: organization-defined time period\] of the release of the updates.

Incorporate flaw remediation into the organizational configuration management process.

a. Detect the following unauthorized operating system commands through the kernel application programming interface on \[Assignment: organization-defined system hardware components\]: \[Assignment: organization-defined unauthorized operating system commands\]; and b. \[Selection (one or more): issue a warning; audit the command execution; prevent the execution of the command\].

c. Configure malicious code protection mechanisms to: 2. \[Selection (one or more): block malicious code; quarantine malicious code; take \[Assignment: organization-defined action\]\]; and send alert to \[Assignment: organization-defined personnel or roles\] in response to malicious code detection.

Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.

Implement the following additional monitoring of privileged users: \[Assignment: organization-defined additional monitoring\]. Employ automated tools and mechanisms to support near real-time analysis of events.

Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.

The information system monitors inbound and outbound communications traffic continuously for unusual or unauthorized activities or conditions.

Make provisions so that \[Assignment: organization-defined encrypted communications traffic\] is visible to \[Assignment: organization-defined system monitoring tools and mechanisms\].

Alert \[Assignment: organization-defined personnel or roles\] using \[Assignment: organization-defined automated mechanisms\] when the following indications of inappropriate or unusual activities with security or privacy implications occur: \[Assignment: organization-defined activities that trigger alerts\].

a. Analyze communications traffic and event patterns for the system; b. Develop profiles representing common traffic and event patterns; and c. Use the traffic and event profiles in tuning system-monitoring devices.

Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.

Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.

Implement the following additional monitoring of privileged users: \[Assignment: organization-defined additional monitoring\].

Implement the following host-based monitoring mechanisms at \[Assignment: organization-defined system components\]: \[Assignment: organization-defined host-based monitoring mechanisms\].

Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.

Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: \[Assignment: organization-defined monitoring objectives\]; and 2. Unauthorized local, network, and remote connections.

Identify unauthorized use of the system through the following techniques and methods: \[Assignment: organization-defined techniques and methods\].

c. Invoke internal monitoring capabilities or deploy monitoring devices: 1. Strategically within the system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization.

Analyze detected events and anomalies.

Broadcast security alert and advisory information throughout the organization using \[Assignment: organization-defined automated mechanisms\].

Generate internal security alerts, advisories, and directives as deemed necessary.

Perform an integrity check of \[Assignment: organization-defined software, firmware, and information\] \[Selection (one or more): at startup; at \[Assignment: organization-defined transitional states or security-relevant events\]; \[Assignment: organization-defined frequency\]\].

Employ centrally managed integrity verification tools.

Incorporate the detection of the following unauthorized changes into the organizational incident response capability: \[Assignment: organization-defined security-relevant changes to the system\].

Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: \[Selection (one or more): generate an audit record; alert current user; alert \[Assignment: organization-defined personnel or roles\]; \[Assignment: organization-defined other actions\]\].

Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: \[Assignment: organization-defined software, firmware, and information\].

a. Provide a manual override capability for input validation of the following information inputs: \[Assignment: organization-defined inputs defined in the base control (SI-10)\]; b. Restrict the use of the manual override capability to only \[Assignment: organization-defined authorized individuals\]; and c. Audit the use of the manual override capability.

Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

Provide \[Selection: real-time; near real-time\] \[Assignment: organization-defined failover capability\] for the system.

Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.