NIST SP 800-172A Rev. 3 日本語訳

Victoria Pillitteri Ron Ross

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172Ar3

Victoria Pillitteri Ron Ross1 Computer Security Division

Information Technology Laboratory

1 Former NIST employee; all work for this publication was done while at NIST.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172Ar3

May 2026

U.S. Department of Commerce Howard Lutnick, Secretary

National Institute of Standards and Technology

Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283 [1]. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130 [2].

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

NIST Technical Series Policies Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

Publication History Approved by the NIST Editorial Review Board on 2026-04-27

Pillitteri V, Ross R (2026) Assessing Enhanced Security Requirements for Controlled Unclassified Information. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-172Ar3. https://doi.org/10.6028/NIST.SP.800-172Ar3

Victoria Pillitteri: 0000-0002-7446-7506

Ron Ross: 0000-0002-1099-9757

sec-cert@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/172/a/r3/final, including related content, potential updates, and document history.

All comments are subject to release under the Freedom of Information Act (FOIA).

The protection of controlled unclassified information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides federal agencies with assessment procedures for the enhanced security requirements in NIST SP 800-172. The assessment procedures are flexible and can be tailored to the needs of federal agencies and assessors. Security requirement assessments can be conducted as (1) self-assessments; (2) independent, third-party assessments; or (3) government-sponsored assessments. The assessments can be conducted with varying degrees of rigor based on federal agency-defined depth and coverage attributes. The findings and evidence produced during the assessments can be used to facilitate risk-based decisions by organizations related to the security requirements.

assessment; assessment procedure; assurance; enhanced security requirement; enhanced security requirement assessment; controlled unclassified information; Executive Order 13556; nonfederal organization; nonfederal system; security assessment.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Supplemental Content

The following materials are available on the publication details page to supplement the guidelines provided in this publication:

Audience

This publication serves a diverse group of individuals and organizations in the public and private sectors, including individuals with:

The above roles and responsibilities can be viewed from two perspectives:

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

The authors gratefully acknowledge and appreciate the contributions from individuals and organizations in the public and private sectors whose constructive comments improved the overall quality, thoroughness, and usefulness of this publication. The authors also wish to thank the NIST technical editing and production staff — Jim Foti, Jeff Brewer, Eduardo Takamura, Jeremy Licata, Isabel Van Wyk, Derek Sappington, Michaela Iorga, Selena Xiao, and Cristina Ritfeld — for their outstanding support in preparing this document and datasets for publication.

The security assessment process gathers information and produces evidence to determine the effectiveness of security requirements by:

The purpose of this publication is to provide procedures for assessing the enhanced security requirements in NIST Special Publication (SP) 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information [3]. Organizations can use the assessment procedures to generate evidence that the security requirements have been satisfied. The scope of the security assessments conducted using the procedures described in this publication is guided and informed by the system security plans for systems that process, store, or transmit CUI. The assessment procedures offer the flexibility to customize assessments based on organizational policies and requirements, known threat and vulnerability information, system and platform dependencies, operational considerations, and tolerance for risk.¹

The remainder of this special publication is organized as follows:

The following sections provide additional information to support the assessment of security requirements for the protection of CUI:

The contents of this publication can be used for many different assessment-related purposes to determine organizational compliance with the security requirements. The broad range of Potential Assessment Methods and Objects listed in this publication does not necessarily reflect and should not be directly associated with actual compliance or noncompliance. Rather, the selection of specific potential assessment methods and objects from the list provided can help generate a picture of overall compliance with the security requirements. There is no expectation about the number of methods or objects needed to determine compliance with the security requirements. Moreover, the entire list of potential assessment objects should not be viewed as required artifacts needed to determine compliance. Organizations have the flexibility to determine the specific methods and objects that provide sufficient evidence to support claims of compliance.

The process used by organizations and assessors to assess the enhanced security requirements in SP 800-172 [3] includes (1) preparing for the assessment, (2) developing a security assessment plan, (3) conducting the assessment, and (4) documenting, analyzing, and reporting the assessment results. The remainder of this section describes the structure and content of the procedures used to assess the security requirements and the importance of assurance cases in providing the evidence necessary to determine compliance with the requirements.

The enhanced security requirements in SP 800-172 [3] are organized into 17 families, as illustrated in Table 1.

Table 1. Enhanced security requirement families

The assessment procedures in Sec. 3 are grouped by similar family designations to ensure the completeness and consistency of assessments. The procedures have been derived from and are sourced to the assessment procedures in SP 800-53A [5].

An assessment procedure consists of an assessment objective and a set of potential assessment methods and objects that can be used to conduct the assessment. Each potential assessment objective includes a determination statement related to the security requirement. If there is an organization-defined parameter (ODP) in the security requirement, then the assessment objective begins with a determination statement related to the definition of the ODP. The determination statements are linked to the content of the security requirements to help ensure traceability of the assessment results to the requirements.

Assessment objects identify the specific items being assessed and can include specifications, mechanisms, activities, and individuals. Specifications are the documented artifacts² (e.g., plans, policies, procedures, requirements, functional and assurance specifications, design documentation, architectures) associated with a system. Mechanisms are the hardware, software, and firmware safeguards implemented within a system. Activities are the protection-related actions supporting a system that involve people (e.g., conducting system backup operations, exercising an incident response plan, monitoring network traffic). Individuals are the people applying the specifications, mechanisms, or activities described above.

Assessment methods define the nature and extent of the assessor’s actions and are used to facilitate understanding, achieve clarification, or obtain evidence. The assessment methods include examine, interview, and test. The examine method is the process of reviewing, studying, inspecting, or analyzing assessment objects. The interview method is the process of holding discussions with individuals or groups about assessment objects. The test method is the process of exercising assessment objects (i.e., activities, mechanisms) under specified conditions to compare actual with expected behavior. Assessment methods include attributes of depth and coverage, which define the rigor, scope, and level of effort for the assessment as well as the degree of assurance that the security requirements have been satisfied. See SP 800-53A, Appendix D [5].

The structure and content of an assessment procedure are provided in the example below.

Determine if:

A.03.01.01E.ODP[01]: privileged commands and/or other actions requiring dual authorization are defined.

A.03.01.01E: dual authorization is enforced for <A.03.01.01E.ODP[01]: privileged commands and/or other actions>.

Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement and dual authorization; system design documentation; system configuration settings and associated documentation; list of actions requiring dual authorization; list of privileged commands requiring dual authorization; list of approved authorizations (user privileges); system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with access enforcement responsibilities; system/network administrators; system personnel with information security responsibilities].

Test

[SELECT FROM: Dual authorization mechanisms implementing access control policy].

Source Assessment Procedures: AC-03(02)

Determination statements have alphanumeric identifiers. Each determination statement begins with the letter “A” to indicate that it is part of an assessment procedure. The next sequence of numbers followed by the letter “E” indicates the enhanced security requirement identifier from SP 800-172 [3] (and the specific control item if it is a multi-part requirement) that is the target of the assessment. Organization-defined parameters are indicated by the letters “ODP.” If there are multiple ODPs in the determination statement, the ODP number is indicated in a square bracket (e.g., A.03.01.04E.ODP[01]). Square brackets are also used to denote when an assessment procedure further decomposes a requirement into more granular determination statements (e.g., A.03.10.03E.a[01], A.03.10.03E.a[02], A.03.10.03E.a[03], A.03.10.03E.a[04]).

