NIST SP 800-171A Rev. 3 日本語訳

The security assessment process gathers information and produces evidence to determine the effectiveness of security requirements by:

The purpose of this publication is to provide procedures for assessing the security requirements in NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations [3]. Organizations can use the assessment procedures to generate evidence that the security requirements have been satisfied. The scope of the security assessments conducted using the procedures described in this publication is guided and informed by the system security plans for systems that process, store, or transmit CUI. The assessment procedures offer the flexibility to customize assessments based on organizational policies and requirements, known threat and vulnerability information, system and platform dependencies, operational considerations, and tolerance for risk.1

The remainder of this special publication is organized as follows:

The following sections provide additional information to support the protection of CUI:

The process used by organizations and assessors to assess the security requirements in SP 800-171 [3] includes (1) preparing for the assessment, (2) developing a security assessment plan, (3) conducting the assessment, and (4) documenting, analyzing, and reporting the assessment results.2 The remainder of this section describes the structure and content of the procedures used to assess the security requirements and the importance of assurance cases in providing the evidence necessary to determine compliance with the requirements.

The security requirements in SP 800-171 are organized into 17 families, as illustrated in Table 1. The assessment procedures in Sec. 3 are grouped by similar family designations to ensure the completeness and consistency of assessments. The procedures have been derived from the assessment procedures in SP 800-53A [5].

Table 1. Security Requirement Families

An assessment procedure consists of an assessment objective and a set of potential assessment methods and objects that can be used to conduct the assessment. Each potential assessment objective includes a determination statement related to the security requirement. If there is an organization-defined parameter (ODP) in the security requirement, then the assessment objective begins with a determination statement related to the definition of the ODP. The determination statements are linked to the content of the security requirements to help ensure traceability of the assessment results to the requirements.

Assessment objects identify the specific items being assessed and can include specifications, mechanisms, activities, and individuals. Specifications are the documented artifacts3 (e.g., plans, policies, procedures, requirements, functional and assurance specifications, design documentation, and architectures) associated with a system. Mechanisms are the hardware, software, and firmware safeguards implemented within a system. Activities are the protection-related actions supporting a system that involve people (e.g., conducting system backup operations, exercising an incident response plan, and monitoring network traffic). Individuals are the people applying the specifications, mechanisms, or activities described above.

Assessment methods define the nature and extent of the assessor’s actions and are used to facilitate understanding, achieve clarification, or obtain evidence. The assessment methods include examine, interview, and test. The examine method is the process of reviewing, studying, inspecting, or analyzing assessment objects. The interview method is the process of holding discussions with individuals or groups about assessment objects. The test method is the process of exercising assessment objects (i.e., activities, mechanisms) under specified conditions to compare actual with expected behavior. Assessment methods include attributes of depth and coverage, which define the rigor, scope, and level of effort for the assessment as well as the degree of assurance that the security requirements have been satisfied. See SP 800-53A, Appendix C, Assessment Method Descriptions [5].

The structure and content of an assessment procedure are provided in the example below:

03.01.06 Least Privilege – Privileged Accounts

ASSESSMENT OBJECTIVE

Determine if:

A.03.01.06.ODP[01]: personnel or roles to which privileged accounts on the system are to be restricted are defined.

A.03.01.06.a: privileged accounts on the system are restricted to <A.03.01.06.ODP[01]: personnel or roles>.

A.03.01.06.b: users (or roles) with privileged accounts are required to use non-privileged accounts when accessing non-security functions or non-security information.

ASSESSMENT METHODS AND OBJECTS

Examine

[SELECT FROM: access control policy and procedures; procedures for least privilege; list of system-generated privileged accounts; list of system administration personnel; system audit records; system configuration settings; system security plan; list of system-generated security functions or security-relevant information assigned to system accounts or roles; other relevant documents or records]

Interview

[SELECT FROM: personnel with responsibilities for defining least privileges; personnel with information security responsibilities; system administrators]

Test

[SELECT FROM: mechanisms for implementing least privilege functions]

Source Assessment Procedures: AC-06(02), AC-06(05)

Determination statements have alphanumeric identifiers. Each determination statement begins with the letter “A” to indicate that it is part of an assessment procedure. The next sequence of numbers or letters (e.g., 03.01.01.e or 03.01.01.f.02) indicates the security requirement identifier from NIST SP 800-171 (and the specific control item if it is a multi-part requirement) that is the target of the assessment. Organization-defined parameters are indicated by the letters “ODP.” If there are multiple ODPs in the determination statement, the ODP number is indicated in a square bracket (e.g., A.03.01.08.ODP[01]). Square brackets are also used to denote when an assessment procedure further decomposes a requirement into more granular determination statements (e.g., A.03.01.12.a[01], A.03.01.12.a[02], A.03.01.12.a[03]).

The application of an assessment procedure to a security requirement produces assessment results or findings. The findings are compiled and used as evidence to determine whether the security requirement has been satisfied or other than satisfied. A finding of satisfied indicates that the assessment objective has been met, producing a fully acceptable result. A finding of other than satisfied indicates that there are potential anomalies that may need to be addressed by the organization. A finding of other than satisfied may also indicate that the assessor was unable to obtain sufficient information to make the determination called for in the determination statement.

Building an effective assurance case to determine compliance with security requirements involves compiling evidence from a variety of sources and conducting different types of activities during an assessment. An assurance case is a body of evidence organized into an argument demonstrating that some claim about a system is true. For security assessments conducted using the procedures in this publication, that claim is “compliance” with the security requirements in SP 800-171. Assessors obtain evidence during security assessments to allow designated officials4 to make objective determinations about compliance with the security requirements. The evidence needed to make such determinations can be obtained from various sources, including independent, third-party assessments or other types of assessments, depending on the needs of the organization establishing the requirements and the organization conducting the assessments.

For example, many technical security requirements are satisfied by security capabilities that are built into commercial information technology products and systems. Product assessments are typically conducted by independent, third-party testing organizations.5 These assessments examine the security functions of products and established configuration settings. Assessments can also be conducted to demonstrate compliance with industry, national, or international security standards as well as developer and vendor claims. Since many information technology products are assessed by commercial testing organizations and then subsequently deployed in hundreds of thousands of systems, these types of assessments can be carried out at a greater level of depth and provide deeper insights into the security capabilities of the products.

The evidence needed to determine compliance with the security requirements is obtained by assessing the implementation of the safeguards and countermeasures selected to satisfy the requirements. Assessors can build on previously developed materials that started with the specification of the information security needs of the organization and were further improved during the design, development, and implementation of the system. These materials provide the initial evidence for an assurance case.

Assessments can be conducted by system developers, system integrators, auditors, system owners, or the security staffs of organizations. The assessors or assessment teams bring available information about the system together, such as the results of component product assessments. The assessors can conduct additional system-level assessments using the assessment methods and procedures contained in this publication and the implementation information provided by the nonfederal organization in its system security plan. Assessments can be used to compile and evaluate the evidence needed by organizations to help determine the effectiveness of the safeguards implemented to protect CUI, the actions needed to mitigate security risks to the organization, and compliance with the security requirements.

This section provides assessment procedures for the security requirements defined in NIST SP 800-171 [3]. Organizations that conduct security requirement assessments can develop their security assessment plans by using the information provided in the assessment procedures and selecting the specific assessment methods and objects that meet the organization’s needs. Organizations also have flexibility in defining the level of rigor and detail associated with the assessment based on the assurance requirements of the organization.

Determine if:

A.03.01.01.ODP[01]: the time period for account inactivity before disabling is defined.

A.03.01.01.ODP[02]: the time period within which to notify account managers and designated personnel or roles when accounts are no longer required is defined.

A.03.01.01.ODP[03]: the time period within which to notify account managers and designated personnel or roles when users are terminated or transferred is defined.

A.03.01.01.ODP[04]: the time period within which to notify account managers and designated personnel or roles when system usage or the need-to-know changes for an individual is defined.

A.03.01.01.ODP[05]: the time period of expected inactivity requiring users to log out of the system is defined.

A.03.01.01.ODP[06]: circumstances requiring users to log out of the system are defined.

A.03.01.01.a[01]: system account types allowed are defined.

A.03.01.01.a[02]: system account types prohibited are defined.

A.03.01.01.b[01]: system accounts are created in accordance with organizational policy, procedures, prerequisites, and criteria.

A.03.01.01.b[02]: system accounts are enabled in accordance with organizational policy, procedures, prerequisites, and criteria.

A.03.01.01.b[03]: system accounts are modified in accordance with organizational policy, procedures, prerequisites, and criteria.

A.03.01.01.b[04]: system accounts are disabled in accordance with organizational policy, procedures, prerequisites, and criteria.

