NIST SP 800-53B 日本語訳

NIST Special Publication 800-53B

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

NIST Special Publication 800-53B

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

October 2020

INCLUDES UPDATES AS OF 12-10-2020; SEE PAGE XI

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems. Such information security standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis, and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-53B Natl. Inst. Stand. Technol. Spec. Publ. 800-53B, 85 pages (October 2020) CODEN: NSPUE2 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Certain commercial entities, equipment, or materials may be identified in this document to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Comments on this publication may be submitted to: National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96].

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations.

This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation.

Assurance; impact level; privacy control; privacy control baseline; security control; security control baseline; tailoring; control selection; control overlays.

This publication was developed by the Joint Task Force Interagency Working Group. The group includes representatives from the civil, defense, and intelligence communities. The National Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from the Department of Commerce, Department of Defense, the Office of the Director of National Intelligence, the Committee on National Security Systems, and the members of the interagency working group whose dedicated efforts contributed significantly to this publication.

Dana Deasy, Chief Information Officer

John Sherman, Principal Deputy CIO

Mark Hakun, Deputy CIO for Cybersecurity and DoD SISO

Kevin Dulany, Director, Cybersecurity Policy and Partnerships

Matthew A. Kozma, Chief Information Officer

Michael E. Waschull, Deputy Chief Information Officer

Clifford M. Conner, Cybersecurity Group and IC CISO

Vacant, Director, Security Coordination Center

Charles H. Romine, Director, Information Technology Laboratory

Kevin Stine, Acting Cybersecurity Advisor, ITL

Matthew Scholl, Chief, Computer Security Division

Kevin Stine, Chief, Applied Cybersecurity Division

Ron Ross, FISMA Implementation Project Leader

Mark G. Hakun, Chair

Susan Dorr, Co-Chair

Kevin Dulany, Tri-Chair—Defense Community

Chris Johnson, Tri-Chair—Intelligence Community

Vicki Michetti, Tri-Chair—Civil Agencies

Victoria Pillitteri, NIST, JTF Leader

Ehijele Olumese, The MITRE Corporation

Esten Porter, The MITRE Corporation

David Black, The MITRE Corporation

Eduardo Takamura, NIST

McKay Tolboe, DoD

Lydia Humphries, Booz Allen Hamilton

Julie Nethery Snyder, The MITRE Corporation

Rich Graubart, The MITRE Corporation

Ned Goren, NIST

Dorian Pappas, Intelligence Community

Daniel Faigin, Aerospace Corporation

Christina Sames, The MITRE Corporation

Peter Duspiva, Intelligence Community

Andrew Regenscheid, NIST

Kelley Dempsey, NIST

Naomi Lefkovitz, NIST

Christian Enloe, NIST

Kaitlin Boeckl, NIST

Jon Boyens, NIST

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim Foti, and the NIST web team for their outstanding administrative support. The authors also wish to recognize the professional staff from the NIST Computer Security Division and the Applied Cybersecurity Division and the input from representatives from the OMB Office of Information and Regulatory Affairs (OIRA) Privacy Branch and the Federal CIO Council and Interagency Working Group for their contributions in helping to improve the technical content of the publication. Finally, the authors gratefully acknowledge the significant contributions from individuals and organizations in the public and private sectors, nationally and internationally, whose insightful and constructive comments improved the quality, thoroughness, and usefulness of this publication.