The application of an assessment procedure to a security requirement produces assessment results or findings. The findings are compiled and used as evidence to determine whether the security requirement has been satisfied or other than satisfied. A finding of satisfied indicates that the assessment objective has been met, producing a fully acceptable result. A finding of other than satisfied indicates that there are potential anomalies that may need to be addressed by the organization. A finding of other than satisfied may also indicate that the assessor was unable to obtain sufficient information to make the specific determination called for in the determination statement.

Building an effective assurance case to determine compliance with security requirements involves compiling evidence from a variety of sources and conducting different types of activities during an assessment. An assurance case is a body of evidence organized into an argument demonstrating that some claim about a system is true. For security assessments conducted using the procedures in this publication, that claim is “compliance” with the security requirements in SP 800-172 [3]. Assessors obtain evidence during security assessments to allow designated officials³ to make objective determinations about compliance with the security requirements. The evidence needed to make such determinations can be obtained from various sources, including independent, third-party assessments or other types of assessments, depending on the needs of the organization establishing the requirements and the organization conducting the assessments.

For example, many technical security requirements are satisfied by security capabilities that are built into commercial information technology products and systems. Product assessments are typically conducted by independent, third-party testing organizations.⁴ These assessments examine the security functions of products and established configuration settings. Assessments can also be conducted to demonstrate compliance with industry, national, or international security standards as well as developer and vendor claims. Since many information technology products are assessed by commercial testing organizations and then subsequently deployed in hundreds of thousands of systems, these types of assessments can be carried out at a greater level of depth and provide deeper insights into the security capabilities of the products.

The evidence needed to determine compliance with the security requirements is obtained by assessing the implementation of the safeguards and countermeasures selected to satisfy the requirements. Assessors can build on previously developed materials that started with the specification of the information security needs of the organization and were further improved during the design, development, and implementation of the system. These materials provide the initial evidence for an assurance case.

Assessments can be conducted by system developers, system integrators, auditors, system owners, or the security personnel of organizations. The assessors or assessment teams bring available information about the system together, such as the results of component product assessments. The assessors can conduct additional system-level assessments using the assessment methods and procedures contained in this publication and the implementation information provided by the nonfederal organization in its system security plan. Assessments can be used to compile and evaluate the evidence needed by organizations to help determine the effectiveness of the safeguards implemented to protect CUI, the actions needed to mitigate security risks to the organization, and compliance with the security requirements.

The assessment procedures in this publication are based on and sourced to the assessment procedures in SP 800-53A [5]. For additional information and guidance on preparing for security assessments, developing assessment plans, conducting assessments, and analyzing assessment report results, consult SP 800-53A [5].

This section provides assessment procedures for the security requirements defined in SP 800-172 [3]. Organizations that conduct security requirement assessments can develop their security assessment plans by using the information provided in the assessment procedures and selecting the specific potential assessment methods and objects that meet the organization’s needs. Organizations also have flexibility in defining the level of rigor and detail associated with the assessment based on the assurance requirements of the organization.

Determine if:

A.03.01.01E.ODP[01]: privileged commands and/or other actions requiring dual authorization are defined.

A.03.01.01E: dual authorization is enforced for <A.03.01.01E.ODP[01]: privileged commands and/or other actions>.

Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement and dual authorization; system design documentation; system configuration settings and associated documentation; list of actions requiring dual authorization; list of privileged commands requiring dual authorization; list of approved authorizations (user privileges); system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with access enforcement responsibilities; system/network administrators; system developers; personnel with information security responsibilities].

Test

[SELECT FROM: Dual authorization mechanisms implementing access control policy].

Source Assessment Procedures: AC-03(02)

Determine if:

A.03.01.02E.ODP[01]: restrictions on the use of non-organizationally owned systems or system components to process, store, or transmit CUI are defined.

A.03.01.02E: the use of non-organizationally owned systems or system components to process, store, or transmit CUI is restricted using <A.03.01.02E.ODP[01]: restrictions>.

Examine

[SELECT FROM: Access control policy; procedures addressing the use of external systems; system design documentation; system configuration settings and associated documentation; system connection or processing agreements; account management documents; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices; system/network administrators; personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices].

Source Assessment Procedures: AC-20(03)

Addressed by 03.01.09E, 03.01.10E, and 03.01.03 (SP 800-171).

Determine if:

A.03.01.04E.ODP[01]: accounts and/or account types for which to limit the number of concurrent sessions is defined.

A.03.01.04E.ODP[02]: the number of concurrent sessions to be allowed for each account and/or account type is defined.

A.03.01.04E: the number of concurrent sessions for each <A.03.01.04E.ODP[01]: account and/or account types> is limited to <A.03.01.04E.ODP[02]: number>.

Examine

[SELECT FROM: Access control policy; procedures addressing concurrent session control; system design documentation; system configuration settings and associated documentation; security plan; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing access control policy for concurrent session control].

Source Assessment Procedures: AC-10

Determine if:

A.03.01.05E[01]: automated mechanisms are employed to monitor remote access methods.

A.03.01.05E[02]: automated mechanisms are employed to control remote access methods.

Examine

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system design documentation; system remote access configuration settings and associated documentation; system audit records; system monitoring records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Automated mechanisms monitoring and controlling remote access methods].

Source Assessment Procedures: AC-17(01)

Determine if:

A.03.01.06E: information about remote access mechanisms is protected from unauthorized use and disclosure.

Examine

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with responsibilities for implementing or monitoring remote access to the system; system users with knowledge of information about remote access mechanisms; personnel with information security responsibilities].

Source Assessment Procedures: AC-17(06)

Determine if:

A.03.01.07E[01]: automated mechanisms are used to audit account creation actions.

A.03.01.07E[02]: automated mechanisms are used to audit account modification actions.

A.03.01.07E[03]: automated mechanisms are used to audit account enabling actions.

A.03.01.07E[04]: automated mechanisms are used to audit account disabling actions.

A.03.01.07E[05]: automated mechanisms are used to audit account removal actions.

Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentation; system configuration settings and associated documentation; notifications or alerts of account creation, modification, enabling, disabling, and removal actions; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with account management responsibilities; system/network administrators; personnel with information security responsibilities].

Test

[SELECT FROM: Automated mechanisms implementing account management functions].

Source Assessment Procedures: AC-02(04)

Determine if:

A.03.01.08E.ODP[01]: atypical usage for which to monitor system accounts is defined.

A.03.01.08E.ODP[02]: personnel or roles to report atypical usage are defined.

A.03.01.08E.a: system accounts are monitored for <A.03.01.08E.ODP[01]: atypical usage>.

A.03.01.08E.b: atypical usage of system accounts is reported to <A.03.01.08E.ODP[02]: personnel or roles>.

Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentation; system configuration settings and associated documentation; system monitoring records; system audit records; audit tracking and monitoring reports; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with account management responsibilities; system/network administrators; personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms implementing account management functions].

Source Assessment Procedure: AC-02(12)

Determine if:

A.03.01.09E.ODP[01]: attributes to assume access permissions are defined.