A.03.01.01.b[05]: system accounts are removed in accordance with organizational policy, procedures, prerequisites, and criteria.

A.03.01.01.c.01: authorized users of the system are specified.

A.03.01.01.c.02: group and role memberships are specified.

A.03.01.01.c.03: access authorizations (i.e., privileges) for each account are specified.

A.03.01.01.d.01: access to the system is authorized based on a valid access authorization.

A.03.01.01.d.02: access to the system is authorized based on intended system usage.

A.03.01.01.e: the use of system accounts is monitored.

A.03.01.01.f.01: system accounts are disabled when the accounts have expired.

A.03.01.01.f.02: system accounts are disabled when the accounts have been inactive for <A.03.01.01.ODP[01]: time period>.

A.03.01.01.f.03: system accounts are disabled when the accounts are no longer associated with a user or individual.

A.03.01.01.f.04: system accounts are disabled when the accounts violate organizational policy.

A.03.01.01.f.05: system accounts are disabled when significant risks associated with individuals are discovered.

A.03.01.01.g.01: account managers and designated personnel or roles are notified within <A.03.01.01.ODP[02]: time period> when accounts are no longer required.

A.03.01.01.g.02: account managers and designated personnel or roles are notified within <A.03.01.01.ODP[03]: time period> when users are terminated or transferred.

A.03.01.01.g.03: account managers and designated personnel or roles are notified within <A.03.01.01.ODP[04]: time period> when system usage or the need-to-know changes for an individual.

A.03.01.01.h: users are required to log out of the system after <A.03.01.01.ODP[05]: time period> of expected inactivity or when the following circumstances occur: <A.03.01.01.ODP[06]: circumstances>.

[SELECT FROM: access control policy and procedures; personnel termination or transfer policies and procedures; procedures for account management; list of active system accounts and the name of the individual associated with each account; system design documentation; list of conditions for group and role membership; system configuration settings; notifications of recent transfers, separations, or terminations of employees; list of recently disabled system accounts and the name of the individual associated with each account; list of user activities that pose significant organizational risks; access authorization records; account management compliance reviews; system monitoring and audit records; system security plan; system-generated list of accounts removed; system-generated list of emergency accounts disabled; system-generated list of disabled accounts; other relevant documents and records]

[SELECT FROM: personnel with account management responsibilities; system administrators; personnel with information security responsibilities; system developers]

[SELECT FROM: processes for account management on the system; mechanisms for implementing account management]

Source Assessment Procedures: AC-02, AC-02(03), AC-02(05), AC-02(13)

Determine if:

A.03.01.02[01]: approved authorizations for logical access to CUI are enforced in accordance with applicable access control policies.

A.03.01.02[02]: approved authorizations for logical access to system resources are enforced in accordance with applicable access control policies.

[SELECT FROM: access control policy and procedures; procedures for access enforcement; system design documentation; system configuration settings; list of approved authorizations (i.e., user privileges); system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with access enforcement responsibilities; system administrators; personnel with information security responsibilities; system developers]

[SELECT FROM: mechanisms for implementing the access control policy]

Source Assessment Procedure: AC-03

Determine if:

A.03.01.03[01]: approved authorizations are enforced for controlling the flow of CUI within the system.

A.03.01.03[02]: approved authorizations are enforced for controlling the flow of CUI between connected systems.

[SELECT FROM: access control policy and procedures; information flow control policies; procedures for information flow enforcement; security architecture and design documentation; system configuration settings; system baseline configuration; system audit records; list of information flow authorizations; system security plan; other relevant documents or records]

[SELECT FROM: system administrators; personnel with security architecture responsibilities; personnel with information security responsibilities; system developers]

[SELECT FROM: mechanisms for implementing the information flow enforcement policy]

Source Assessment Procedure: AC-04

Determine if:

A.03.01.04.a: duties of individuals requiring separation are identified.

A.03.01.04.b: system access authorizations to support separation of duties are defined.

[SELECT FROM: access control policy and procedures; procedures for the separation of duties and the division of responsibilities; system configuration settings; system audit records; system access authorizations; list of divisions of responsibility and separation of duties; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for defining the separation of duties and the division of responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: mechanisms for implementing the separation of duties policy]

Source Assessment Procedure: AC-05

Determine if:

A.03.01.05.ODP[01]: security functions for authorized access are defined.

A.03.01.05.ODP[02]: security-relevant information for authorized access is defined.

A.03.01.05.ODP[03]: the frequency at which to review the privileges assigned to roles or classes of users is defined.

A.03.01.05.a: system access for users (or processes acting on behalf of users) is authorized only when necessary to accomplish assigned organizational tasks.

A.03.01.05.b[01]: access to <A.03.01.05.ODP[01]: security functions> is authorized.

A.03.01.05.b[02]: access to <A.03.01.05.ODP[02]: security-relevant information> is authorized.

A.03.01.05.c: the privileges assigned to roles or classes of users are reviewed <A.03.01.05.ODP[03]: frequency> to validate the need for such privileges.

A.03.01.05.d: privileges are reassigned or removed, as necessary.

[SELECT FROM: access control policy and procedures; procedures for least privilege; list of assigned access authorizations (i.e., privileges); system configuration settings; system audit records; list of security functions (implemented in hardware, software, and firmware); security-relevant information for which access must be explicitly authorized; list of system-generated roles or classes of users and assigned privileges; validation reviews of privileges assigned to roles or classes of users; records of privilege removals or reassignments for roles or classes of users; system security plan; system design documentation; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for defining least privileges; personnel with information security responsibilities; system administrators]

[SELECT FROM: mechanisms for implementing least privilege functions; mechanisms for implementing reviews of user privileges]

Source Assessment Procedures: AC-06, AC-06(01), AC-06(07), AU-09(04)

Determine if:

A.03.01.06.ODP[01]: personnel or roles to which privileged accounts on the system are to be restricted are defined.

A.03.01.06.a: privileged accounts on the system are restricted to <A.03.01.06.ODP[01]: personnel or roles>.

A.03.01.06.b: users (or roles) with privileged accounts are required to use non-privileged accounts when accessing non-security functions or non-security information.

[SELECT FROM: access control policy and procedures; procedures for least privilege; list of system-generated privileged accounts; list of system administration personnel; system audit records; system configuration settings; system security plan; list of system-generated security functions or security-relevant information assigned to system accounts or roles; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for defining least privileges; personnel with information security responsibilities; system administrators]

[SELECT FROM: mechanisms for implementing least privilege functions]

Source Assessment Procedures: AC-06(02), AC-06(05)

Determine if:

A.03.01.07.a: non-privileged users are prevented from executing privileged functions.

A.03.01.07.b: the execution of privileged functions is logged.

[SELECT FROM: access control policy and procedures; procedures for least privilege; system design documentation; system configuration settings; system audit records; list of audited events; list of privileged functions to be audited and associated user account assignments; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for reviewing least privileges; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for auditing the execution of least privilege functions; mechanisms for implementing least privilege functions for non-privileged users]

Source Assessment Procedures: AC-06(09), AC-06(10)

Determine if:

A.03.01.08.ODP[01]: the number of consecutive invalid logon attempts by a user allowed during a time period is defined.

A.03.01.08.ODP[02]: the time period to which the number of consecutive invalid logon attempts by a user is limited is defined.

A.03.01.08.ODP[03]: one or more of the following PARAMETER VALUES are selected: {the account or node is locked automatically for <A.03.01.08.ODP[04]: time period>; the account or node is locked automatically until released by an administrator; the next logon prompt is delayed automatically; the system administrator is notified automatically; other action is taken automatically}.

A.03.01.08.ODP[04]: the time period for an account or node to be locked is defined (if selected).

A.03.01.08.a: a limit of <A.03.01.08.ODP[01]: number> consecutive invalid logon attempts by a user during <A.03.01.08.ODP[02]: time period> is enforced.

A.03.01.08.b: <A.03.01.08.ODP[03]: SELECTED PARAMETER VALUES> when the maximum number of unsuccessful attempts is exceeded.

[SELECT FROM: access control policy and procedures; procedures for unsuccessful logon attempts; system design documentation; system audit records; system configuration settings; system security plan; other relevant documents or records]

[SELECT FROM: personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for implementing the access control policy for unsuccessful logon attempts]

Source Assessment Procedure: AC-07

Determine if:

A.03.01.09: a system use notification message with privacy and security notices consistent with applicable CUI rules is displayed before granting access to the system.