HISTORICAL CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-53 The authors wanted to acknowledge the many individuals who contributed to previous versions of Special Publication 800-53 since its inception in 2005. They include Marshall Abrams, Dennis Bailey, Lee Badger, Curt Barker, Matthew Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb Bodeau, Paul Brusil, Brett Burley, Bill Burr, Dawn Cappelli, Roger Caslow, Corinne Castanza, Mike Cooper, Matt Coose, Dominic Cussatt, George Dinolt, Randy Easter, Kurt Eleam, Denise Farrar, Dave Ferraiolo, Cita Furlani, Harriett Goldman, Peter Gouldmann, Tim Grance, Jennifer Guild, Gary Guissanie, Sarbari Gupta, Priscilla Guthrie, Richard Hale, Peggy Himes, Bennett Hodge, William Hunteman, Cynthia Irvine, Arnold Johnson, Roger Johnson, Donald Jones, Lisa Kaiser, Stuart Katzke, Sharon Keller, Tom Kellermann, Cass Kelly, Eustace King, Daniel Klemm, Steve LaFountain, Annabelle Lee, Robert Lentz, Steven Lipner, William MacGregor, Thomas Macklin, Thomas Madden, Robert Martin, Erika McCallister, Tim McChesney, Michael McEvilley, Rosalie McQuaid, Peter Mell, John Mildner, Pam Miller, Sandra Miravalle, Joji Montelibano, Douglas Montgomery, George Moore, Rama Moorthy, Mark Morrison, Harvey Newstrom, Sherrill Nicely, Robert Niemeyer, LouAnna Notargiacomo, Pat O’Reilly, Tim Polk, Karen Quigg, Steve Quinn, Mark Riddle, Ed Roback, Cheryl Roby, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone, Roger Schell, Jackie Snouffer, Ray Snouffer, Murugiah Souppaya, Gary Stoneburner, Keith Stouffer, Marianne Swanson, Pat Toth, Glenda Turner, Patrick Viscuso, Joe Weiss, Richard Wilsher, Mark Wilson, John Woodward, and Carol Woody.

Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

Organizations must exercise due diligence in managing information security and privacy risk. This is accomplished, in part, by establishing a comprehensive risk management program that uses the flexibility inherent in NIST publications to categorize systems, select and implement security and privacy controls that meet mission and business needs, assess the effectiveness of the controls, authorize the systems for operation, and continuously monitor the systems. Exercising due diligence and implementing robust and comprehensive information security and privacy risk management programs can facilitate compliance with applicable laws, regulations, executive orders, and government-wide policies. Risk management frameworks and risk management processes are essential in developing, implementing, and maintaining the protection measures necessary to address stakeholder needs and the current threats to organizational operations and assets, individuals, other organizations, and the Nation. Employing effective risk-based processes, procedures, methods, and technologies ensures that information systems and organizations have the necessary trustworthiness and resiliency to support essential mission and business functions, the U.S. critical infrastructure, and continuity of government.

In working with the Office of Management and Budget to develop standards and guidelines required by FISMA, NIST consults with federal agencies; state, local, and tribal governments; and private sector organizations to improve information security and privacy, avoid unnecessary and costly duplication of effort, and help ensure that its publications are complementary with the standards and guidelines used for the protection of national security systems. In addition to a comprehensive and transparent public review and comment process, NIST is engaged in a collaborative partnership with the Office of Management and Budget, Office of the Director of National Intelligence, Department of Defense, Committee on National Security Systems, Federal CIO Council, and Federal Privacy Council to establish a Risk Management Framework (RMF) for information security and privacy for the Federal Government. This common foundation provides the Federal Government and their contractors with cost-effective, flexible, and consistent ways to manage security and privacy risks to organizational operations and assets, individuals, other organizations, and the Nation. The framework provides a basis for the reciprocal acceptance of security and privacy control assessment evidence and authorization decisions and facilitates information sharing and collaboration. NIST continues to work with public and private sector entities to establish mappings and relationships between the standards and guidelines developed by NIST and those developed by other organizations. NIST anticipates using these mappings and the gaps they identify to improve the control catalog.

Throughout this publication, examples are used to illustrate, clarify, or explain certain items in chapter sections, controls, and control enhancements. These examples are illustrative in nature and are not intended to limit or constrain the application of controls or control enhancements by organizations.

Executive Summary

As we push computers to “the edge,” building an increasingly complex world of connected information systems and devices, security and privacy will continue to dominate the national dialogue. In its 2017 report entitled, Task Force on Cyber Deterrence [DSB 2017], the Defense Science Board provides a sobering assessment of the current vulnerabilities in the U.S. critical infrastructure and the information systems that support mission-essential operations and assets in the public and private sectors.

“…The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States must lean significantly on deterrence to address the cyber threat posed by the most capable U.S. adversaries. It is clear that a more proactive and systematic approach to U.S. cyber deterrence is urgently needed…”

There is an urgent need to further strengthen the underlying information systems, component products, and services that the Nation depends on in every sector of the critical infrastructure— ensuring that those systems, components, and services are sufficiently trustworthy and provide the necessary resilience to support the economic and national security interests of the United States.