A.03.01.09E.a[01]: the attribute-based access control policy is enforced over defined subjects.

A.03.01.09E.a[02]: the attribute-based access control policy is enforced over defined objects.

A.03.01.09E.b: access is controlled based upon <A.03.01.09E.ODP[01]: attributes>.

Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with access enforcement responsibilities; system/network administrators; personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms implementing access enforcement functions].

Source Assessment Procedures: AC-03(13)

Determine if:

A.03.01.10E.ODP[01]: security attributes to be associated with information, source, and destination objects are defined.

A.03.01.10E.ODP[02]: information objects to be associated with information security attributes are defined.

A.03.01.10E.ODP[03]: source objects to be associated with information security attributes are defined.

A.03.01.10E.ODP[04]: destination objects to be associated with information security attributes are defined.

A.03.01.10E.ODP[05]: information flow control policies as a basis for the enforcement of flow control decisions are defined.

A.03.01.10E: <A.03.01.10E.ODP[01]: security attributes> associated with <A.03.01.10E.ODP[02]: information objects>, <A.03.01.10E.ODP[03]: source objects>, and <A.03.01.10E.ODP[04]: destination objects> are used to enforce <A.03.01.10E.ODP[05]: information flow control policies> as a basis for flow control decisions.

Examine

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of security attributes and associated source and destination objects; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

Source Assessment Procedure: AC-04(01)

Determine if:

A.03.01.11E.ODP[01]: roles and users authorized to assume such roles are defined.

A.03.01.11E.a: a role-based access control policy over defined subjects and objects is enforced.

A.03.01.11E.b: access is controlled based upon <A.03.01.11E.ODP[01] roles and authorized users>.

Examine

[SELECT FROM: Access control policy; role-based access control policies; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of roles, users, and associated privileges required to control system access; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing role-based access control policy].

Source Assessment Procedure: AC-03(07)

Determine if:

A.03.01.12E.ODP[01]: mechanisms and/or techniques to separate CUI flows are defined.

A.03.01.12E: CUI flows are logically or physically separated using <A.03.01.12E.ODP[01] mechanisms and/or techniques>.

Examine

[SELECT FROM: Information flow enforcement policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of required separation of information flows by information types; list of mechanisms and/or techniques used to logically or physically separate information flows; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information flow enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement functions].

Source Assessment Procedure: AC-04(21)

Determine if:

A.03.01.13E.ODP[01]: metadata on which to base enforcement of information flow control is defined.

A.03.01.13E: information flow control based on <A.03.01.13E.ODP[01]: metadata> is enforced.

Examine

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

Source Assessment Procedure: AC-04(06)

Determine if:

A.03.01.14E.ODP[01]: security policy filters are defined.

A.03.01.14E.ODP[02]: information flows are defined.

A.03.01.14E.ODP[03]: one or more of the following PARAMETER VALUES is/are selected: {Block; Strip; Modify; Quarantine} in response to a filter processing failure.

A.03.01.14E.ODP[04]: security policy addressing a filter processing failure is defined.

A.03.01.14E.a: information flow control is enforced using <A.03.01.14E.ODP[01] security policy filters> as a basis for flow control decisions for <A.03.01.14E.ODP[02] information flows>.

A.03.01.14E.b: <A.03.01.14E.ODP[03]: SELECTED PARAMETER VALUE(S)> data after a filter processing failure in accordance with <A.03.01.14E.ODP[04] security policy>.

Examine

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of security policy filters regulating flow control decisions; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement policy; security policy filters].

Source Assessment Procedure: AC-04(08)

Determine if:

A.03.01.15E.ODP[01]: data type identifiers are defined.

A.03.01.15E: when transferring information between security domains, <A.03.01.15E.ODP[01]: data type identifiers> are used to validate data that is essential for information flow decisions.

Examine

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of data type identifiers; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

Source Assessment Procedure: AC-04(12)

Determine if:

A.03.01.16E.ODP[01]: policy-relevant subcomponents into which to decompose CUI for submission to policy enforcement mechanisms are defined.

A.03.01.16E: when transferring information between different security domains, CUI is decomposed into <A.03.01.16E.ODP[01]: policy-relevant subcomponents> for submission to policy enforcement mechanisms.

Examine

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

Source Assessment Procedure: AC-04(13)

Determine if:

A.03.01.17E.ODP[01]: unsanctioned CUI to be detected is defined.

A.03.01.17E.ODP[02]: a security policy that prohibits the transfer of unsanctioned information is defined.

A.03.01.17E.a: when transferring information between different security domains, information is examined for the presence of <A.03.01.17E.ODP[01] unsanctioned information>.

A.03.01.17E.b: the transfer of CUI defined in 03.01.17E.a is prohibited in accordance with <A.03.01.17E.ODP[02] security policy>.

Examine

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of unsanctioned information types and associated information; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

Source Assessment Procedure: AC-04(15)

Determine if:

A.03.02.01E.ODP[01]: indicators of malicious code are defined.

A.03.02.01E.ODP[02]: the frequency at which to update security literacy training content is defined.

A.03.02.01E.ODP[03]: events which cause security literacy training content to be updated are defined.

A.03.02.01E.a.01: security literacy training on the advanced persistent threat is provided to system users.

A.03.02.01E.a.02: security literacy training on recognizing suspicious communications and anomalous behavior in systems using <A.03.02.01E.ODP[01]: indicators of malicious code> is provided to system users.

A.03.02.01E.a.03: security literacy training on the cyber threat environment is provided to system users.

A.03.02.01E.b[01]: security literacy training content is updated <A.03.02.01E.ODP[02]: frequency>.

A.03.02.01E.b[02]: security literacy training content is updated following <A.03.02.01E.ODP[03]: events>

Examine

[SELECT FROM: System security plan; security literacy and awareness training policy; procedures addressing security literacy and awareness training implementation; security literacy and awareness training curriculum; security literacy and awareness training materials; other relevant documents or records].

Interview

[SELECT FROM: Personnel who receive security literacy and awareness training; personnel with responsibilities for security literacy and awareness training; personnel with information security responsibilities].

Source Assessment Procedures: AT-02(04); AT-02(05); AT-02(06)

Determine if:

A.03.02.02E: practical exercises in literacy training that simulate events and incidents are provided.

Examine

[SELECT FROM: System security plan; security literacy and awareness training policy; procedures addressing security literacy and awareness training implementation; security awareness training curriculum; security awareness training materials; other relevant documents or records].

Interview

[SELECT FROM: Personnel who receive security literacy and awareness training; personnel with responsibilities for security awareness training; personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms implementing cyber-attack simulations in practical exercises].

Source Assessment Procedures: AT-02(01)

Determine if:

A.03.02.03E.ODP[01]: personnel to whom feedback on organizational training results will be provided are assigned.

A.03.02.03E: feedback on organizational training results is provided to <A.03.02.03E.ODP[01]: personnel>.

Examine

[SELECT FROM: Security awareness training policy; procedures addressing security literacy and awareness training records; security literacy and awareness training records; security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with security and awareness training record retention responsibilities].

Test

[SELECT FROM: Mechanisms supporting the management of security literacy and awareness training records].