[SELECT FROM: access control policy and procedures; privacy and security policies, procedures for system use notification; documented approval of system use notification messages; system audit records; user acknowledgements of system use notification messages; system design documentation; system configuration settings; system use notification messages; system security plan; other relevant documents or records]

[SELECT FROM: personnel with information security responsibilities; legal counsel; system developers; system administrators]

[SELECT FROM: mechanisms for implementing system use notifications]

Source Assessment Procedure: AC-08

Determine if:

A.03.01.10.ODP[01]: one or more of the following PARAMETER VALUES are selected: {a device lock is initiated after <A.03.01.10.ODP[02]: time period> of inactivity; the user is required to initiate a device lock before leaving the system unattended}.

A.03.01.10.ODP[02]: the time period of inactivity after which a device lock is initiated is defined (if selected).

A.03.01.10.a: access to the system is prevented by <A.03.01.10.ODP[01]: SELECTED PARAMETER VALUES>.

A.03.01.10.b: the device lock is retained until the user reestablishes access using established identification and authentication procedures.

A.03.01.10.c: information previously visible on the display is concealed via device lock with a publicly viewable image.

[SELECT FROM: access control policy and procedures; procedures for session lock and identification and authentication; system design documentation; system configuration settings; display screen with session lock activated; system security plan; other relevant documents or records]

[SELECT FROM: personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for implementing the access control policy for session lock; session lock mechanisms]

Source Assessment Procedures: AC-11, AC-11(01)

Determine if:

A.03.01.11.ODP[01]: conditions or trigger events that require session disconnect are defined.

A.03.01.11: a user session is terminated automatically after <A.03.01.11.ODP[01]: conditions or trigger events>.

[SELECT FROM: access control policy and procedures; procedures for session termination; system design documentation; system configuration settings; list of conditions or trigger events requiring session disconnect; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: automated mechanisms for implementing user session termination]

Source Assessment Procedure: AC-12

Determine if:

A.03.01.12.a[01]: types of allowable remote system access are defined.

A.03.01.12.a[02]: usage restrictions are established for each type of allowable remote system access.

A.03.01.12.a[03]: configuration requirements are established for each type of allowable remote system access.

A.03.01.12.a[04]: connection requirements are established for each type of allowable remote system access.

A.03.01.12.b: each type of remote system access is authorized prior to establishing such connections.

A.03.01.12.c[01]: remote access to the system is routed through authorized access control points.

A.03.01.12.c[02]: remote access to the system is routed through managed access control points.

A.03.01.12.d[1]: remote execution of privileged commands is authorized.

A.03.01.12.d[2]: remote access to security-relevant information is authorized.

[SELECT FROM: access control policy and procedures; procedures for remote system access; remote system access configuration and connection requirements; configuration management plan; system configuration settings; remote access authorizations; system audit records; system design documentation; procedures for remote access to the system; system monitoring records; list of managed network access control points; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for managing remote access connections; personnel with information security responsibilities; system administrators]

[SELECT FROM: mechanisms for monitoring and controlling remote access methods; mechanisms for routing remote accesses through managed access control points; remote access management capability for the system]

Source Assessment Procedures: AC-17, AC-17(03), AC-17(04)

Addressed by 03.13.08.

Incorporated into 03.01.12.

Incorporated into 03.01.12.

Determine if:

A.03.01.16.a[01]: each type of wireless access to the system is defined.

A.03.01.16.a[02]: usage restrictions are established for each type of wireless access to the system.

A.03.01.16.a[03]: configuration requirements are established for each type of wireless access to the system.

A.03.01.16.a[04]: connection requirements are established for each type of wireless access to the system.

A.03.01.16.b: each type of wireless access to the system is authorized prior to establishing such connections.

A.03.01.16.c: wireless networking capabilities not intended for use are disabled prior to issuance and deployment.

A.03.01.16.d[01]: wireless access to the system is protected using authentication.

A.03.01.16.d[02]: wireless access to the system is protected using encryption.

[SELECT FROM: access control policy and procedures; procedures for wireless system access; wireless system access configuration and connection requirements; configuration management plan; system configuration settings; wireless access authorizations; system audit records; system design documentation; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for managing wireless access connections; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: wireless access management capability for the system; mechanisms for implementing wireless access protections to the system; mechanisms for managing the disabling of wireless networking capabilities]

Source Assessment Procedures: AC-18, AC-18(01), AC-18(03)

Incorporated into 03.01.16.

Determine if:

A.03.01.18.a[01]: usage restrictions are established for mobile devices.

A.03.01.18.a[02]: configuration requirements are established for mobile devices.

A.03.01.18.a[03]: connection requirements are established for mobile devices.

A.03.01.18.b: the connection of mobile devices to the system is authorized.

A.03.01.18.c: full-device or container-based encryption is implemented to protect the confidentiality of CUI on mobile devices.

[SELECT FROM: access control policy and procedures; procedures for mobile device access control; system design documentation; configuration management plan; system configuration settings; authorizations for mobile device connections to organizational systems; system audit records; encryption mechanisms and associated configuration documentation; system security plan; other relevant documents or records]

[SELECT FROM: personnel with access control responsibilities for mobile devices; personnel using mobile devices to access organizational systems; personnel with information security responsibilities; system administrators]

[SELECT FROM: access control capability for mobile device connections to organizational systems; encryption mechanisms for protecting the confidentiality of CUI on mobile devices; configurations of mobile devices]

Source Assessment Procedures: AC-19, AC-19(05)

Incorporated into 03.01.18.

Determine if:

A.03.01.20.ODP[01]: security requirements to be satisfied on external systems prior to allowing the use of or access to those systems by authorized individuals are defined.

A.03.01.20.a: the use of external systems is prohibited unless the systems are specifically authorized.

A.03.01.20.b: the following security requirements to be satisfied on external systems prior to allowing the use of or access to those systems by authorized individuals are established: <A.03.01.20.ODP[01]: security requirements>.

A.03.01.20.c.01: authorized individuals are permitted to use external systems to access the organizational system or to process, store, or transmit CUI only after verifying that the security requirements on the external systems as specified in the organization’s system security plans have been satisfied.

A.03.01.20.c.02: authorized individuals are permitted to use external systems to access the organizational system or to process, store, or transmit CUI only after retaining approved system connection or processing agreements with the organizational entity hosting the external systems.

A.03.01.20.d: the use of organization-controlled portable storage devices by authorized individuals on external systems is restricted.

[SELECT FROM: access control policy and procedures; procedures for the use of external systems; terms and conditions for the use of external systems; external systems security requirements; list of types of applications accessible from external systems; system configuration settings; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for defining terms, conditions, and security requirements for the use of external systems; personnel with information security responsibilities; system administrators]

[SELECT FROM: mechanisms for implementing or enforcing terms, conditions, and security requirements for the use of external systems]

Source Assessment Procedures: AC-20, AC-20(01), AC-20(02)

Incorporated into 03.01.20.

Determine if:

A.03.01.22.a: authorized individuals are trained to ensure that publicly accessible information does not contain CUI.

A.03.01.22.b[01]: the content on publicly accessible systems is reviewed for CUI.

A.03.01.22.b[02]: CUI is removed from publicly accessible systems, if discovered.

[SELECT FROM: access control policy and procedures; procedures for publicly accessible content; list of users authorized to post publicly accessible content on organizational systems; training materials or records; records of publicly accessible information reviews; records of response to CUI discovered on public websites; system audit logs; security awareness training records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for managing publicly accessible information posted on organizational systems; personnel with information security responsibilities]

[SELECT FROM: mechanisms for implementing the management of publicly accessible content]

Source Assessment Procedure: AC-22

Determine if:

A.03.02.01.ODP[01]: the frequency at which to provide security literacy training to system users after initial training is defined.

A.03.02.01.ODP[02]: events that require security literacy training for system users are defined.

A.03.02.01.ODP[03]: the frequency at which to update security literacy training content is defined.

A.03.02.01.ODP[04]: events that require security literacy training content updates are defined.

A.03.02.01.a.01[01]: security literacy training is provided to system users as part of initial training for new users.

A.03.02.01.a.01[02]: security literacy training is provided to system users <A.03.02.01.ODP[01]: frequency> after initial training.

A.03.02.01.a.02: security literacy training is provided to system users when required by system changes or following <A.03.02.01.ODP[02]: events>.

A.03.02.01.a.03[01]: security literacy training is provided to system users on recognizing indicators of insider threat.

A.03.02.01.a.03[02]: security literacy training is provided to system users on reporting indicators of insider threat.

A.03.02.01.a.03[03]: security literacy training is provided to system users on recognizing indicators of social engineering.

A.03.02.01.a.03[04]: security literacy training is provided to system users on reporting indicators of social engineering.

A.03.02.01.a.03[05]: security literacy training is provided to system users on recognizing indicators of social mining.

A.03.02.01.a.03[06]: security literacy training is provided to system users on reporting indicators of social mining.

A.03.02.01.b[01]: security literacy training content is updated <A.03.02.01.ODP[03]: frequency>.