NIST SP 800-53B responds to the call of the Defense Science Board by providing a proactive and systemic approach to developing and making available to federal agencies and private sector organizations a comprehensive set of security and privacy control baselines for all types of computing platforms, including general-purpose computing systems, cyber-physical systems, cloud-based systems, mobile devices, and industrial and process control systems. The control baselines provide a starting point for organizations in the security and privacy control selection process. Using the tailoring guidance and assumptions provided, organizations can customize their security and privacy control baselines to ensure that they have the capability to protect their critical and essential operations and assets.

Errata

This table contains changes that have been incorporated into Special Publication 800-53B. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature. Any potential updates for this document that are not yet published in an errata update or revision—including additional issues and potential corrections—will be posted as they are identified; see the SP 800-53B publication details.

THE NEED FOR SECURITY AND PRIVACY CONTROL BASELINES

Security controls are the safeguards or countermeasures selected and implemented within an information system¹ or an organization to protect the confidentiality, integrity, and availability of the system and its information and to manage information security risk. Privacy controls are the administrative, technical, and physical safeguards employed within a system or an organization to ensure compliance with applicable privacy requirements and to manage privacy risks.² Security and privacy controls are selected and implemented to satisfy the security and privacy requirements levied on an information system and/or organization. The requirements are derived from applicable laws, executive orders, directives, regulations, policies, standards, and mission needs to ensure the confidentiality, integrity, and availability of information processed, stored, or transmitted and to manage risks to individual privacy. The selection, design, and effective implementation of controls are important tasks that have significant implications for the operations and assets of organizations as well as the welfare of individuals and the Nation.

NIST Special Publication (SP) 800-37 [SP 800-37] defines two approaches for the selection of security and privacy controls: a baseline control selection approach and an organization-generated control selection approach. The baseline control selection approach uses control baselines, which are predefined sets of controls specifically assembled to meet the protection needs of a group, organization, or community of interest. The control baselines serve as a starting point for the protection of individuals’ privacy, information, and information systems. The organization-generated control selection approach is not addressed in this publication.

This publication establishes security and privacy control baselines for federal information systems and organizations and provides tailoring guidance for those baselines. The control baselines can be implemented by any organization that processes, stores, or transmits information (e.g., federal, state, local, and tribal governments, as well as private sector organizations). Implementation of a minimum set of controls selected from NIST SP 800-53, Revision 5 [SP 800-53] is mandatory to protect federal information and information systems³ in accordance with the Office of Management and Budget (OMB) Circular A-130 [OMB A-130] and the provisions of the Federal Information Security Modernization Act⁴ [FISMA]. Whereas use of the privacy control baseline is not mandated by law or [OMB A-130], SP 800-53B—along with other supporting NIST publications—is designed to help organizations identify the security and privacy controls needed to manage risk and to satisfy the security and privacy requirements in FISMA, the Privacy Act of 1974 [PRIVACT], selected OMB policies (e.g., [OMB A-130]), and designated Federal Information Processing Standards (FIPS), among others.

This publication satisfies security and privacy requirements by applying assumptions that inform the development of the security and privacy control baselines, as described in Section 2.3. The baselines serve as a starting point to meet the protection needs of organizations. The controls in the baselines are tailored following the process described in Section 2.4 to further facilitate the management of security and privacy risk specific to the organization. The tailoring process can be guided and informed by many factors, including organizational mission and business needs, stakeholder protection needs, and assessments of risk. The combination of control baseline selection and control tailoring processes can help organizations satisfy their stated security and privacy requirements.

This publication is intended to serve a diverse audience, including:

Organizations have the responsibility to choose a control selection approach in accordance with [SP 800-37].⁵ If the baseline control selection approach is chosen, organizations select a security control baseline and privacy control baseline as described in Chapter Three. Once the control baseline is selected, organizations apply the tailoring guidance provided in Chapter Two to help ensure that the resulting controls are necessary and sufficient to manage security risk⁶ and privacy risk.⁷

This publication establishes security and privacy control baselines derived from the controls in [SP 800-53]. The control baselines in this publication are in accordance with requirements for federal information and information systems included in [OMB A-130],⁸ Federal Information Processing Standard 199 [FIPS 199], and Federal Information Processing Standard 200 [FIPS 200]. [SP 800-37] provides guidance on control selection approaches.