Source Assessment Procedures: AT-06

Determine if:

A.03.02.04E.ODP[01]: personnel or roles requiring training to detect counterfeit system components are defined.

A.03.02.04E: <A.03.02.04E.ODP[01]: personnel or roles> are trained to detect counterfeit system components.

Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; anti-counterfeit plan; anti-counterfeit policy and procedures; media disposal policy; media protection policy; incident response policy; training materials addressing counterfeit system components; training records on the detection and prevention of counterfeit components entering the system; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with information security responsibilities; personnel with supply chain risk management responsibilities; personnel with contract management responsibilities; personnel with responsibilities for anti-counterfeit policies, procedures, and training].

Test

[SELECT FROM: Processes for anti-counterfeit training].

Source Assessment Procedures: SR-11(01)

Determine if:

A.03.03.01E: audit records are stored in a repository that is part of a physically different system or system component than the system or component being audited.

Examine

[SELECT FROM: Audit and accountability policy; system security plan; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; system or media storing backups of system audit records; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Personnel with audit and accountability responsibilities; personnel with information security responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Mechanisms implementing the backing up of audit records].

Source Assessment Procedures: AU-09(02)

Determine if:

A.03.03.02E.ODP[01]: real-time period requiring alerts when audit failure events (defined in A.03.03.02E.ODP[03]) occur is defined.

A.03.03.02E.ODP[02]: personnel, roles, and/or locations to be alerted in real time when audit failure events (defined in A.03.03.02E.ODP[03]) occur are defined.

A.03.03.02E.ODP[03]: audit logging failure events requiring real-time alerts are defined.

A.03.03.02E: an alert is provided within <A.03.03.02E.ODP[01]: real-time period> to <A.03.03.02E.ODP[02]: personnel, roles, and/or locations> when <A.03.03.02E.ODP[03]: audit logging failure events> occur.

Examine

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentation; system security plan; system configuration settings and associated documentation; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Personnel with audit and accountability responsibilities; personnel with information security responsibilities; system/network administrators; system developers].

Source Assessment Procedures: AU-05(02)

Determine if:

A.03.03.03E.ODP[01]: one or more of the following PARAMETER VALUES is/are selected: {movement; deletion}.

A.03.03.03E.ODP[02]: audit information for which dual authorization is to be enforced is defined.

A.03.03.03E: dual authorization is enforced for the <A.03.03.03E.ODP[01]: SELECTED PARAMETER VALUE(S)> of <A.03.03.03E.ODP[02]: audit information>.

Examine

[SELECT FROM: Audit and accountability policy; system security plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; access authorizations; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Personnel with audit and accountability responsibilities; personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Mechanisms implementing the enforcement of dual authorization].

Source Assessment Procedures: AU-09(05)

Determine if:

A.03.03.04E.ODP[01]: one or more of the following PARAMETER VALUES is/are selected: {vulnerability scanning information; performance data; system monitoring information; <A.03.03.04E.ODP[02] data or information collected from other sources>}.

A.03.03.04E.ODP[02]: data or information collected from other sources to be analyzed is defined (if selected).

A.03.03.04E: analysis of audit records is integrated with analysis of <A.03.03.04E.ODP[01]: SELECTED PARAMETER VALUE(S)> to further enhance the ability to identify inappropriate or unusual activity.

Examine

[SELECT FROM: Audit and accountability policy; system security plan; procedures addressing audit review, analysis, and reporting; system design documentation; system configuration settings and associated documentation; integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information and associated documentation; other relevant documents or records].

Interview

[SELECT FROM: Personnel with audit review, analysis, and reporting responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms implementing the capability to integrate analysis of audit records with analysis of data or information sources].

Source Assessment Procedures: AU-06(05)

Addressed by 03.04.08E, 03.14.04E, 03.17.03E, 03.17.04E, 03.17.05E, 03.04.01 (SP 800-171), 03.04.03 (SP 800-171), and 03.04.10 (SP 800-171).

Determine if:

A.03.04.02E.ODP[01]: automated mechanisms used to detect the presence of unauthorized or misconfigured system components are defined.

A.03.04.02E.ODP[02]: one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized or misconfigured system components; isolate unauthorized or misconfigured system components; notify <A.03.04.02E.ODP[03] personnel or roles>}.

A.03.04.02E.ODP[03]: personnel or roles to be notified when unauthorized or misconfigured system components are detected are defined (if selected).

A.03.04.02E.a: the presence of unauthorized or misconfigured system components is detected using <A.03.04.02E.ODP[01]: automated mechanisms>.

A.03.04.02E.b: one or more of the following actions is/are taken when unauthorized or misconfigured system components are detected: <A.03.04.02E.ODP[02]: SELECTED PARAMETER VALUE(S)>.

Examine

[SELECT FROM: Configuration management policy; procedures addressing system component inventory and configuration settings; configuration management plan; system configuration settings and associated documentation; system component inventory; system design documentation; change control records; common secure configuration checklists; alerts or notifications of unauthorized components within the system; system monitoring records; system maintenance records; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with component inventory and security configuration management responsibilities; personnel with responsibilities for managing automated mechanisms implementing unauthorized system component detection; personnel with information security responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Processes for the detection of unauthorized or misconfigured system components; automated processes for taking action when unauthorized or misconfigured system components are detected; automated mechanisms supporting and/or implementing the detection of unauthorized or misconfigured system components; automated mechanisms supporting and/or implementing actions taken when unauthorized or misconfigured system components are detected].

Source Assessment Procedure: CM-06(01); CM-6(02); CM-08(03)

Determine if:

A.03.04.03E.ODP[01]: automated mechanisms used to maintain the currency of the system component inventory are defined.

A.03.04.03E.ODP[02]: automated mechanisms used to maintain the completeness of the system component inventory are defined.

A.03.04.03E.ODP[03]: automated mechanisms used to maintain the accuracy of the system component inventory are defined.

A.03.04.03E.ODP[04]: automated mechanisms used to maintain the availability of the system component inventory are defined.

A.03.04.03E[01]: <A.03.04.03E.ODP[01]: automated mechanisms> are used to maintain the currency of the system component inventory.

A.03.04.03E[02]: <A.03.04.03E.ODP[02]: automated mechanisms> are used to maintain the completeness of the system component inventory.

A.03.04.03E[03]: <A.03.04.03E.ODP[03]: automated mechanisms> are used to maintain the accuracy of the system component inventory.

A.03.04.03E[04]: <A.03.04.03E.ODP[04]: automated mechanisms> are used to maintain the availability of the system component inventory.

Examine

[SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system design documentation; system component inventory; change control records; system maintenance records; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Personnel with component inventory management responsibilities; personnel with information security responsibilities; system developers; system/network administrators].

Test

[SELECT FROM: Processes for maintaining the system component inventory; automated mechanisms supporting and/or implementing the system component inventory].

Source Assessment Procedures: CM-08(02)

Determine if:

A.03.04.04E.ODP[01]: automated mechanisms for maintaining the baseline configuration of the system are defined.

A.03.04.04E[01]: the currency of the baseline configuration of the system is maintained using <A.03.04.04E.ODP[01]: automated mechanisms>.