A.03.02.01.b[02]: security literacy training content is updated following <A.03.02.01.ODP[04]: events>.

[SELECT FROM: security literacy training and awareness policy and procedures; procedures for security literacy training and awareness implementation; codes of federal regulations; security literacy and awareness training curriculum; security literacy and awareness training materials; training records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for security literacy training and awareness; personnel comprising the general system user community; personnel with information security responsibilities]

[SELECT FROM: mechanisms for managing information security literacy training and awareness]

Source Assessment Procedures: AT-02, AT-02(02), AT-02(03)

Determine if:

A.03.02.02.ODP[01]: the frequency at which to provide role-based security training to assigned personnel after initial training is defined.

A.03.02.02.ODP[02]: events that require role-based security training are defined.

A.03.02.02.ODP[03]: the frequency at which to update role-based security training content is defined.

A.03.02.02.ODP[04]: events that require role-based security training content updates are defined.

A.03.02.02.a.01[01]: role-based security training is provided to organizational personnel before authorizing access to the system or CUI.

A.03.02.02.a.01[02]: role-based security training is provided to organizational personnel before performing assigned duties.

A.03.02.02.a.01[03]: role-based security training is provided to organizational personnel <A.03.02.02.ODP[01]: frequency> after initial training.

A.03.02.02.a.02: role-based security training is provided to organizational personnel when required by system changes or following <A.03.02.02.ODP[02]: events>.

A.03.02.02.b[01]: role-based security training content is updated <A.03.02.02.ODP[03]: frequency>.

A.03.02.02.b[02]: role-based security training content is updated following <A.03.02.02.ODP[04]: events>.

[SELECT FROM: security awareness and training policy and procedures; procedures for security training implementation; codes of federal regulations; security training curriculum; security training materials; training records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for role-based security training; personnel with assigned system security roles and responsibilities]

[SELECT FROM: mechanisms for managing role-based security training and awareness]

Source Assessment Procedure: AT-03

Incorporated into 03.02.01.

Determine if:

A.03.03.01.ODP[01]: event types selected for logging within the system are defined.

A.03.03.01.ODP[02]: the frequency of event types selected for logging are reviewed and updated.

A.03.03.01.a: the following event types are specified for logging within the system: <A.03.03.01.ODP[01]: event types>.

A.03.03.01.b[01]: the event types selected for logging are reviewed <A.03.03.01.ODP[02]: frequency>.

A.03.03.01.b[02]: the event types selected for logging are updated <A.03.03.01.ODP[02]: frequency>.

[SELECT FROM: audit and accountability policy and procedures; procedures for auditable events; system design documentation; system configuration settings; system audit records; system auditable events; system security plan; other relevant documents or records]

[SELECT FROM: personnel with audit and accountability responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: mechanisms for implementing system auditing]

Source Assessment Procedure: AU-02

Determine if:

A.03.03.02.a.01: audit records contain information that establishes what type of event occurred.

A.03.03.02.a.02: audit records contain information that establishes when the event occurred.

A.03.03.02.a.03: audit records contain information that establishes where the event occurred.

A.03.03.02.a.04: audit records contain information that establishes the source of the event.

A.03.03.02.a.05: audit records contain information that establishes the outcome of the event.

A.03.03.02.a.06: audit records contain information that establishes the identity of the individuals, subjects, objects, or entities associated with the event.

A.03.03.02.b: additional information for audit records is provided, as needed.

[SELECT FROM: audit and accountability policy and procedures; procedures for the content of audit records; list of organization-defined auditable events; system design documentation; system configuration settings; system audit records; system incident reports; system security plan; other relevant documents or records]

[SELECT FROM: personnel with audit and accountability responsibilities; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for implementing system auditing of auditable events; system audit capability]

Source Assessment Procedures: AU-03, AU-03(01)

Determine if:

A.03.03.03.a: audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02 are generated.

A.03.03.03.b: audit records are retained for a time period consistent with the records retention policy.

[SELECT FROM: audit and accountability policy and procedures; procedures for audit record generation; system design documentation; list of auditable events; system audit records; audit record retention policy and procedures; organization-defined retention period for audit records; audit record archives; system configuration settings; system security plan; other relevant documents or records]

[SELECT FROM: personnel with audit record generation responsibilities; personnel with audit record retention responsibilities; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for implementing the audit record generation capability]

Source Assessment Procedures: AU-11, AU-12

Determine if:

A.03.03.04.ODP[01]: the time period for organizational personnel or roles receiving audit logging process failure alerts is defined.

A.03.03.04.ODP[02]: additional actions to be taken in the event of an audit logging process failure are defined.

A.03.03.04.a: organizational personnel or roles are alerted in the event of an audit logging process failure within <A.03.03.04.ODP[01]: time period>.

A.03.03.04.b: the following additional actions are taken: <A.03.03.04.ODP[02]: additional actions>.

[SELECT FROM: audit and accountability policy and procedures; procedures for responding to audit processing failures; system design documentation; system configuration settings; list of personnel to be notified in case of an audit processing failure; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with audit and accountability responsibilities; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for implementing system response to audit processing failures]

Source Assessment Procedure: AU-05

Determine if:

A.03.03.05.ODP[01]: the frequency at which system audit records are reviewed and analyzed is defined.

A.03.03.05.a: system audit records are reviewed and analyzed <A.03.03.05.ODP[01]: frequency> for indications and the potential impact of inappropriate or unusual activity.

A.03.03.05.b: findings are reported to organizational personnel or roles.

A.03.03.05.c[01]: audit records across different repositories are analyzed to gain organization-wide situational awareness.

A.03.03.05.c[02]: audit records across different repositories are correlated to gain organization-wide situational awareness.

[SELECT FROM: audit and accountability policy and procedures; procedures for audit record review, analysis, and reporting; reports of audit record findings; records of actions taken in response to reviews and analyses of audit records; system design documentation; system audit records across different repositories; system security plan; system configuration settings; other relevant documents or records]

[SELECT FROM: personnel with audit record review, analysis, and reporting responsibilities; personnel with information security responsibilities]

[SELECT FROM: mechanisms for supporting the analysis and correlation of audit records]

Source Assessment Procedures: AU-06, AU-06(03)

Determine if:

A.03.03.06.a[01]: an audit record reduction and report generation capability that supports audit record review is implemented.

A.03.03.06.a[02]: an audit record reduction and report generation capability that supports audit record analysis is implemented.

A.03.03.06.a[03]: an audit record reduction and report generation capability that supports audit record reporting requirements is implemented.

A.03.03.06.a[04]: an audit record reduction and report generation capability that supports after-the-fact investigations of incidents is implemented.

A.03.03.06.b[01]: the original content of audit records is preserved.

A.03.03.06.b[02]: the original time ordering of audit records is preserved.

[SELECT FROM: audit and accountability policy and procedures; procedures for audit record reduction and report generation; audit record reduction, review, analysis, and reporting tools; system audit records; system design documentation; system configuration settings; system security plan; other relevant documents or records]

[SELECT FROM: personnel with audit record reduction and report generation responsibilities; personnel with information security responsibilities]

[SELECT FROM: mechanisms for supporting audit record reduction and report generation capability]

Source Assessment Procedure: AU-07

Determine if:

A.03.03.07.ODP[01]: granularity of time measurement for audit record time stamps is defined.

A.03.03.07.a: internal system clocks are used to generate time stamps for audit records.

A.03.03.07.b[01]: time stamps are recorded for audit records that meet <A.03.03.07.ODP[01]: granularity of time measurement>.

A.03.03.07.b[02]: time stamps are recorded for audit records that use Coordinated Universal Time (UTC), have a fixed local time offset from UTC, or include the local time offset as part of the time stamp.

[SELECT FROM: audit and accountability policy and procedures; procedures for timestamp generation; system design documentation; system configuration settings; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for implementing timestamp generation]

Source Assessment Procedure: AU-08

Determine if:

A.03.03.08.a[01]: audit information is protected from unauthorized access, modification, and deletion.

A.03.03.08.a[02]: audit logging tools are protected from unauthorized access, modification, and deletion.

A.03.03.08.b: access to management of audit logging functionality is authorized to only a subset of privileged users or roles.

[SELECT FROM: audit and accountability policy and procedures; access control policy and procedures; procedures for the protection of audit information; system configuration settings; system audit records; audit tools; system-generated list of privileged users with access to the management of audit functionality; access authorizations; access control list; system design documentation; system security plan; other relevant documents or records]

[SELECT FROM: personnel with audit and accountability responsibilities; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for implementing audit information protection; mechanisms for managing access to audit functionality]

Source Assessment Procedures: AU-09, AU-09(04)

Incorporated into 03.03.08.

Determine if:

A.03.04.01.ODP[01]: the frequency of baseline configuration review and update is defined.