The security and privacy controls specified in the baselines represent the state-of-the-practice protection measures for individuals, information systems, and organizations. The controls comprising the baselines are periodically reviewed and revised to reflect the experience gained from using the controls; new or revised laws, executive orders, directives, regulations, policies, and standards; changing security and privacy requirements; emerging threats, vulnerabilities, attacks, and information processing methods; and the availability of new technologies. Thus, the security and privacy controls specified in the baselines are also expected to change over time as controls are withdrawn, revised, and added. In addition to the need for change, the need for stability is addressed by requiring that proposed changes to the baseline undergo a rigorous and transparent public review process to obtain public and private sector feedback and to build a consensus for baseline changes. The public review process provides a stable, flexible, and technically sound set of security and privacy control baselines.

The remainder of this special publication is organized as follows:

Security and privacy control baselines are predefined sets of controls specifically assembled to address the protection needs of groups, organizations, or communities of interest. The control baselines serve as a starting point for the protection of individuals’ privacy, information, and information systems and can be tailored (i.e., customized)—appropriately taking into account organizational missions and business functions, specific and credible threat information, the environment in which the organization operates, and individuals’ privacy interests.

CONTROL BASELINES, TAILORING, OVERLAYS, AND CAPABILITIES

This chapter presents the fundamental concepts associated with security and privacy control baselines, including the purpose of control baselines, how control baselines are selected, assumptions associated with control baselines, how the tailoring process is used to customize controls and baselines, the purpose of overlays and how they are used to address the security and privacy needs of communities of interest, and how the concept of capabilities can facilitate the grouping of mutually reinforcing controls.

A significant challenge for organizations is selecting a set of security and privacy controls that can protect their mission and business functions and provide the capability to manage security and privacy risk. The selected controls, if correctly implemented and determined to be effective, meet security and privacy requirements defined by applicable laws, executive orders, policies, regulations, and directives. There is no single set of controls that addresses all security and privacy concerns in every situation. However, choosing the most appropriate controls for a specific situation or system to adequately respond to risk requires a fundamental understanding of the organization’s mission and business priorities, the mission and business functions that the systems will support, and the environments in which the systems will operate. It also requires close collaboration with key organizational stakeholders. With that understanding, organizations can demonstrate how to efficiently and cost-effectively assure the confidentiality, integrity, and availability of organizational information and systems, as well as the privacy of individuals in the context of supporting the organization’s mission and business functions.

The concept of a control baseline is introduced to assist organizations in selecting a set of controls for their systems that is commensurate with security and privacy risk. A control baseline is a collection of controls from [SP 800-53] assembled to address the protection needs of a group, organization, or community of interest.¹⁰ It provides a generalized set of controls that represents a starting point for the subsequent tailoring activities that are applied to the baseline to produce a targeted or customized security and privacy solution for the entity that the baseline is intended to serve. Control baselines are tailored based on a variety of factors, including threat information, mission or business requirements, types of systems, sector-specific requirements, specific technologies, operating environments, organizational assumptions and constraints, individuals’ privacy interests, laws, executive orders, regulations, policies, directives, standards, or industry best practices. Tailoring activities are described in greater detail in Section 2.4.

Information security programs are responsible for protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction (i.e., unauthorized system activity or behavior) in order to provide confidentiality, integrity, and availability. Privacy programs are responsible for managing the risks to individuals associated with the creation, collection, use, processing, dissemination, storage, maintenance, disclosure, or disposal (collectively referred to as “processing”) of personally identifiable information (PII) and for ensuring compliance with applicable privacy requirements.¹¹ When a system processes PII, the information security and privacy programs have a shared responsibility to manage the impacts to individuals that arise from security risks and collaborate to determine the security categorization and the selection and tailoring of controls from the security control baselines.

