Enclosure Notice NIST Rev 5 (Final) 01102022

ATTACHMENT

With reference to paragraph 15 of the Agreement, adequate security shall include, at minimum, implementation security and privacy controls in accordance with:

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5* (“Rev 5”), Security and Privacy Controls for Information Systems and Organizations.

In September 2020, the National Institute of Standards and Technology (NIST), published an update, Revision 5, to NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organization. SP 800-53 Revision 5 is part of the NIST Special Publication 800-series that reports on the NIST Information Technology Laboratory’s (ITL) computer security-related research, guidelines, and outreach. The publication provides a comprehensive set of security controls, three security control baselines (low, moderate, and high impact), and guidance for tailoring the appropriate baseline to specific needs according to the organization's missions, environments of operation, and technologies used.

A separate guideline, SP 800-53B, Control Baselines for Information Systems and Organizations, provides specific guidelines that facilitate periodic assessment of security controls to ensure that controls have been implemented correctly, are operating as intended, and are meeting the organization's security requirements.

NIST SP 800-53 Rev 5 - Families

1. AC - Access Control (23)

2. AT - Awareness and Training (5)

3. AU - Audit and Accountability (15)

4. CA – Assessment, Authorization, and Monitoring (8)

5. CM - Configuration Management (14)

6. CP - Contingency Planning (12)

7. IA - Identification and Authentication (12)

8. IR - Incident Response (9)

9. MA – Maintenance (7)

10. MP - Media Protection (8)

11. PE - Physical and Environmental Protection (22)

12. PL – Planning (8)

13. PM – Program Management (32)

14. PS - Personnel Security (9)

15. PT – PII Processing and Transparency (8)

16. RA - Risk Assessment (9)

17. SA - System and Services Acquisition (16)

18. SC - System and Communications Protection (47)

19. SI - System and Information Integrity (22)

20. SR – Supply Chain Risk Management (12)

The 20 Families are broken into 322 Controls

(Note: There will be overlap in numbers between the baselines)

• 188 are High Impact

• 177 are Moderate Impact, and

• 131 are Low Impact

The following pages provide a breakdown of each control and the assigned impact level. Detailed requirements for each control can be found at: NIST Risk Management Framework | CSRC

Further understanding can be acquired from the NIST Special Publication 800-53, Rev 5, found at: http://csrc.nist.gov/publications/PubsSPs.html