A.03.04.04E[02]: the completeness of the baseline configuration of the system is maintained using <A.03.04.04E.ODP[01]: automated mechanisms>.

A.03.04.04E[03]: the accuracy of the baseline configuration of the system is maintained using <A.03.04.04E.ODP[01]: automated mechanisms>.

A.03.04.04E[04]: the availability of the baseline configuration of the system is maintained using <A.03.04.04E.ODP[01]: automated mechanisms>.

Examine

[SELECT FROM: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; system component inventory; configuration change control records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with configuration management responsibilities; personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Processes for managing baseline configurations; automated mechanisms implementing baseline configuration maintenance].

Source Assessment Procedures: CM-02(02)

Determine if:

A.03.04.05E.ODP[01]: system components requiring dual authorization for the implementation of changes are defined.

A.03.04.05E.ODP[02]: system-level information requiring dual authorization for the implementation of changes is defined.

A.03.04.05E[01]: dual authorization for implementing changes to <A.03.04.05E.ODP[01]: system components> is enforced.

A.03.04.05E[02]: dual authorization for implementing changes to <A.03.04.05E.ODP[02]: system-level information> is enforced.

Examine

[SELECT FROM: Configuration management policy; procedures addressing access restrictions for changes to the system; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; change control records; system audit records; system component inventory; system information types; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with dual authorization enforcement responsibilities for implementing system changes; personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Processes for managing access restrictions to change; mechanisms implementing dual authorization enforcement].

Source Assessment Procedures: CM-05(04)

Determine if:

A.03.04.06E.ODP[01]: the number of previous baseline configuration versions to be retained is defined.

A.03.04.06E: <A.03.04.06E.ODP[01]: number> previous versions of baseline configurations of the system are retained to support rollback.

Examine

[SELECT FROM: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; system architecture and configuration documentation; system configuration settings and associated documentation; copies of previous baseline configuration versions; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with configuration management responsibilities; personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Processes for managing baseline configurations].

Source Assessment Procedures: CM-02(03)

Determine if:

A.03.04.07E[01]: changes to the system are tested before finalizing the implementation of the changes.

A.03.04.07E[02]: changes to the system are validated before finalizing the implementation of the changes.

A.03.04.07E[03]: changes to the system are documented before finalizing the implementation of the changes.

Examine

[SELECT FROM: Configuration management policy; configuration management plan; procedures addressing system configuration change control; system architecture and configuration documentation; system design documentation; test records; system configuration settings and associated documentation; validation records; change control records; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with configuration change control responsibilities; personnel with information security responsibilities; members of change control board or similar; system/network administrators; system developers].

Test

[SELECT FROM: Processes for configuration change control; mechanisms supporting and/or implementing, testing, validating, and documenting system changes].

Source Assessment Procedures: CM-03(02)

Determine if:

A.03.04.08E: a centralized repository for the inventory of system components is provided.

Examine

[SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system design documentation; system security plan; system component inventory; system configuration settings and associated documentation; change control records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with component inventory management responsibilities; organizational personnel with security responsibilities].

Test

[SELECT FROM: Organizational processes for managing the system component inventory; mechanisms supporting and/or implementing system component inventory].

Source Assessment Procedures: CM-08(07)

Determine if:

A.03.05.01E.ODP[01]: devices and/or types of devices requiring the use of cryptographically based bidirectional authentication to authenticate before establishing a system connection are defined.

A.03.05.01E: <A.03.05.01E.ODP[01]: devices and/or types of devices> are authenticated before establishing a system connection using bidirectional authentication that is cryptographically based.

Examine

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing device identification and authentication; system design documentation; configuration settings and associated documentation; list of devices requiring unique identification and authentication; device connection reports; other relevant documents or records].

Interview

[SELECT FROM: Personnel with operational responsibilities for device identification and authentication; personnel with information security responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Mechanisms supporting and/or implementing device authentication capabilities; cryptographically based bidirectional authentication mechanisms].

Source Assessment Procedures: IA-03(01)

Determine if:

A.03.05.02E.ODP[01]: password managers employed for generating and managing passwords are defined.

A.03.05.02E.ODP[02]: safeguards for protecting passwords are defined.

A.03.05.02E.a: <A.03.05.02E.ODP[01]: password managers> are employed to generate and manage passwords.

A.03.05.02E.b: passwords are protected using <A.03.05.02E.ODP[02]: safeguards>.

Examine

[SELECT FROM: Identification and authentication policy; procedures addressing identifier management; system security plan; system design documentation; mechanisms providing dynamic binding of identifiers and authenticators; system configuration settings and associated documentation; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Personnel with identification and authentication management responsibilities; personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Mechanisms supporting and/or implementing account management capabilities; mechanisms supporting and/or implementing identification and authentication management capabilities for the system].

Source Assessment Procedures: IA-05(18)

Determine if:

A.03.05.03E.ODP[01]: the configuration management process employed to handle device identification and authentication based on attestation is defined.

A.03.05.03E: device identification and authentication are handled based on attestation by <A.03.05.03E.ODP[01]: configuration management process>.

Examine

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing device identification and authentication; procedures addressing device configuration management; system design documentation; system configuration settings and associated documentation; configuration management records; change control records; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Personnel with operational responsibilities for device identification and authentication; personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Mechanisms supporting and/or implementing device identification and authentication capabilities; mechanisms supporting and/or implementing configuration management; cryptographic mechanisms supporting device attestation].

Source Assessment Procedures: IA-03(04)

Determine if:

A.03.05.04E: unencrypted static authenticators are not embedded in applications or other forms of static storage.

Examine

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing authenticator management; system design documentation; system configuration settings and associated documentation; logical access scripts; application code reviews for detecting unencrypted static authenticators; other relevant documents or records].

Interview

[SELECT FROM: Personnel with authenticator management responsibilities; personnel with information security responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Mechanisms supporting and/or implementing authenticator management capabilities; mechanisms implementing authentication in applications].

Source Assessment Procedures: IA-05(07)

Determine if:

A.03.05.05E.ODP[01]: the time period after which the use of cached authenticators is prohibited is defined.

A.03.05.05E: the use of cached authenticators is prohibited after <A.03.05.05E.ODP[01]: time period>.

Examine

[SELECT FROM: Identification and authentication policy; procedures addressing authenticator management; system security plan; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Personnel with authenticator management responsibilities; personnel with information security responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Mechanisms supporting and/or implementing authenticator management capabilities].

Source Assessment Procedures: IA-05(13)

Determine if:

A.03.05.06E.a: users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity-proofed.

A.03.05.06E.b: user identities are resolved to a unique individual.

A.03.05.06E.c[01]: identity evidence is collected.

A.03.05.06E.c[02]: identity evidence is validated.

A.03.05.06E.c[03]: identity evidence is verified.

Examine

[SELECT FROM: Identification and authentication policy; procedures addressing identity proofing; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with system operations responsibilities; personnel with information security responsibilities; system/network administrators; system developers; personnel with identification and authentication responsibilities].

Test

[SELECT FROM: Mechanisms supporting and/or implementing identification and authentication capabilities].

Source Assessment Procedure: IA-12

Determine if:

A.03.05.07E.ODP[01]: an identification and authentication policy is defined.