A.03.04.01.a[01]: a current baseline configuration of the system is developed.

A.03.04.01.a[02]: a current baseline configuration of the system is maintained under configuration control.

A.03.04.01.b[01]: the baseline configuration of the system is reviewed <A.03.04.01.ODP[01]: frequency>.

A.03.04.01.b[02]: the baseline configuration of the system is updated <A.03.04.01.ODP[01]: frequency>.

A.03.04.01.b[03]: the baseline configuration of the system is reviewed when system components are installed or modified.

A.03.04.01.b[04]: the baseline configuration of the system is updated when system components are installed or modified.

[SELECT FROM: configuration management policy and procedures; procedures for the baseline system configuration; configuration management plan; enterprise architecture; system design documentation; system architecture; system configuration settings; system component inventory; change control records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with configuration management responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for managing baseline configurations; mechanisms for supporting configuration control of the baseline configuration]

Source Assessment Procedure: CM-02

Determine if:

A.03.04.02.ODP[01]: configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are defined.

A.03.04.02.a[01]: the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are established and documented: <A.03.04.02.ODP[01]: configuration settings>.

A.03.04.02.a[02]: the following configuration settings for the system are implemented: <A.03.04.02.ODP[01]: configuration settings>.

A.03.04.02.b[01]: any deviations from established configuration settings are identified and documented.

A.03.04.02.b[02]: any deviations from established configuration settings are approved.

[SELECT FROM: configuration management policy and procedures; procedures for system configuration settings; configuration management plan; system design documentation; system configuration settings; common secure configuration checklists; system component inventory; evidence supporting approved deviations from established configuration settings; change control records; system data processing and retention permissions; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with security configuration management responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for managing configuration settings; mechanisms that implement, monitor, or control system configuration settings; mechanisms that identify or document deviations from established configuration settings]

Source Assessment Procedure: CM-06

Determine if:

A.03.04.03.a: the types of changes to the system that are configuration-controlled are defined.

A.03.04.03.b[01]: proposed configuration-controlled changes to the system are reviewed with explicit consideration for security impacts.

A.03.04.03.b[02]: proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security impacts.

A.03.04.03.c[01]: approved configuration-controlled changes to the system are implemented.

A.03.04.03.c[02]: approved configuration-controlled changes to the system are documented.

A.03.04.03.d[01]: activities associated with configuration-controlled changes to the system are monitored.

A.03.04.03.d[02]: activities associated with configuration-controlled changes to the system are reviewed.

[SELECT FROM: configuration management policy and procedures; procedures for system configuration change control; configuration management plan; system architecture; configuration settings; change control records; system audit records; change control audit and review reports; agenda, minutes, and documentation from configuration change control oversight meetings; system security plan; other relevant documents or records]

[SELECT FROM: personnel with configuration change control responsibilities; personnel with information security responsibilities; members of change control board or similar; system administrators]

[SELECT FROM: processes for configuration change control; mechanisms that implement configuration change control]

Source Assessment Procedure: CM-03

Determine if:

A.03.04.04.a: changes to the system are analyzed to determine potential security impacts prior to change implementation.

A.03.04.04.b: the security requirements for the system continue to be satisfied after the system changes have been implemented.

[SELECT FROM: configuration management policy and procedures; procedures for security impact analyses for system changes; configuration management plan; security impact analysis documentation; system design documentation; analysis tools and outputs; change control records; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with security impact analysis responsibilities; personnel with information security responsibilities; members of change control board; system developers; system administrators]

[SELECT FROM: processes for security impact analyses]

Source Assessment Procedure: CM-04, CM-04(02)

Determine if:

A.03.04.05[01]: physical access restrictions associated with changes to the system are defined and documented.

A.03.04.05[02]: physical access restrictions associated with changes to the system are approved.

A.03.04.05[03]: physical access restrictions associated with changes to the system are enforced.

A.03.04.05[04]: logical access restrictions associated with changes to the system are defined and documented.

A.03.04.05[05]: logical access restrictions associated with changes to the system are approved.

A.03.04.05[06]: logical access restrictions associated with changes to the system are enforced.

[SELECT FROM: configuration management policy and procedures; procedures for access restrictions for system changes; configuration management plan; system design documentation; system architecture; system configuration settings; logical access approvals; physical access approvals; access credentials; change control records; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with logical access control responsibilities; personnel with physical access control responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for managing access restrictions for system changes; mechanisms for supporting, implementing, or enforcing access restrictions associated with system changes]

Source Assessment Procedure: CM-05

Determine if:

A.03.04.06.ODP[01]: functions to be prohibited or restricted are defined.

A.03.04.06.ODP[02]: ports to be prohibited or restricted are defined.

A.03.04.06.ODP[03]: protocols to be prohibited or restricted are defined.

A.03.04.06.ODP[04]: connections to be prohibited or restricted are defined.

A.03.04.06.ODP[05]: services to be prohibited or restricted are defined.

A.03.04.06.ODP[06]: the frequency at which to review the system to identify unnecessary or nonsecure functions, ports, protocols, connections, or services is defined.

A.03.04.06.a: the system is configured to provide only mission-essential capabilities.

A.03.04.06.b[01]: the use of the following functions is prohibited or restricted: <A.03.04.06.ODP[01]: functions>.

A.03.04.06.b[02]: the use of the following ports is prohibited or restricted: <A.03.04.06.ODP[02]: ports>.

A.03.04.06.b[03]: the use of the following protocols is prohibited or restricted: <A.03.04.06.ODP[03]: protocols>.

A.03.04.06.b[04]: the use of the following connections is prohibited or restricted: <A.03.04.06.ODP[04]: connections>.

A.03.04.06.b[05]: the use of the following services is prohibited or restricted: <A.03.04.06.ODP[05]: services>.

A.03.04.06.c: the system is reviewed <A.03.04.06.ODP[06]: frequency> to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.

A.03.04.06.d: unnecessary or nonsecure functions, ports, protocols, connections, and services are disabled or removed.

[SELECT FROM: configuration management policy and procedures; procedures for least functionality in the system; configuration management plan; system design documentation; system configuration settings; system component inventory; common secure configuration checklists; documented reviews of functions, ports, protocols, and services; change control records; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with configuration management responsibilities; personnel with responsibilities for reviewing functions, ports, protocols, and services; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: processes for prohibiting or restricting functions, ports, protocols, and services; processes for reviewing or disabling functions, ports, protocols, and services; mechanisms for implementing the review and disabling of functions, ports, protocols, and services; mechanisms for implementing restrictions on or the prohibition of functions, ports, protocols, and services]

Source Assessment Procedures: CM-07, CM-07(01)

Incorporated into 03.04.06 and 03.04.08.

Determine if:

A.03.04.08.ODP[01]: the frequency at which to review and update the list of authorized software programs is defined.

A.03.04.08.a: software programs authorized to execute on the system are identified.

A.03.04.08.b: a deny-all, allow-by-exception policy for the execution of authorized software programs on the system is implemented.

A.03.04.08.c: the list of authorized software programs is reviewed and updated <A.03.04.08.ODP[01]: frequency>.

[SELECT FROM: configuration management policy and procedures; procedures for least functionality in the system; configuration management plan; system design documentation; system configuration settings; list of software programs authorized to execute on the system; system component inventory; records associated with the review and update of the list of authorized software programs; common secure configuration checklists; change control records; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for identifying software authorized to execute on the system; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for identifying, reviewing, and updating programs authorized to execute on the system; processes for implementing authorized software policy; mechanisms for supporting or implementing authorized software policy]

Source Assessment Procedure: CM-07(05)

Addressed by 03.01.05, 03.01.06, 03.01.07, 03.04.08, and 03.12.03.

Determine if:

A.03.04.10.ODP[01]: the frequency at which to review and update the system component inventory is defined.

A.03.04.10.a: an inventory of system components is developed and documented.

A.03.04.10.b[01]: the system component inventory is reviewed <A.03.04.10.ODP[01]: frequency>.

A.03.04.10.b[02]: the system component inventory is updated <A.03.04.10.ODP[01]: frequency>.

A.03.04.10.c[01]: the system component inventory is updated as part of component installations.

A.03.04.10.c[02]: the system component inventory is updated as part of component removals.

A.03.04.10.c[03]: the system component inventory is updated as part of system updates.

[SELECT FROM: configuration management policy and procedures; procedures for system component inventory; configuration management plan; system design documentation; system component inventory; inventory reviews and update records; component installation records; change control records; component removal records; system change records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with component inventory management responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for managing the system component inventory; mechanisms for supporting or implementing the system component inventory; processes for updating the system component inventory; mechanisms for supporting or implementing the system component inventory updates]

Source Assessment Procedures: CM-08, CM-08(01)

Determine if:

A.03.04.11.a[01]: the location of CUI is identified and documented.