Security Control Baselines

In preparation for selecting and tailoring the appropriate security control baselines for organizational systems and their respective environments of operation, organizations first determine the criticality and sensitivity of the information to be processed, stored, or transmitted by those systems. The process of determining information criticality and sensitivity is known as security categorization and is described in [FIPS 199].¹² The results of security categorization help guide and inform the selection of security control baselines to protect systems and information. The control baselines selected for systems are commensurate with the potential adverse impact on organizational operations, organizational assets, individuals, other organizations, or the Nation if there is a loss of confidentiality, integrity, or availability. [FIPS 199] requires organizations to categorize systems as low-impact, moderate-impact, or high-impact for the stated security objectives of confidentiality, integrity, and availability.¹³

Since the potential impact values for confidentiality, integrity, and availability may not always be the same for a particular system, the high water mark concept (introduced in [FIPS 199]) is used in [FIPS 200] to determine the impact level of the system. The impact level of the system, in turn, is used for the express purpose of selecting the applicable security control baseline from one of the three baselines identified in Chapter Three.¹⁴ Thus, a low-impact system is defined as a system in which all three of the security objectives are low. A moderate-impact system is a system in which at least one of the security objectives is moderate and no security objective is high. Finally, a high-impact system is a system in which at least one security objective is high.

Once the impact level of the system is determined, organizations select the appropriate security control baseline.¹⁵ The selection of the security control baseline is based on the [FIPS 200] impact level of the system as determined by the security categorization process described above. The organization selects one of three security control baselines from Chapter Three corresponding to the low-impact, moderate-impact, or high-impact categorization of the system. Note that not all controls or control enhancements identified in [SP 800-53] are assigned to control baselines as indicated in the tables in Chapter Three. The controls and control enhancements that are assigned to baselines are indicated by an “x” in the low, moderate, or high columns in Tables 3-1 through 3-20. The use of the term control baseline is intentional. The controls and control enhancements in the baselines are a starting point from which controls or enhancements may be removed, added, or specialized based on the tailoring guidance in Section 2.4.16

Privacy Control Baseline

In addition to the three security control baselines, Chapter Three provides an initial privacy control baseline for federal agencies to address privacy requirements and manage privacy risks that arise from the processing of PII based on privacy program responsibilities under [OMB A-130].¹⁷ The controls and control enhancements that are assigned to the privacy baseline are indicated by an “x.”¹⁸ Not all controls or control enhancements that address privacy risk are assigned to the privacy control baseline. This approach provides a starting point from which controls or control enhancements may be removed, added, or specialized based on the tailoring guidance in Section 2.4.19

Organizations conduct privacy risk assessments that consider the nature of the PII processing and its impact on individuals to guide the tailoring of the privacy control baseline for their programs and systems. Privacy risk assessments include evaluating the applicability of legal and policy requirements for their programs. For example, organizations may remove controls or control enhancements related to legal or policy requirements that are not applicable to them unless they determine that, based on a privacy risk assessment, the controls or control enhancements would be helpful in mitigating identified privacy risks. In addition, organizations may add unassigned controls or control enhancements to mitigate privacy risks specific to their information systems as determined by their privacy risk assessments.

The control baselines in Chapter Three address the protection needs of a diverse set of constituencies, including individual users and organizations. Thus, certain working assumptions generally underlie the control baselines in Chapter Three. These assumptions, made when determining the baselines in Chapter Three, consider the environments in which organizational information systems operate, including legislative, regulatory, or policy obligations; the nature of organizational operations; the specific functionality employed within the systems; the types of threats confronting organizations, mission and business processes, and systems; individuals’ privacy interests; and the types of information processed, stored, or transmitted by systems.²⁰ Articulating the underlying assumptions is a key element in the Risk Framing step of the risk management process described in [SP 800-39] and reinforced in the Prepare step in [SP 800-37]. Specific assumptions that underlie the control baselines in Chapter Three include:

If any of the above assumptions are not valid, then some of the security controls allocated to the control baselines in Chapter Three may not be applicable—a situation that can be addressed by applying the tailoring guidance in Section 2.4 and the results of organization- and system-level risk assessments. Additional assumptions that are not addressed in the baselines include:

If any of these assumptions apply, then additional controls from [SP 800-53] are likely needed to ensure adequate protection—a situation that can also be effectively addressed by applying the tailoring guidance in Section 2.4 (specifically, security control supplementation) and the results of organization- and system-level assessments of risk.