A.03.05.07E.ODP[02]: mechanisms supporting authentication and authorization decisions are defined.

A.03.05.07E[01]: identity providers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authentication decisions in accordance with <A.03.05.07E.ODP[01]: policy> using <A.03.05.07E.ODP[02]: mechanisms>.

A.03.05.07E[02]: identity providers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authorization decisions in accordance with <A.03.05.07E.ODP[01]: policy> using <A.03.05.07E.ODP[02]: mechanisms>.

A.03.05.07E[03]: authorization servers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authentication decisions in accordance with <A.03.05.07E.ODP[01]: policy> using <A.03.05.07E.ODP[02]: mechanisms>.

A.03.05.07E[02]: authorization servers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authorization decisions in accordance with <A.03.05.07E.ODP[01]: policy> using <A.03.05.07E.ODP[02]: mechanisms>.

Examine

[SELECT FROM: Identification and authentication policy; procedures addressing user and device identification and authentication; system security plan; system design documentation; system configuration settings and associated documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; organizational personnel with account management responsibilities; system developers].

Test

[SELECT FROM: Mechanisms supporting and/or implementing identification and authentication capabilities and access rights].

Source Assessment Procedure: IA-13

Determine if:

A.03.06.01E[01]: a security operations center is established.

A.03.06.01E[02]: a security operations center is maintained.

Examine

[SELECT FROM: Incident response policy; contingency planning policy; procedures addressing incident handling; procedures addressing the security operations center operations; mechanisms supporting dynamic response capabilities; system security plan; contingency plan; incident response plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with incident handling responsibilities; personnel with information security responsibilities; security operations center personnel; personnel with contingency planning responsibilities].

Test

[SELECT FROM: Mechanisms that support and/or implement the security operations center capability; mechanisms that support and/or implement the incident handling process].

Source Assessment Procedures: IR-04(14)

Determine if:

A.03.06.02E.ODP[01]: the time period within which an integrated incident response team can be deployed is defined.

A.03.06.02E[01]: an integrated incident response team is established.

A.03.06.02E[02]: an integrated incident response team is maintained.

A.03.06.02E[03]: the integrated incident response team can be deployed to any location identified by the organization in <A.03.06.02E.ODP[01]: time period>.

Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; procedures addressing incident response planning; incident response plan; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with incident handling responsibilities; personnel with information security responsibilities; members of the integrated incident response team].

Source Assessment Procedures: IR-04(11)

Determine if:

A.03.06.03E.ODP[01]: environments or resources that may contain or be related to anomalous or suspected adversarial behavior are defined.

A.03.06.03E: anomalous or suspected adversarial behavior in or related to <A.03.06.03E.ODP[01]: environments or resources> is analyzed.

Examine

[SELECT FROM: Incident response policy; procedures addressing system monitoring tools and techniques; incident response plan; system monitoring logs or records; system monitoring tools and techniques documentation; decoy capability configuration and results; system configuration settings and associated documentation; system security plan; system component inventory; network diagram; system protocols documentation; list of acceptable thresholds for false positives and false negatives; other relevant documents or records].

Interview

[SELECT FROM: Personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Processes for detecting anomalous behavior].

Source Assessment Procedures: IR-04(13)

Determine if:

A.03.06.04E.ODP[01]: automated mechanisms used to track incidents are defined.

A.03.06.04E.ODP[02]: automated mechanisms used to collect incident information are defined.

A.03.06.04E.ODP[03]: automated mechanisms used to analyze incident information are defined.

A.03.06.04E[01]: incidents are tracked using <A.03.06.04E.ODP[01]: automated mechanisms>.

A.03.06.04E[02]: incident information is collected using <A.03.06.04E.ODP[02]: automated mechanisms>.

A.03.06.04E[03]: incident information is analyzed using <A.03.06.04E.ODP[03]: automated mechanisms>.

Examine

[SELECT FROM: Incident response policy; procedures addressing incident monitoring; incident response records and documentation; system security plan; incident response plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with incident monitoring responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Incident monitoring capability for the organization; automated mechanisms supporting and/or implementing the tracking and documenting of system security incidents].

Source Assessment Procedures: IR-05(01)

Determine if:

A.03.07.01E: maintenance tools are inspected to ensure that the latest software updates and patches are installed.

Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; list of personnel authorized to use maintenance tools; maintenance tool usage records; maintenance records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for inspecting maintenance tools; processes for maintenance tool updates; mechanisms supporting and/or implementing the inspection of maintenance tools; mechanisms supporting and/or implementing maintenance tool updates].

Source Assessment Procedures: MA-03(06)

Determine if:

A.03.08.01E.ODP[01]: system media containing CUI to be sanitized requiring dual authorization is defined.

A.03.08.01E: dual authorization for the sanitization of <A.03.08.01E.ODP[01]: system media> is enforced.

Examine

[SELECT FROM: System media protection policy; procedures addressing media sanitization and disposal; dual authorization policy and procedures; list of system media requiring dual authorization for sanitization; authorization records; media sanitization records; audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with system media sanitization responsibilities; personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Processes requiring dual authorization for media sanitization; mechanisms supporting and/or implementing media sanitization; mechanisms supporting and/or implementing dual authorization].

Source Assessment Procedures: MP-06(07)

Determine if:

A.03.08.02E.ODP[01]: system backup information for which to enforce dual authorization in order to delete or destroy is defined.

A.03.08.02E: dual authorization for the deletion or destruction of <A.03.08.02E.ODP[01]: system backup information> is enforced.

Examine

[SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; system design documentation; system configuration settings and associated documentation; system-generated list of dual authorization credentials or rules; logs or records of the deletion or destruction of backup information; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with system backup responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms supporting and/or implementing dual authorization; mechanisms supporting and/or implementing the deletion and/or destruction of backup information].

Source Assessment Procedures: CP-09(07)

Determine if:

A.03.08.03E.ODP[01]: the frequency at which to test backup information for media reliability is defined.

A.03.08.03E.ODP[02]: the frequency at which to test backup information for information integrity is defined.

A.03.08.03E[01]: backup information is tested <A.03.08.03E.ODP[01]: frequency> to verify media reliability.

A.03.08.03E[02]: backup information is tested <A.03.08.03E.ODP[02]: frequency> to verify information integrity.

Examine

[SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; system backup test results; contingency plan test documentation; contingency plan test results; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with system backup responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for conducting system backups; mechanisms supporting and/or implementing system backups].

Source Assessment Procedures: CP-09(07)

Determine if:

A.03.08.04E.ODP[01]: a time period consistent with recovery time and recovery point objectives for the recovery of the system is determined.

A.03.08.04E.ODP[02]: a time period consistent with recovery time and recovery point objectives for the reconstitution of the system is determined.

A.03.08.04E[01]: the recovery of the system to a known state is provided within <A.03.08.04E.ODP[01]: time period> after a disruption, compromise, or failure.

A.03.08.04E[02]: the reconstitution of the system to a known state is provided within <A.03.08.04E.ODP[02]: time period> after a disruption, compromise, or failure.

Examine

[SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; system backup test results; contingency plan test results; contingency plan test documentation; redundant secondary system for system backups; locations of redundant secondary backup systems; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes implementing system recovery and reconstitution operations; mechanisms supporting and/or implementing system recovery and reconstitution operations].