No.	Control Name	Low-Impact	Moderate-Impact	High-Impact	Privacy Control Baseline
ACCESS CONTROL
AC-1	POLICY AND PROCEDURES	AC-1	AC-1	AC-1	AC-1
AC-2	ACCOUNT MANAGEMENT	AC-2	AC-2 (1) (2) (3) (4) (5) (13)	AC-2 (1) (2) (3) (4) (5) (11) (12) (13)
AC-3	ACCESS ENFORCEMENT	AC-3	AC-3	AC-3	AC-3 (14)
AC-4	INFORMATION FLOW ENFORCEMENT		AC-4	AC-4 (4)
AC-5	SEPARATION OF DUTIES		AC-5	AC-5
AC-6	LEAST PRIVILEGE		AC-6 (1) (2) (5) (7) (9) (10)	AC-6 (1) (2) (3) (5) (7) (9) (10)
AC-7	UNSUCCESSFUL LOGON ATTEMPTS	AC-7	AC-7	AC-7
AC-8	SYSTEM USE NOTIFICATION	AC-8	AC-8	AC-8
AC-9	PREVIOUS LOGON NOTIFICATION
AC-10	CONCURRENT SESSION CONTROL			AC-10
AC-11	DEVICE LOCK		AC-11 (1)	AC-11 (1)
AC-12	SESSION TERMINATION		AC-12	AC-12
AC-13	SUPERVISION AND REVIEW — ACCESS CONTROL
AC-14	PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION	AC-14	AC-14	AC-14
AC-15	AUTOMATED MARKING
AC-16	SECURITY AND PRIVACY ATTRIBUTES
AC-17	REMOTE ACCESS	AC-17	AC-17 (1) (2) (3) (4)	AC-17 (1) (2) (3) (4)
AC-18	WIRELESS ACCESS	AC-18	AC-18 (1) (3)	AC-18 (1) (3) (4) (5)
AC-19	ACCESS CONTROL FOR MOBILE DEVICES	AC-19	AC-19 (5)	AC-19 (5)
AC-20	USE OF EXTERNAL SYSTEMS	AC-20	AC-20 (1) (2)	AC-20 (1) (2)
AC-21	INFORMATION SHARING		AC-21	AC-21
AC-22	PUBLICLY ACCESSIBLE CONTENT	AC-22	AC-22	AC-22
AC-23	DATA MINING PROTECTION
AC-24	ACCESS CONTROL DECISIONS
AC-25	REFERENCE MONITOR
AWARENESS AND TRAINING
AT-1	POLICY AND PROCEDURES	AT-1	AT-1	AT-1	AT-1
AT-2	LITERACY TRAINING AND AWARENESS	AT-2 (2)	AT-2 (2) (3)	AT-2 (2) (3)	AT-2
AT-3	ROLE-BASED TRAINING	AT-3	AT-3	AT-3	AT-3 (5)
AT-4	TRAINING RECORDS	AT-4	AT-4	AT-4	AT-4
AT-5	CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS
AT-6	TRAINING FEEDBACK
AUDIT AND ACCOUNTABILITY
AU-1	POLICY AND PROCEDURES	AU-1	AU-1	AU-1	AU-1
AU-2	EVENT LOGGING	AU-2	AU-2	AU-2	AU-2
AU-3	CONTENT OF AUDIT RECORDS	AU-3	AU-3 (1)	AU-3 (1)	AU-3 (3)
AU-4	AUDIT LOG STORAGE CAPACITY	AU-4	AU-4	AU-4
AU-5	RESPONSE TO AUDIT LOGGING PROCESS FAILURES	AU-5	AU-5	AU-5 (1) (2)
AU-6	AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING	AU-6	AU-6 (1) (3)	AU-6 (1) (3) (5) (6)
AU-7	AUDIT RECORD REDUCTION AND REPORT GENERATION		AU-7 (1)	AU-7 (1)
AU-8	TIME STAMPS	AU-8	AU-8	AU-8
AU-9	PROTECTION OF AUDIT INFORMATION	AU-9	AU-9 (4)	AU-9 (2) (3) (4)
AU-10	NON-REPUDIATION			AU-10
AU-11	AUDIT RECORD RETENTION	AU-11	AU-11	AU-11	AU-11
AU-12	AUDIT RECORD GENERATION	AU-12	AU-12	AU-12 (1) (3)
AU-13	MONITORING FOR INFORMATION DISCLOSURE
AU-14	SESSION AUDIT
AU-15	ALTERNATE AUDIT LOGGING CAPABILITY
AU-16	CROSS-ORGANIZATIONAL AUDIT LOGGING