After selecting an appropriate control baseline, organizations initiate a tailoring process to align the controls more closely with the specific security and privacy requirements identified by the organization. The tailoring process is part of an organization-wide risk management process that includes framing, assessing, responding to, and monitoring information security and privacy risks. Tailoring decisions are dependent on organizational or system-specific factors. While tailoring decisions are focused on security and privacy considerations, the decisions are typically aligned with other risk-related issues that organizations must routinely address. Risk-related issues such as cost, schedule, and performance are considered in the determination of which controls to employ and how to implement controls in organizational systems and environments of operation.²⁴ The tailoring process can include but is not limited to the following activities:²⁵

Organizations use risk management guidance to facilitate risk-based decision making regarding the applicability of the controls in the baselines. Ultimately, organizations employ the tailoring process to achieve cost-effective solutions that support organizational mission and business needs and provide security and privacy protections commensurate with risk. Organizations have the flexibility to tailor at the organization level for systems in support of a line of business or a mission or business process, at the individual system level, or by using a combination of the two.²⁶ However, organizations do not arbitrarily remove security and privacy controls from baselines. Tailoring decisions are expected to be defensible based on mission and business needs, a sound rationale, and explicit risk-based determinations.²⁷

Tailoring decisions, including the risk-based justification for the decisions, are documented in the system security and privacy plans for organizational systems.²⁸ Every control from the selected control baseline is accounted for by the organization. If certain controls are tailored out, the rationale is recorded in the system security and privacy plans and subsequently approved by the responsible officials within the organization as part of the approval process for the plans. Documenting risk management decisions during the baseline tailoring process is imperative for organizational officials to have the necessary information to make credible, risk-based decisions regarding security and privacy and to do so in a manner that fully supports transparency, traceability, and accountability.

Common controls are controls that may be inherited by one or more organizational systems. If a system inherits a common control provided by another entity (internal or external), there is no need to implement the control within that system. Organizational decisions on which controls are designated as common controls may affect the responsibilities of individual system owners with regard to the implementation of the controls in a baseline.²⁹ Common control providers ensure that current implementation information and assessment results are available to facilitate decision making by system owners and authorizing officials. System owners and authorizing officials determine if the common controls available for inheritance actually provide protection commensurate with risk for inheriting systems.³⁰

Common control designation and control implementation can affect organizations’ resource expenditures. That is, in general, the greater the number of common controls implemented, the greater the potential cost savings since the protective measures are amortized over many systems. Additionally, the deployment of controls as common controls often provides a more standardized, stable, scalable, and secure implementation across the organization as opposed to the same control implemented separately on multiple individual systems.

Scoping considerations, when applied in conjunction with risk management guidance, provide organizations with a more granular foundation on which to make risk-based decisions.³¹ The application of these scoping considerations can eliminate unnecessary controls from the initial control baselines and ensure that organizations select only those controls that are needed to provide a level of protection that is commensurate with risk. Organizations may apply the scoping considerations described below as needed to assist with making risk-based decisions regarding control selection and specification.

The growing complexity of systems requires careful analysis in the implementation of security and privacy controls. Controls in the initial baselines may not be applicable to every component in the system. Controls are applicable only to system components that provide or support the security or privacy functions or capabilities addressed by the controls.³² Organizations make explicit risk-based decisions about where to apply or allocate specific controls in organizational systems to achieve the needed security or privacy function or capability and to satisfy security and privacy requirements.

Certain controls in the control baselines assume the existence of operational or environmental factors. Where operational or environmental factors are absent or significantly diverge from the baseline assumptions described in Section 2.3, it is justifiable to tailor the baseline. Common operational and environmental factors include mobile devices and operations; single-user systems and operations; data connectivity and bandwidth; air-gapped systems; systems that have very limited or sporadic bandwidth, such as tactical systems that support warfighter or law enforcement missions; cyber-physical systems, sensors, and Internet of Things (IoT) devices; limited functionality systems, such as facsimile machines, printers, and digital cameras; systems that process, store, or transmit non-persistent information or that use virtualization techniques to establish non-persistent instantiations of operating systems and applications; and systems that require public access.