Source Assessment Procedures: CP-10

Addressed by 03.09.01 (SP 800-171).

Addressed by 03.01.01 (SP 800-171) and 03.09.01 (SP 800-171).

Determine if:

A.03.09.03E.ODP[01]: the frequency at which to review and update access agreements is defined.

A.03.09.03E.ODP[02]: the frequency at which to re-sign access agreements to maintain access systems processing, storing, or transmitting CUI is defined.

A.03.09.03E.a: access agreements are developed and documented for systems processing, storing, or transmitting CUI.

A.03.09.03E.b[01]: access agreements are reviewed <A.03.09.03E.ODP[01]: frequency>.

A.03.09.03E.b[02]: access agreements are updated <A.03.09.03E.ODP[01]: frequency>.

A.03.09.03E.c.01: individuals requiring access to CUI and systems processing, storing, or transmitting CUI sign appropriate access agreements prior to being granted access.

A.03.09.03E.c.02: individuals requiring access to CUI and systems processing, storing, or transmitting CUI re-sign access agreements to maintain access when access agreements have been updated or <A.03.09.03E.ODP[02]: frequency>.

Examine

[SELECT FROM: Personnel security policy; personnel security procedures; procedures addressing access agreements for systems processing, storing, or transmitting CUI; access control policy; access control procedures; access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements); documentation of access agreement reviews, updates, and re-signing; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with personnel security responsibilities; personnel who have signed and/or resigned access agreements; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for reviewing, updating, and re-signing access agreements; mechanisms supporting reviewing, updating, and re-signing of access agreements].

Source Assessment Procedures: PS-06

Determine if:

A.03.09.04E.ODP[01]: citizenship requirements to be met by individuals to access a system processing, storing, or transmitting CUI are defined.

A.03.09.04E: individuals accessing a system processing, storing, or transmitting CUI meet <A.03.09.04E.ODP[01] citizenship requirements>.

Examine

[SELECT FROM: Personnel security policy; access control policy, procedures addressing personnel screening; records of screened personnel; screening criteria; records of access authorizations; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with personnel security responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for ensuring valid access authorizations for accessing CUI and systems requiring citizenship; processes for additional personnel screening].

Source Assessment Procedures: PS-03(04)

Determine if:

A.03.10.01E[01]: physical access to the facility where the system resides is monitored using physical intrusion alarms.

A.03.10.01E[02]: physical access to the facility where the system resides is monitored using physical surveillance equipment.

Examine

[SELECT FROM: Physical and environmental protection policy; procedures addressing physical access monitoring; physical access monitoring records; physical access log reviews; physical access logs or records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with physical access monitoring responsibilities; personnel with incident response responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for monitoring physical intrusion alarms and surveillance equipment; mechanisms supporting and/or implementing physical intrusion alarms and surveillance equipment; mechanisms supporting and/or implementing physical access monitoring].

Source Assessment Procedures: PE-06(01)

Determine if:

A.03.10.02E.ODP[01]: the types of system components to be authorized and controlled when entering the facility are defined.

A.03.10.02E.ODP[02]: the types of system components to be authorized and controlled when exiting the facility are defined.

A.03.10.02E.a[01]: <A.03.10.02E.ODP[01]: types of system components> are authorized when entering the facility.

A.03.10.02E.a[02]: <A.03.10.02E.ODP[01]: types of system components> are controlled when entering the facility.

A.03.10.02E.a[03]: <A.03.10.02E.ODP[02]: types of system components> are authorized when exiting the facility.

A.03.10.02E.a[04]: <A.03.10.02E.ODP[02]: types of system components> are controlled when exiting the facility.

A.03.10.02E.b: records of the system components entering and exiting the facility are maintained.

Examine

[SELECT FROM: Physical and environmental protection policy; procedures addressing the delivery and removal of system components from the facility; facility housing the system; records of items entering and exiting the facility; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with responsibilities for controlling system components entering and exiting the facility; personnel with information security responsibilities].

Test

[SELECT FROM: Process for authorizing, monitoring, and controlling system-related items entering and exiting the facility; mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system components entering and exiting the facility].

Source Assessment Procedures: PE-16

Determine if:

A.03.11.01E: a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.

Examine

[SELECT FROM: Information security program plan; threat awareness program policy; threat awareness program procedures; risk assessment results relevant to threat awareness; documentation about the cross-organization information-sharing capability; other relevant documents or records].

Interview

[SELECT FROM: Personnel with information security program planning and plan implementation responsibilities; personnel responsible for the threat awareness program; personnel responsible for the cross-organization information-sharing capability; personnel with information security responsibilities; external personnel with whom threat awareness information is shared by the organization].

Test

[SELECT FROM: Processes for implementing the threat awareness program; processes for implementing the cross-organization information-sharing capability; mechanisms supporting and/or implementing the threat awareness program; mechanisms supporting and/or implementing the cross-organization information-sharing capability].

Source Assessment Procedures: PM-16

Determine if:

A.03.11.02E.ODP[01]: the frequency at which to employ the threat-hunting capability is defined.

A.03.11.02E.a.01[01]: a cyber threat-hunting capability is established to search for indicators of compromise in organizational systems.

A.03.11.02E.a.01[02]: a cyber threat-hunting capability is maintained to search for indicators of compromise in organizational systems.

A.03.11.02E.a.02[01]: a cyber threat-hunting capability is established to detect, track, and disrupt threats that evade existing safeguards.

A.03.11.02E.a.02[02]: a cyber threat-hunting capability is maintained to detect, track, and disrupt threats that evade existing safeguards.

A.03.11.02E.b: the threat-hunting capability is employed<A.03.11.02E.ODP[01]: frequency>.

Examine

[SELECT FROM: Risk assessment policy; assessment reports; audit records and/or event logs; threat-hunting capability; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with threat-hunting responsibilities; system/network administrators; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for assessments and audits; mechanisms or tools supporting and/or implementing threat-hunting capabilities].

Source Assessment Procedures: RA-10

Determine if:

A.03.11.03E.ODP[01]: advanced automation capabilities to predict and identify risks are defined.

A.03.11.03E.ODP[02]: systems or system components in which advanced automation and analytics capabilities are to be employed are defined.

A.03.11.03E.ODP[03]: advanced analytics capabilities to predict and identify risks are defined.

A.03.11.03E[01]: <A.03.11.03E.ODP[01]: advanced automation capabilities> are employed to predict and identify risks to <A.03.11.03E.ODP[02]: systems or system components>.

A.03.11.03E[02]: <A.03.11.03E.ODP[03]: advanced analytics capabilities> are employed to predict and identify risks to <A.03.11.03E.ODP[02]: systems or system components>.

Examine

[SELECT FROM: Risk assessment policy; security planning policy and procedures; procedures addressing organizational assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; risk reports; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with risk assessment responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for risk assessment; mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment].

Source Assessment Procedures: RA-03(04)

Addressed by 03.15.01E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), and 03.15.02 (SP 800-171).

Addressed by 03.11.01E, 03.11.03E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), 03.12.01 (SP 800-171), and 03.12.03 (SP 800-171).