ASSESSMENT, AUTHORIZATION AND MONITORING
CA-1	POLICY AND PROCEDURES	CA-1	CA-1	CA-1	CA-1
CA-2	CONTROL ASSESSMENTS	CA-2	CA-2 (1)	CA-2 (1) (2)	CA-2
CA-3	INFORMATION EXCHANGE	CA-3	CA-3	CA-3 (6)
CA-4	SECURITY CERTIFICATION
CA-5	PLAN OF ACTION AND MILESTONES	CA-5	CA-5	CA-5	CA-5
CA-6	AUTHORIZATION	CA-6	CA-6	CA-6	CA-6
CA-7	CONTINUOUS MONITORING	CA-7 (4)	CA-7 (1) (4)	CA-7 (1) (4)	CA-7 (4)
CA-8	PENETRATION TESTING			CA-8 (1)
CA-9	INTERNAL SYSTEM CONNECTIONS	CA-9	CA-9	CA-9
CONFIGURATION MANAGEMENT
CM-1	POLICY AND PROCEDURES	CM-1	CM-1	CM-1	CM-1
CM-2	BASELINE CONFIGURATION	CM-2	CM-2 (2) (3) (7)	CM-2 (2) (3) (7)
CM-3	CONFIGURATION CHANGE CONTROL		CM-3 (2) (4)	CM-3 (1) (2) (4) (6)
CM-4	IMPACT ANALYSES	CM-4	CM-4 (2)	CM-4 (1) (2)	CM-4
CM-5	ACCESS RESTRICTIONS FOR CHANGE	CM-5	CM-5	CM-5 (1)
CM-6	CONFIGURATION SETTINGS	CM-6	CM-6	CM-6 (1) (2)
CM-7	LEAST FUNCTIONALITY	CM-7	CM-7 (1) (2) (5)	CM-7 (1) (2) (5)
CM-8	SYSTEM COMPONENT INVENTORY	CM-8	CM-8 (1) (3)	CM-8 (1) (2) (3) (4)
CM-9	CONFIGURATION MANAGEMENT PLAN		CM-9	CM-9
CM-10	SOFTWARE USAGE RESTRICTIONS	CM-10	CM-10	CM-10
CM-11	USER-INSTALLED SOFTWARE	CM-11	CM-11	CM-11
CM-12	INFORMATION LOCATION		CM-12 (1)	CM-12 (1)
CM-13	DATA ACTION MAPPING
CM-14	SIGNED COMPONENTS
CONTINGENCY PLANNING
CP-1	POLICY AND PROCEDURES	CP-1	CP-1	CP-1
CP-2	CONTINGENCY PLAN	CP-2	CP-2 (1) (3) (8)	CP-2 (1) (2) (3) (5) (8)
CP-3	CONTINGENCY TRAINING	CP-3	CP-3	CP-3 (1)
CP-4	CONTINGENCY PLAN TESTING	CP-4	CP-4 (1)	CP-4 (1) (2)
CP-5	CONTINGENCY PLAN UPDATE
CP-6	ALTERNATE STORAGE SITE		CP-6 (1) (3)	CP-6 (1) (2) (3)
CP-7	ALTERNATE PROCESSING SITE		CP-7 (1) (2) (3)	CP-7 (1) (2) (3) (4)
CP-8	TELECOMMUNICATIONS SERVICES		CP-8 (1) (2)	CP-8 (1) (2) (3) (4)
CP-9	SYSTEM BACKUP	CP-9	CP-9 (1) (8)	CP-9 (1) (2) (3) (5) (8)
CP-10	SYSTEM RECOVERY AND RECONSTITUTION	CP-10	CP-10 (2)	CP-10 (2) (4)
CP-11	ALTERNATE COMMUNICATIONS PROTOCOLS
CP-12	SAFE MODE
CP-13	ALTERNATIVE SECURITY MECHANISMS
IDENTIFICATION AND AUTHENTICATION
IA-1	POLICY AND PROCEDURES	IA-1	IA-1	IA-1
IA-2	IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)	IA-2 (1) (2) (8) (12)	IA-2 (1) (2) (8) (12)	IA-2 (1) (2) (5) (8) (12)
IA-3	DEVICE IDENTIFICATION AND AUTHENTICATION		IA-3	IA-3
IA-4	IDENTIFIER MANAGEMENT	IA-4	IA-4 (4)	IA-4 (4)
IA-5	AUTHENTICATOR MANAGEMENT	IA-5 (1)	IA-5 (1) (2) (6)	IA-5 (1) (2) (6)
IA-6	AUTHENTICATION FEEDBACK	IA-6	IA-6	IA-6
IA-7	CRYPTOGRAPHIC MODULE AUTHENTICATION	IA-7	IA-7	IA-7
IA-8	IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS)	IA-8 (1) (2) (4)	IA-8 (1) (2) (4)	IA-8 (1) (2) (4)