Controls that refer to specific technologies—such as wireless, cryptography, or public key infrastructure—are applicable only if those technologies are implemented or required for use within organizational systems. Controls that can be effectively supported by automated mechanisms do not require the development of such mechanisms if the mechanisms do not already exist or are not readily available in commercial or government off-the-shelf products. If automated mechanisms are not available, cost-effective, or technically feasible, compensating controls implemented through non-automated mechanisms or procedures can be implemented to satisfy specified controls or control enhancements.

Certain controls may not be appropriate if implementing those controls has the potential to degrade, debilitate, or interfere with organizational mission or business functions, including endangering or harming individuals. However, decisions on the appropriateness of control implementation always consider legislative, regulatory, and policy requirements.

Controls that support only one or two of the security objectives (i.e., confidentiality, integrity, or availability) may be downgraded to the corresponding control in a lower baseline (or modified or eliminated if not defined in a lower baseline) only if the downgrading action reflects the [FIPS 199] security category for the supported security objectives before considering the [FIPS 200] impact level (i.e., high water mark), is supported by an organizational assessment of risk, and does not adversely affect the level of protection for the security-relevant information within the system. For example, if a system is categorized as moderate-impact using the high water mark concept because confidentiality and/or integrity are moderate but availability is low, there are several controls that only support the availability security objective and that could potentially be downgraded to the low baseline controls. In this scenario, it may be appropriate to refrain from implementing CP-2(1) because the control enhancement only supports availability and is selected in the moderate baseline but not in the low baseline. The following security controls and control enhancements are candidates for downgrading for each of the security categories:

Although controls that are used to meet legislative, regulatory, or policy requirements are not to be tailored out of control baselines, some legislative, regulatory, or policy requirements may only apply in specified circumstances. It is justifiable to tailor the baseline when these circumstances are not applicable to an organization or certain systems.

Selecting Compensating Controls

Compensating controls are used by organizations in lieu of specific controls in control baselines. The use of compensating controls is appropriate when controls are tailored out of the control baseline by necessity, but the protection provided by the controls is still needed to reduce risk to an acceptable level. Compensating controls are often chosen when implementing a baseline control is technically infeasible, not cost effective, or the control implementation negatively affects organizational mission or business functions.³³ For technology-based scoping considerations, compensating controls may be temporary and used only until the system is updated. Compensating controls are intended to provide equivalent or comparable protection³⁴ for systems, organizations, and individuals.³⁵ Compensating controls are selected after applying the scoping considerations in the tailoring process. To use compensating controls, organizations:

Assigning Control Parameter Values

Controls and control enhancements containing embedded parameters (i.e., assignment and selection operations) give organizations the flexibility to specify values for certain portions of controls and control enhancements to support specific organizational requirements. After the application of scoping considerations and the selection of compensating controls, organizations review the controls and control enhancements for assignment or selection operations and determine the appropriate organization-defined values for the identified parameters. The parameter values may be driven by mission or business requirements, or the values may be prescribed by laws, executive orders, directives, regulations, policies, standards, guidelines, or industry best practices.

Once organizations specify the parameter values for the controls and control enhancements, the specified assignment and selection values become a permanent part of the control and control enhancement. As such, they are documented in security and privacy program plans or system security and privacy plans, as appropriate. Organizations can specify the parameter values before selecting compensating controls since the parameter specification completes the control definitions and may affect the need for compensating controls. There can be significant benefits to collaborating on the development of parameter values for controls. For organizations that work together on a frequent basis or regularly conduct exchanges of information, it may be useful to develop a mutually agreeable set of control parameter values.

Supplementing Control Baselines

In certain situations, additional controls or control enhancements beyond the controls and enhancements contained in the control baselines in Chapter Three may be required to address specific threats to organizations, mission and business processes, and systems; to address specific types of PII processing and associated privacy risks; and to satisfy the requirements of laws, executive orders, directives, policies, regulations, standards, and guidelines. Organizational assessments of risk provide information for determining the necessity and sufficiency of the controls and control enhancements in the control baselines. Organizations are encouraged to make maximum use of the control catalog in [SP 800-53] to supplement control baselines with additional controls or control enhancements.