A.03.04.11.a[02]: the system components on which CUI is processed are identified and documented.

A.03.04.11.a[03]: the system components on which CUI is stored are identified and documented.

A.03.04.11.b[01]: changes to the system or system component location where CUI is processed are documented.

A.03.04.11.b[02]: changes to the system or system component location where CUI is stored are documented.

[SELECT FROM: configuration management policy and procedures; configuration management plan; procedures for identification and documentation of information location; system audit records; architecture documentation; system design documentation; list of users with system and system component access; change control records; system component inventory; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for managing information location and user access; personnel with responsibilities for operating, using, or maintaining the system; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: processes governing information location; mechanisms for enforcing policies and methods for governing information location]

Source Assessment Procedure: CM-12

Determine if:

A.03.04.12.ODP[01]: configurations for systems or system components to be issued to individuals traveling to high-risk locations are defined.

A.03.04.12.ODP[02]: security requirements to be applied to the system or system components when individuals return from travel are defined.

A.03.04.12.a: systems or system components with the following configurations are issued to individuals traveling to high-risk locations: <A.03.04.12.ODP[01]: configurations>.

A.03.04.12.b: the following security requirements are applied to the system or system components when the individuals return from travel: <A.03.04.12.ODP[02]: security requirements>.

[SELECT FROM: configuration management policy and procedures; configuration management plan; procedures for the baseline configuration of the system; procedures for system component installations and upgrades; system component inventory; system component installations or upgrades and associated records; records of system baseline configuration reviews and updates; system configuration settings; system architecture; change control records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with configuration management responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for managing baseline configurations]

Source Assessment Procedure: CM-02(07)

Determine if:

A.03.05.01.ODP[01]: circumstances or situations that require re-authentication are defined.

A.03.05.01.a[01]: system users are uniquely identified.

A.03.05.01.a[02]: system users are authenticated.

A.03.05.01.a[03]: processes acting on behalf of users are associated with uniquely identified and authenticated system users.

A.03.05.01.b: users are reauthenticated when <A.03.05.01.ODP[01]: circumstances or situations>.

[SELECT FROM: identification and authentication policy and procedures; list of circumstances or situations requiring re-authentication; system design documentation; system configuration settings; system audit records; list of system accounts; system security plan; other relevant documents or records]

[SELECT FROM: personnel with identification and authentication responsibilities; personnel with system operations responsibilities; personnel with account management responsibilities; system developers; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for uniquely identifying and authenticating users; mechanisms for supporting or implementing identification and authentication capabilities]

Source Assessment Procedures: IA-02, IA-11

Determine if:

A.03.05.02.ODP[01]: devices or types of devices to be uniquely identified and authenticated before establishing a connection are defined.

A.03.05.02[01]: <A.03.05.02.ODP[01]: devices or types of devices> are uniquely identified before establishing a system connection.

A.03.05.02[02]: <A.03.05.02.ODP[01]: devices or types of devices> are authenticated before establishing a system connection.

[SELECT FROM: identification and authentication policy and procedures; procedures for device identification and authentication; system design documentation; list of devices requiring unique identification and authentication; device connection reports; system configuration settings; system security plan; other relevant documents or records]

[SELECT FROM: personnel with responsibilities for device identification and authentication; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for supporting or implementing device identification and authentication capabilities]

Source Assessment Procedure: IA-03

Determine if:

A.03.05.03[01]: multi-factor authentication for access to privileged accounts is implemented.

A.03.05.03[02]: multi-factor authentication for access to non-privileged accounts is implemented.

[SELECT FROM: identification and authentication policy and procedures; system design documentation; list of system accounts; system configuration settings; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system operations responsibilities; personnel with account management responsibilities; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for supporting or implementing a multi-factor authentication capability]

Source Assessment Procedures: IA-02(01), IA-02(02)

Determine if:

A.03.05.04[01]: replay-resistant authentication mechanisms for access to privileged accounts are implemented.

A.03.05.04[02]: replay-resistant authentication mechanisms for access to non-privileged accounts are implemented.

[SELECT FROM: identification and authentication policy and procedures; system design documentation; system audit records; system configuration settings; list of privileged system accounts; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system operations responsibilities; personnel with account management responsibilities; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for supporting or implementing identification and authentication capabilities; mechanisms for supporting or implementing replay-resistance]

Source Assessment Procedure: IA-02(08)

Determine if:

A.03.05.05.ODP[01]: the time period for preventing the reuse of identifiers is defined.

A.03.05.05.ODP[02]: characteristics used to identify individual status are defined.

A.03.05.05.a: authorization is received from organizational personnel or roles to assign an individual, group, role, service, or device identifier.

A.03.05.05.b[01]: an identifier that identifies an individual, group, role, service, or device is selected.

A.03.05.05.b[02]: an identifier that identifies an individual, group, role, service, or device is assigned.

A.03.05.05.c: the reuse of identifiers for <A.03.05.05.ODP[01]: time period> is prevented.

A.03.05.05.d: individual identifiers are managed by uniquely identifying each individual as <A.03.05.05.ODP[02]: characteristic>.

[SELECT FROM: identification and authentication policy and procedures; procedures for identifier management; procedures for account management; system design documentation; list of system accounts; list of characteristics identifying individual status; system configuration settings; list of identifiers generated from physical access control devices; system security plan; other relevant documents or records]

[SELECT FROM: personnel with identifier management responsibilities; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for supporting or implementing identifier management]

Source Assessment Procedures: IA-04, IA-04(04)

Consistency with SP 800-53 [8].

Determine if:

A.03.05.07.ODP[01]: the frequency at which to update the list of commonly used, expected, or compromised passwords is defined.

A.03.05.07.ODP[02]: password composition and complexity rules are defined.

A.03.05.07.a[01]: a list of commonly used, expected, or compromised passwords is maintained.

A.03.05.07.a[02]: a list of commonly used, expected, or compromised passwords is updated <A.03.05.07.ODP[01]: frequency>.

A.03.05.07.a[03]: a list of commonly used, expected, or compromised passwords is updated when organizational passwords are suspected to have been compromised.

A.03.05.07.b: passwords are verified not to be found on the list of commonly used, expected, or compromised passwords when they are created or updated by users.

A.03.05.07.c: passwords are only transmitted over cryptographically protected channels.

A.03.05.07.d: passwords are stored in a cryptographically protected form.

A.03.05.07.e: a new password is selected upon first use after account recovery.

A.03.05.07.f: the following composition and complexity rules for passwords are enforced: <A.03.05.07.ODP[02]: rules>.

[SELECT FROM: identification and authentication policy and procedures; password policy; procedures for authenticator management; system design documentation; system configuration settings; password configurations; system security plan; other relevant documents or records]

[SELECT FROM: personnel with authenticator management responsibilities; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for supporting or implementing a password-based authenticator management capability]

Source Assessment Procedure: IA-05(01)

Consistency with SP 800-53 [8].

Consistency with SP 800-53 [8].

Incorporated into 03.05.07.

Determine if:

A.03.05.11: feedback of authentication information during the authentication process is obscured.

[SELECT FROM: identification and authentication policy and procedures; procedures for authenticator feedback; system design documentation; system configuration settings; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: mechanisms for supporting or implementing the obscuring of feedback of authentication information during authentication]

Source Assessment Procedure: IA-06

Determine if:

A.03.05.12.ODP[01]: the frequency for changing or refreshing authenticators is defined.

A.03.05.12.ODP[02]: events that trigger the change or refreshment of authenticators are defined.

A.03.05.12.a: the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution is verified.

A.03.05.12.b: initial authenticator content for any authenticators issued by the organization is established.

A.03.05.12.c[01]: administrative procedures for initial authenticator distribution are established.

A.03.05.12.c[02]: administrative procedures for lost, compromised, or damaged authenticators are established.

A.03.05.12.c[03]: administrative procedures for revoking authenticators are established.

A.03.05.12.c[04]: administrative procedures for initial authenticator distribution are implemented.

A.03.05.12.c[05]: administrative procedures for lost, compromised, or damaged authenticators are implemented.

A.03.05.12.c[06]: administrative procedures for revoking authenticators are implemented.

A.03.05.12.d: default authenticators are changed at first use.

A.03.05.12.e: authenticators are changed or refreshed <A.03.05.12.ODP[01]: frequency> or when the following events occur: <A.03.05.12.ODP[02]: events>.

A.03.05.12.f[01]: authenticator content is protected from unauthorized disclosure.

A.03.05.12.f[02]: authenticator content is protected from unauthorized modification.