IA-9	SERVICE IDENTIFICATION AND AUTHENTICATION
IA-10	ADAPTIVE AUTHENTICATION
IA-11	RE-AUTHENTICATION	IA-11	IA-11	IA-11
IA-12	IDENTITY PROOFING		IA-12 (2) (3) (5)	IA-12 (2) (3) (4) (5)
INCIDENT RESPONSE
IR-1	POLICY AND PROCEDURES	IR-1	IR-1	IR-1	IR-1
IR-2	INCIDENT RESPONSE TRAINING	IR-2	IR-2	IR-2 (1) (2)	IR-2 (3)
IR-3	INCIDENT RESPONSE TESTING		IR-3 (2)	IR-3 (2)	IR-3
IR-4	INCIDENT HANDLING	IR-4	IR-4 (1)	IR-4 (1) (4) (11)	IR-4
IR-5	INCIDENT MONITORING	IR-5	IR-5	IR-5 (1)	IR-5
IR-6	INCIDENT REPORTING	IR-6	IR-6 (1) (3)	IR-6 (1) (3)	IR-6
IR-7	INCIDENT RESPONSE ASSISTANCE	IR-7	IR-7 (1)	IR-7 (1)	IR-7
IR-8	INCIDENT RESPONSE PLAN	IR-8	IR-8	IR-8	IR-8 (1)
IR-9	INFORMATION SPILLAGE RESPONSE
IR-10	INTEGRATED INFORMATION SECURITY ANALYSIS TEAM
MAINTENANCE
MA-1	POLICY AND PROCEDURES	MA-1	MA-1	MA-1
MA-2	CONTROLLED MAINTENANCE	MA-2	MA-2	MA-2 (2)
MA-3	MAINTENANCE TOOLS		MA-3 (1) (2) (3)	MA-3 (1) (2) (3)
MA-4	NONLOCAL MAINTENANCE	MA-4	MA-4	MA-4 (3)
MA-5	MAINTENANCE PERSONNEL	MA-5	MA-5	MA-5 (1)
MA-6	TIMELY MAINTENANCE		MA-6	MA-6
MA-7	FIELD MAINTENANCE
MEDIA PROTECTION
MP-1	POLICY AND PROCEDURES	MP-1	MP-1	MP-1	MP-1
MP-2	MEDIA ACCESS	MP-2	MP-2	MP-2
MP-3	MEDIA MARKING		MP-3	MP-3
MP-4	MEDIA STORAGE		MP-4	MP-4
MP-5	MEDIA TRANSPORT		MP-5	MP-5
MP-6	MEDIA SANITIZATION	MP-6	MP-6	MP-6 (1) (2) (3)	MP-6
MP-7	MEDIA USE	MP-7	MP-7	MP-7
MP-8	MEDIA DOWNGRADING
PHYSICAL AND ENVIRONMENTAL PROTECTION
PE-1	POLICY AND PROCEDURES	PE-1	PE-1	PE-1
PE-2	PHYSICAL ACCESS AUTHORIZATIONS	PE-2	PE-2	PE-2
PE-3	PHYSICAL ACCESS CONTROL	PE-3	PE-3	PE-3 (1)
PE-4	ACCESS CONTROL FOR TRANSMISSION		PE-4	PE-4
PE-5	ACCESS CONTROL FOR OUTPUT DEVICES		PE-5	PE-5
PE-6	MONITORING PHYSICAL ACCESS	PE-6	PE-6 (1)	PE-6 (1) (4)
PE-7	VISITOR CONTROL
PE-8	VISITOR ACCESS RECORDS	PE-8	PE-8	PE-8 (1)	PE-8 (3)
PE-9	POWER EQUIPMENT AND CABLING		PE-9	PE-9
PE-10	EMERGENCY SHUTOFF		PE-10	PE-10
PE-11	EMERGENCY POWER		PE-11	PE-11 (1)
PE-12	EMERGENCY LIGHTING	PE-12	PE-12	PE-12
PE-13	FIRE PROTECTION	PE-13	PE-13 (1)	PE-13 (1) (2)
PE-14	ENVIRONMENTAL CONTROLS	PE-14	PE-14	PE-14
PE-15	WATER DAMAGE PROTECTION	PE-15	PE-15	PE-15 (1)
PE-16	DELIVERY AND REMOVAL	PE-16	PE-16	PE-16
PE-17	ALTERNATE WORK SITE		PE-17	PE-17
PE-18	LOCATION OF SYSTEM COMPONENTS			PE-18
PE-19	INFORMATION LEAKAGE
PE-20	ASSET MONITORING AND TRACKING
PE-21	ELECTROMAGNETIC PULSE PROTECTION
PE-22	COMPONENT MARKING
PE-23	FACILITY LOCATION
PLANNING
PL-1	POLICY AND PROCEDURES	PL-1	PL-1	PL-1	PL-1
PL-2	SYSTEM SECURITY AND PRIVACY PLANS	PL-2	PL-2	PL-2	PL-2
PL-3	SYSTEM SECURITY PLAN UPDATE