Providing Additional Specification Information for Control Implementation

Since controls and control enhancements are statements of security or privacy functions or capabilities that are conveyed at higher levels of abstraction, the controls may lack sufficient information for implementation. Therefore, additional details may be necessary to fully define the intent of a given control for implementation purposes and to ensure that the security and privacy requirements related to that control are satisfied. For example, additional information may be provided as part of the process of moving from control to specification requirements and may involve refinement of implementation details, refinement of scope, or iteration to apply the same control differently to different scopes. The need to provide control specification information occurs routinely when controls are employed in a systems engineering process as part of requirements engineering. Organizations ensure that if existing control information is not sufficient to define the intended implementation details for the control, such information is provided to system owners and common control providers. Organizations have the flexibility to determine whether control specification information is included as part of the control statement or in a separate control addendum section. When providing additional detail, organizations are cautioned not to change the intent of the base control or modify the original language in the control. Implementation information is documented in the system security and privacy plans.

Organizations consider defining a set of capabilities as a precursor to the control selection process. The concept of capability recognizes that satisfying security or privacy requirements seldom derives from a single control but rather from a set of mutually reinforcing controls. For example, organizations may wish to define a capability for secure remote authentication. This capability can be achieved by the selection and implementation of a set of controls from [SP 800-53], such as IA-2 (1), IA-2 (2), IA-2 (8), IA-2 (9), and SC-8 (1). Moreover, capabilities can address a variety of areas that can include technical means, physical means, procedural means, or any combination thereof. In addition to the above capability for secure remote access, organizations may also need security capabilities that address physical means, such as tamper detection on a cryptographic module or anomaly detection/analysis on an orbiting spacecraft.

As the number of controls in [SP 800-53] grows in response to an increasingly sophisticated threat space, it is important for organizations to have the ability to describe key capabilities needed to protect organizational missions and business functions, and to subsequently select controls that—if properly designed, developed, and implemented—produce such capabilities. The use of capabilities simplifies how the protection problem is viewed conceptually. Using the construct of a capability provides a method of grouping controls that are employed for a common purpose or to achieve a common objective. For example, the grouping of controls is an important consideration when assessing controls for effectiveness.³⁷

Traditionally, assessments have been conducted on a control-by-control basis, producing results that are characterized as pass (i.e., control satisfied) or fail (i.e., control not satisfied). However, the failure of a single control, or in some cases, multiple controls may not affect the overall capability needed by an organization. Moreover, employing the broader construct of a capability allows an organization to assess the severity of the vulnerabilities in its systems and determine if the failure of a particular control or the decision not to deploy a control affects the capability needed for mission and business protection. It also facilitates conducting root cause analyses to determine if the failure of one control can be traced to the failure of other controls based on the established control relationships. Ultimately, authorization decisions (i.e., risk acceptance decisions) are made based on the degree to which the desired capabilities have been effectively achieved and are meeting the security and privacy requirements defined by an organization. These risk-based decisions are directly related to the organizational risk tolerance that is defined as part of an organization’s risk management strategy.

SECURITY AND PRIVACY CONTROL BASELINES

Tables 3-1 through 3-20 provide a listing of the controls and control enhancements assigned to the control families in [SP 800-53] and the respective control allocations to the privacy control baseline and the low-impact, moderate-impact, and high-impact security control baselines. Section 2.2 (Privacy Control Baseline) provides additional information on the privacy control selection criteria.

Table 3-1 provides a summary of the controls and control enhancements assigned to the Access Control Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

TABLE 3-1: ACCESS CONTROL FAMILY

Table 3-2 provides a summary of the controls and control enhancements assigned to the Awareness and Training Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

TABLE 3-2: AWARENESS AND TRAINING FAMILY

Table 3-3 provides a summary of the controls and control enhancements assigned to the Audit and Accountability Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

TABLE 3-3: AUDIT AND ACCOUNTABILITY FAMILY

Table 3-4 provides a summary of the controls and control enhancements assigned to the Assessment, Authorization, and Monitoring Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

TABLE 3-4: ASSESSMENT, AUTHORIZATION, AND MONITORING FAMILY

Table 3-5 provides a summary of the controls and control enhancements assigned to the Configuration Management Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

TABLE 3-5: CONFIGURATION MANAGEMENT FAMILY

Table 3-6 provides a summary of the controls and control enhancements assigned to the Contingency Planning Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

TABLE 3-6: CONTINGENCY PLANNING FAMILY