[SELECT FROM: identification and authentication policy and procedures; procedures for authenticator management; system configuration settings; list of system authenticator types; system design documentation; system audit records; change control records associated with managing system authenticators; system security plan; other relevant documents or records]

[SELECT FROM: personnel with authenticator management responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: mechanisms for supporting or implementing the authenticator management capability]

Source Assessment Procedure: IA-05

Determine if:

A.03.06.01[01]: an incident-handling capability that is consistent with the incident response plan is implemented.

A.03.06.01[02]: the incident handling capability includes preparation.

A.03.06.01[03]: the incident handling capability includes detection and analysis.

A.03.06.01[04]: the incident handling capability includes containment.

A.03.06.01[05]: the incident handling capability includes eradication.

A.03.06.01[06]: the incident handling capability includes recovery.

[SELECT FROM: incident response policy and procedures; contingency planning policy and procedures; procedures for incident handling; procedures for incident response planning; incident response plan; contingency plan; records of incident response plan reviews and approvals; system security plan; other relevant documents or records]

[SELECT FROM: personnel with incident handling responsibilities; personnel with incident response planning responsibilities; personnel with contingency planning responsibilities; personnel with information security responsibilities]

[SELECT FROM: incident handling capability for the organization; incident response plan]

Source Assessment Procedure: IR-04

Determine if:

A.03.06.02.ODP[01]: the time period to report suspected incidents to the organizational incident response capability is defined.

A.03.06.02.ODP[02]: authorities to whom incident information is to be reported are defined.

A.03.06.02.a[01]: system security incidents are tracked.

A.03.06.02.a[02]: system security incidents are documented.

A.03.06.02.b: suspected incidents are reported to the organizational incident response capability within <A.03.06.02.ODP[01]: time period>.

A.03.06.02.c: incident information is reported to <A.03.06.02.ODP[02]: authorities>.

A.03.06.02.d: an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.

[SELECT FROM: incident response policy and procedures; procedures for incident monitoring; procedures for incident response assistance; incident response records and documentation; incident response plan; system security plan; other relevant documents or records]

[SELECT FROM: personnel with incident monitoring responsibilities; personnel with incident response assistance and support responsibilities; personnel with information security responsibilities]

[SELECT FROM: processes for incident reporting; incident monitoring capability; mechanisms for supporting or implementing the tracking and documenting of system security incidents; mechanisms for supporting or implementing incident reporting; mechanisms for supporting or implementing incident response assistance; processes for incident response assistance]

Source Assessment Procedures: IR-05, IR-06, IR-07

Determine if:

A.03.06.03.ODP[01]: the frequency at which to test the effectiveness of the incident response capability for the system is defined.

A.03.06.03: the effectiveness of the incident response capability is tested <A.03.06.03.ODP[01]: frequency>.

[SELECT FROM: incident response policy and procedures; contingency planning policy and procedures; procedures for incident response testing; procedures for contingency plan testing; incident response testing material; incident response test results; incident response test plan; incident response plan; contingency plan; system security plan; other relevant documents or records]

[SELECT FROM: personnel with incident response testing responsibilities; personnel with information security responsibilities]

Source Assessment Procedure: IR-03

Determine if:

A.03.06.04.ODP[01]: the time period within which incident response training is to be provided to system users is defined.

A.03.06.04.ODP[02]: the frequency at which to provide incident response training to users after initial training is defined.

A.03.06.04.ODP[03]: the frequency at which to review and update incident response training content is defined.

A.03.06.04.ODP[04]: events that initiate a review of the incident response training content are defined.

A.03.06.04.a.01: incident response training for system users consistent with assigned roles and responsibilities is provided within <A.03.06.04.ODP[01]: time period> of assuming an incident response role or responsibility or acquiring system access.

A.03.06.04.a.02: incident response training for system users consistent with assigned roles and responsibilities is provided when required by system changes.

A.03.06.04.a.03: incident response training for system users consistent with assigned roles and responsibilities is provided <A.03.06.04.ODP[02]: frequency> thereafter.

A.03.06.04.b[01]: incident response training content is reviewed <A.03.06.04.ODP[03]: frequency>.

A.03.06.04.b[02]: incident response training content is updated <A.03.06.04.ODP[03]: frequency>.

A.03.06.04.b[03]: incident response training content is reviewed following <A.03.06.04.ODP[04]: events>.

A.03.06.04.b[04]: incident response training content is updated following <A.03.06.04.ODP[04]: events>.

[SELECT FROM: incident response policy and procedures; procedures for incident response training; incident response training curriculum; incident response training materials; incident response plan; incident response training records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with incident response training and operational responsibilities; personnel with information security responsibilities]

Source Assessment Procedure: IR-02

Determine if:

A.03.06.05.a.01: an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.

A.03.06.05.a.02: an incident response plan is developed that describes the structure and organization of the incident response capability.

A.03.06.05.a.03: an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.

A.03.06.05.a.04: an incident response plan is developed that defines reportable incidents.

A.03.06.05.a.05: an incident response plan is developed that addresses the sharing of incident information.

A.03.06.05.a.06: an incident response plan is developed that designates responsibilities to organizational entities, personnel, or roles.

A.03.06.05.b[01]: copies of the incident response plan are distributed to designated incident response personnel (identified by name or by role).

A.03.06.05.b[02]: copies of the incident response plan are distributed to organizational elements.

A.03.06.05.c: the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing.

A.03.06.05.d: the incident response plan is protected from unauthorized disclosure.

[SELECT FROM: incident response policy; procedures addressing incident response planning; incident response plan; system security plan; records of incident response plan reviews and approvals; other relevant documents or records]

[SELECT FROM: personnel with incident response planning responsibilities; personnel with information security responsibilities]

[SELECT FROM: incident response plan and related processes]

Source Assessment Procedure: IR-08

Recategorized as NCO.

Incorporated into 03.07.04 and 03.07.06.

Incorporated into 03.08.03.

Determine if:

A.03.07.04.a[01]: the use of system maintenance tools is approved.

A.03.07.04.a[02]: the use of system maintenance tools is controlled.

A.03.07.04.a[03]: the use of system maintenance tools is monitored.

A.03.07.04.b: media with diagnostic and test programs are checked for malicious code before the media are used in the system.

A.03.07.04.c: the removal of system maintenance equipment containing CUI is prevented by verifying that there is no CUI on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.

[SELECT FROM: maintenance policy and procedures; procedures for system maintenance tools; system maintenance tools; maintenance tool inspection records; equipment sanitization records; media sanitization records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system maintenance responsibilities; personnel responsible for media sanitization; personnel with information security responsibilities]

[SELECT FROM: processes for approving, controlling, and monitoring maintenance tools; mechanisms for supporting or implementing the approval, control, or monitoring of maintenance tools; processes for preventing the unauthorized removal of information; processes for inspecting media for malicious code; mechanisms for supporting media sanitization or the destruction of equipment; mechanisms for supporting the verification of media sanitization; processes for inspecting maintenance tools; mechanisms for supporting or implementing the inspection of maintenance tools; mechanisms for supporting or implementing the inspection of media used for maintenance]

Source Assessment Procedures: MA-03, MA-03(01), MA-03(02), MA-03(03)

Determine if:

A.03.07.05.a[01]: nonlocal maintenance and diagnostic activities are approved.

A.03.07.05.a[02]: nonlocal maintenance and diagnostic activities are monitored.

A.03.07.05.b[01]: multi-factor authentication is implemented in the establishment of nonlocal maintenance and diagnostic sessions.

A.03.07.05.b[02]: replay resistance is implemented in the establishment of nonlocal maintenance and diagnostic sessions.

A.03.07.05.c[01]: session connections are terminated when nonlocal maintenance is completed.

A.03.07.05.c[02]: network connections are terminated when nonlocal maintenance is completed.

[SELECT FROM: maintenance policy and procedures; remote access policy and procedures; procedures for nonlocal system maintenance; records of remote access; maintenance records; diagnostic records; system design documentation; system configuration settings; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system maintenance responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for managing nonlocal maintenance; mechanisms for implementing, supporting, or managing nonlocal maintenance; mechanisms for implementing multi-factor authentication and replay resistance; mechanisms for terminating nonlocal maintenance sessions and network connections]

Source Assessment Procedure: MA-04

Determine if:

A.03.07.06.a: a process for maintenance personnel authorization is established.

A.03.07.06.b: a list of authorized maintenance organizations or personnel is maintained.

A.03.07.06.c: non-escorted personnel who perform maintenance on the system possess the required access authorizations.

A.03.07.06.d[01]: organizational personnel with required access authorizations are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.

A.03.07.06.d[02]: organizational personnel with required technical competence are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.