Addressed by 03.12.03E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), 03.12.01 (SP 800-171), 03.12.03 (SP 800-171), and 03.17.03 (SP 800-171).

Addressed by 03.17.01 (SP 800-171).

Determine if:

A.03.11.08E.ODP[01]: the means to determine the current cyber threat environment on an ongoing basis are defined.

A.03.11.08E: the current cyber threat environment is determined on an ongoing basis using <A.03.11.08E.ODP[01]: means>.

Examine

[SELECT FROM: Risk assessment policy; security planning policy and procedures; procedures addressing organizational assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; risk reports; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with risk assessment responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for risk assessment; mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment].

Source Assessment Procedures: RA-03(03)

Determine if:

A.03.11.09E.ODP[01]: sources that provide indicators of compromise are defined.

A.03.11.09E.ODP[02]: personnel or roles to whom indicators of compromise are to be distributed are defined.

A.03.11.09E[01]: indicators of compromise provided by <A.03.11.09E.ODP[01]: sources> are discovered.

A.03.11.09E[02]: indicators of compromise provided by <A.03.11.09E.ODP[01]: sources> are collected.

A.03.11.09E[03]: indicators of compromise provided by <A.03.11.09E.ODP[01]: sources> are distributed to <A.03.11.09E.ODP[02]: personnel or roles>.

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing system monitoring; system design documentation; system monitoring tools and techniques documentation; system configuration settings and associated documentation; system monitoring logs or records; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers; personnel installing, configuring, and/or maintaining the system; personnel responsible for monitoring system hosts].

Test

[SELECT FROM: Processes for system monitoring; processes for the discovery, collection, distribution, and use of indicators of compromise; mechanisms supporting and/or implementing a system monitoring capability; mechanisms supporting and/or implementing the discovery, collection, distribution, and use of indicators of compromise].

Source Assessment Procedures: SI-04(24)

Determine if:

A.03.11.10E.ODP[01]: systems, system components, or system services to be analyzed for criticality are defined.

A.03.11.10E.ODP[02]: decision points in the system development life cycle when a criticality analysis is to be performed are defined.

A.03.11.10E: critical system components and functions are identified by performing a criticality analysis for <A.03.11.10E.ODP[01]: systems, system components, or system services> at <A.03.11.10E.ODP[02]: decision points>.

Examine

[SELECT FROM: Risk assessment policy; assessment reports; criticality analysis and/or finalized criticality for each component and/or subcomponent; audit records and/or event logs; analysis reports; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with assessment and auditing responsibilities; personnel with criticality analysis responsibilities; system/network administrators; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for assessments and audits; mechanisms and/or tools supporting and/or implementing assessments and auditing].

Source Assessment Procedures: RA-09

Determine if:

A.03.11.11E.ODP[01]: corrective actions to be taken if information about the system is discoverable are defined.

A.03.11.11E[01]: discoverable information about the system is identified.

A.03.11.11E[02]: <A.03.11.11E.ODP[01]: corrective actions> are taken when information about the system is confirmed as discoverable.

Examine

[SELECT FROM: Procedures addressing vulnerability scanning; assessment report; penetration test results; vulnerability scanning results; risk assessment report; records of corrective actions taken on discoverable information; incident response records; audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with vulnerability scanning and/or penetration testing responsibilities; personnel with vulnerability scan analysis responsibilities; personnel responsible for risk response; personnel responsible for incident management and response; personnel with information security responsibilities].

Test

[SELECT FROM: Processes for vulnerability scanning; processes for risk response; processes for incident management and response; mechanisms and/or tools supporting and/or implementing vulnerability scanning; mechanisms supporting and/or implementing risk response; mechanisms supporting and/or implementing incident management and response].

Source Assessment Procedures: RA-05(04)

Determine if:

A.03.11.12E: automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.

Examine

[SELECT FROM: Information security program plan; threat awareness program policy; threat awareness program procedures; risk assessment results related to threat awareness; documentation about the cross-organization information-sharing capability; other relevant documents or records].

Interview

[SELECT FROM: Personnel with information security program planning and plan implementation responsibilities; personnel responsible for the threat awareness program; personnel responsible for the cross-organization information-sharing capability; personnel with information security responsibilities; external personnel with whom threat awareness information is shared by the organization].

Test

[SELECT FROM: Processes for implementing the threat awareness program; processes for implementing the cross-organization information-sharing capability; automated mechanisms supporting and/or implementing the threat awareness program; automated mechanisms supporting and/or implementing the cross-organization information-sharing capability].

Source Assessment Procedures: PM-16(01)

Determine if:

A.03.12.01E.ODP[01]: the frequency at which to conduct penetration testing on systems or system components is defined.

A.03.12.01E.ODP[02]: systems or system components on which penetration testing is to be conducted are defined.

A.03.12.01E: penetration testing is conducted <A.03.12.01E.ODP[01]: frequency> on <A.03.12.01E.ODP[02]: systems or system components>.

Examine

[SELECT FROM: Assessment and monitoring policy; procedures addressing penetration testing; assessment plan; system security plan; penetration test rules of engagement; penetration test report; assessment report; assessment evidence; other relevant documents or records].

Interview

[SELECT FROM: Personnel with assessment responsibilities; personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Mechanisms supporting penetration testing].

Source Assessment Procedures: CA-08

Determine if:

A.03.12.02E: independent assessors or assessment teams are used to conduct security requirement assessments.

Examine

[SELECT FROM: Assessment and monitoring policy; procedures addressing assessments; previous assessment plan; previous assessment report; plan of action and milestones; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with assessment responsibilities; personnel with information security responsibilities].

Source Assessment Procedures: CA-02(01)

Determine if:

A.03.12.03E[01]: risk monitoring is an integral part of the continuous monitoring strategy.

A.03.12.03E[02]: effectiveness monitoring is included in risk monitoring.

A.03.12.03E[03]: compliance monitoring is included in risk monitoring.

A.03.12.03E[04]: change monitoring is included in risk monitoring.

Examine

[SELECT FROM: Assessment and monitoring policy; organizational continuous monitoring strategy; system-level continuous monitoring strategy; procedures addressing continuous monitoring of system; assessment report; plan of action and milestones; system monitoring records; impact analyses; status reports; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Personnel with continuous monitoring responsibilities; personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms supporting risk monitoring].

Source Assessment Procedures: CA-07(04)

Determine if:

A.03.12.04E.ODP[01]: system components or classes of components requiring internal connections to the system are defined.

A.03.12.04E.ODP[02]: conditions requiring the termination of internal connections are defined.

A.03.12.04E.ODP[03]: the frequency at which to review the continued need for each internal connection is defined.

A.03.12.04E.a: internal connections of <A.03.12.04E.ODP[01]: system components or classes of components> to the system are authorized.

A.03.12.04E.b[01]: for each internal connection, the interface characteristics are documented.

A.03.12.04E.b[02]: for each internal connection, the security requirements are documented.

A.03.12.04E.b[03]: for each internal connection, the nature of the information communicated is documented.

A.03.12.04E.c: internal system connections are terminated after <A.03.12.04E.ODP[02]: conditions>.

A.03.12.04E.d: the continued need for each internal connection is reviewed <A.03.12.04E.ODP[03]: frequency>.