[SELECT FROM: maintenance policy and procedures; service provider contracts; service-level agreements; list of authorized personnel; maintenance records; access control records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system maintenance responsibilities; personnel with information security responsibilities]

[SELECT FROM: processes for authorizing and managing maintenance personnel; mechanisms for supporting or implementing the authorization of maintenance personnel]

Source Assessment Procedure: MA-05

Determine if:

A.03.08.01[01]: system media that contain CUI are physically controlled.

A.03.08.01[02]: system media that contain CUI are securely stored.

[SELECT FROM: physical protection policy and procedures; media protection policy and procedures; procedures for media storage; access control policy and procedures; system media; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system media protection and storage responsibilities; personnel with information security responsibilities]

[SELECT FROM: processes for storing information media; mechanisms for supporting or implementing secure media storage/media protection]

Source Assessment Procedure: MP-04

Determine if:

A.03.08.02: access to CUI on system media is restricted to authorized personnel or roles.

[SELECT FROM: physical protection policy and procedures; media protection policy and procedures; procedures for media access restrictions; access control policy and procedures; media storage facilities; access control records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system media protection responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for restricting information on media; mechanisms for supporting or implementing media access restrictions]

Source Assessment Procedure: MP-02

Determine if:

A.03.08.03: system media that contain CUI are sanitized prior to disposal, release out of organizational control, or release for reuse.

[SELECT FROM: media protection policy and procedures; procedures for media sanitization and disposal; applicable standards and policies that address media sanitization policy; system audit records; media sanitization records; system design documentation; system configuration settings; records retention and disposition policy; records retention and disposition procedures; system security plan; other relevant documents or records]

[SELECT FROM: personnel with media sanitization responsibilities; personnel with records retention and disposition responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for media sanitization; mechanisms for supporting or implementing media sanitization]

Source Assessment Procedure: MP-06

Determine if:

A.03.08.04[01]: system media that contain CUI are marked to indicate distribution limitations.

A.03.08.04[02]: system media that contain CUI are marked to indicate handling caveats.

A.03.08.04[03]: system media that contain CUI are marked to indicate applicable CUI markings.

[SELECT FROM: physical protection policy and procedures; media protection policy and procedures; procedures for media marking; list of system media marking security attributes; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system media protection and marking responsibilities; personnel with information security responsibilities]

[SELECT FROM: processes for marking information media; mechanisms for supporting or implementing media marking]

Source Assessment Procedure: MP-03

Determine if:

A.03.08.05.a[01]: system media that contain CUI are protected during transport outside of controlled areas.

A.03.08.05.a[02]: system media that contain CUI are controlled during transport outside of controlled areas.

A.03.08.05.b: accountability for system media that contain CUI is maintained during transport outside of controlled areas.

A.03.08.05.c: activities associated with the transport of system media that contain CUI are documented.

[SELECT FROM: physical protection policy and procedures; media protection policy and procedures; procedures for media storage; access control policy and procedures; authorized personnel list; system media; designated controlled areas; system and communications protection policy and procedures; cryptographic mechanisms and configuration documentation; procedures for the protection of information at rest; system design documentation; system configuration settings; list of information at rest requiring confidentiality protections; system audit records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system media protection and storage responsibilities; personnel with information security responsibilities; system developers; system administrators]

[SELECT FROM: processes for storing information media; mechanisms for supporting or implementing media storage/media protection; mechanisms for supporting or implementing confidentiality protections for information at rest]

Source Assessment Procedures: MP-05, SC-28

Addressed by 03.13.08.

Determine if:

A.03.08.07.ODP[01]: types of system media with usage restrictions or that are prohibited from use are defined.

A.03.08.07.a: the use of the following types of system media is restricted or prohibited: <A.03.08.07.ODP[01]: types of system media>.

A.03.08.07.b: the use of removable system media without an identifiable owner is prohibited.

[SELECT FROM: system media protection policy and procedures; system use policy; procedures for media usage restrictions; rules of behavior; system audit records; system design documentation; system configuration settings; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system media use responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for media use; mechanisms for restricting or prohibiting the use of system media on systems or system components]

Source Assessment Procedure: MP-07

Incorporated into 03.08.07.

Determine if:

A.03.08.09.a: the confidentiality of backup information is protected.

A.03.08.09.b: cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI at backup storage locations.

[SELECT FROM: contingency planning policy and procedures; procedures for system backup; contingency plan; system design documentation; system configuration settings; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system backup responsibilities; personnel with information security responsibilities]

[SELECT FROM: mechanisms for supporting or implementing the cryptographic protection of backup information]

Source Assessment Procedures: CP-09, CP-09(08)

Determine if:

A.03.09.01.ODP[01]: conditions that require the rescreening of individuals are defined.

A.03.09.01.a: individuals are screened prior to authorizing access to the system.

A.03.09.01.b: individuals are rescreened in accordance with the following conditions: <A.03.09.01.ODP[01]: conditions>.

[SELECT FROM: personnel security policy and procedures; procedures for personnel screening and rescreening; records of screened personnel; system security plan; other relevant documents or records]

[SELECT FROM: personnel with personnel security responsibilities; personnel with information security responsibilities]

[SELECT FROM: processes for personnel screening and rescreening]

Source Assessment Procedure: PS-03

Determine if:

A.03.09.02.ODP[01]: the time period within which to disable system access is defined.

A.03.09.02.a.01: upon termination of individual employment, system access is disabled within <A.03.09.02.ODP[01]: time period>.

A.03.09.02.a.02[01]: upon termination of individual employment, authenticators associated with the individual are terminated or revoked.

A.03.09.02.a.02[02]: upon termination of individual employment, credentials associated with the individual are terminated or revoked.

A.03.09.02.a.03: upon termination of individual employment, security-related system property is retrieved.

A.03.09.02.b.01[01]: upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is reviewed.

A.03.09.02.b.01[02]: upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is confirmed.

A.03.09.02.b.02: upon individual reassignment or transfer to other positions in the organization, access authorization is modified to correspond with any changes in operational need.

[SELECT FROM: personnel security policy and procedures; procedures for personnel termination; records of personnel transfer actions; procedures for personnel transfer; list of system and facility access authorizations; records of personnel termination actions; records of terminated or revoked authenticators or credentials; list of system accounts; records of exit interviews; system security plan; other relevant documents or records]

[SELECT FROM: personnel with personnel security responsibilities; personnel with account management responsibilities; personnel with information security responsibilities; system administrators]

[SELECT FROM: processes for personnel termination; processes for personnel transfer; mechanisms for supporting or implementing personnel transfer notifications; mechanisms for supporting or implementing personnel termination notifications; mechanisms for disabling system access and revoking authenticators]

Source Assessment Procedures: PS-04, PS-05

Determine if:

A.03.10.01.ODP[01]: the frequency at which to review the access list detailing authorized facility access by individuals is defined.

A.03.10.01.a[01]: a list of individuals with authorized access to the facility where the system resides is developed.

A.03.10.01.a[02]: a list of individuals with authorized access to the facility where the system resides is approved.

A.03.10.01.a[03]: a list of individuals with authorized access to the facility where the system resides is maintained.

A.03.10.01.b: authorization credentials for facility access are issued.

A.03.10.01.c: the facility access list is reviewed <A.03.10.01.ODP[01]: frequency>.

A.03.10.01.d: individuals from the facility access list are removed when access is no longer required.

[SELECT FROM: physical protection policy and procedures; procedures for physical access authorizations; authorized personnel access list; physical access list reviews; physical access termination records; authorization credentials; system security plan; other relevant documents or records]

[SELECT FROM: personnel with physical access authorization responsibilities; personnel with physical access to the facility where the system resides; personnel with information security responsibilities]

[SELECT FROM: processes for physical access authorizations; mechanisms for supporting or implementing physical access authorizations]

Source Assessment Procedure: PE-02

Determine if:

A.03.10.02.ODP[01]: the frequency at which to review physical access logs is defined.

A.03.10.02.ODP[02]: events or potential indications of events requiring physical access logs to be reviewed are defined.

A.03.10.02.a[01]: physical access to the facility where the system resides is monitored to detect physical security incidents.

A.03.10.02.a[02]: physical security incidents are responded to.

A.03.10.02.b[01]: physical access logs are reviewed <A.03.10.02.ODP[01]: frequency>.

A.03.10.02.b[02]: physical access logs are reviewed upon occurrence of <A.03.10.02.ODP[02]: events or potential indications of events>.

[SELECT FROM: physical protection policy and procedures; procedures for physical access monitoring; physical access logs or records; physical access monitoring records; physical access log reviews; system security plan; other relevant documents or records]

[SELECT FROM: personnel with physical access monitoring responsibilities; personnel with incident response responsibilities; personnel with information security responsibilities]

[SELECT FROM: processes for monitoring physical access; mechanisms for supporting or implementing physical access monitoring; mechanisms for supporting or implementing the review of physical access logs]