PL-4	RULES OF BEHAVIOR	PL-4 (1)	PL-4 (1)	PL-4 (1)	PL-4 (1)
PL-5	PRIVACY IMPACT ASSESSMENT
PL-6	SECURITY-RELATED ACTIVITY PLANNING
PL-7	CONCEPT OF OPERATIONS
PL-8	SECURITY AND PRIVACY ARCHITECTURES		PL-8	PL-8	PL-8
PL-9	CENTRAL MANAGEMENT				PL-9
PL-10	BASELINE SELECTION	PL-10	PL-10	PL-10
PL-11	BASELINE TAILORING	PL-11	PL-11	PL-11
PROGRAM MANAGEMENT
PM-1	INFORMATION SECURITY PROGRAM PLAN
PM-2	INFORMATION SECURITY PROGRAM LEADERSHIP ROLE
PM-3	INFORMATION SECURITY AND PRIVACY RESOURCES				PM-3
PM-4	PLAN OF ACTION AND MILESTONES PROCESS				PM-4
PM-5	SYSTEM INVENTORY				PM-5 (1)
PM-6	MEASURES OF PERFORMANCE				PM-6
PM-7	ENTERPRISE ARCHITECTURE				PM-7
PM-8	CRITICAL INFRASTRUCTURE PLAN				PM-8
PM-9	RISK MANAGEMENT STRATEGY				PM-9
PM-10	AUTHORIZATION PROCESS				PM-10
PM-11	MISSION AND BUSINESS PROCESS DEFINITION				PM-11
PM-12	INSIDER THREAT PROGRAM
PM-13	SECURITY AND PRIVACY WORKFORCE				PM-13
PM-14	TESTING, TRAINING, AND MONITORING				PM-14
PM-15	SECURITY AND PRIVACY GROUPS AND ASSOCIATIONS
PM-16	THREAT AWARENESS PROGRAM
PM-17	PROTECTING CONTROLLED UNCLASSIFIED INFORMATION ON EXTERNAL SYSTEMS				PM-17
PM-18	PRIVACY PROGRAM PLAN				PM-18
PM-19	PRIVACY PROGRAM LEADERSHIP ROLE				PM-19
PM-20	DISSEMINATION OF PRIVACY PROGRAM INFORMATION				PM-20 (1)
PM-21	ACCOUNTING OF DISCLOSURES				PM-21
PM-22	PERSONALLY IDENTIFIABLE INFORMATION QUALITY MANAGEMENT				PM-22
PM-23	DATA GOVERNANCE BODY
PM-24	DATA INTEGRITY BOARD				PM-24
PM-25	MINIMIZATION OF PERSONALLY IDENTIFIABLE INFORMATION USED IN TESTING, TRAINING, AND RESEARCH				PM-25
PM-26	COMPLAINT MANAGEMENT				PM-26
PM-27	PRIVACY REPORTING				PM-27
PM-28	RISK FRAMING				PM-28
PM-29	RISK MANAGEMENT PROGRAM LEADERSHIP ROLES
PM-30	SUPPLY CHAIN RISK MANAGEMENT STRATEGY
PM-31	CONTINUOUS MONITORING STRATEGY				PM-31
PM-32	PURPOSING
PERSONNEL SECURITY
PS-1	POLICY AND PROCEDURES	PS-1	PS-1	PS-1
PS-2	POSITION RISK DESIGNATION	PS-2	PS-2	PS-2
PS-3	PERSONNEL SCREENING	PS-3	PS-3	PS-3
PS-4	PERSONNEL TERMINATION	PS-4	PS-4	PS-4 (2)
PS-5	PERSONNEL TRANSFER	PS-5	PS-5	PS-5
PS-6	ACCESS AGREEMENTS	PS-6	PS-6	PS-6	PS-6
PS-7	EXTERNAL PERSONNEL SECURITY	PS-7	PS-7	PS-7
PS-8	PERSONNEL SANCTIONS	PS-8	PS-8	PS-8
PS-9	POSITION DESCRIPTIONS	PS-9	PS-9	PS-9
PII PROCESSING AND TRANSPARENCY
PT-1	POLICY AND PROCEDURES				PT-1
PT-2	AUTHORITY TO PROCESS PERSONALLY IDENTIFIABLE INFORMATION				PT-2
PT-3	PERSONALLY IDENTIFIABLE INFORMATION PROCESSING PURPOSES				PT-3
PT-4	CONSENT				PT-4
PT-5	PRIVACY NOTICE				PT-5 (2)
PT-6	SYSTEM OF RECORDS NOTICE				PT-6 (1) (2)
PT-7	SPECIFIC CATEGORIES OF PERSONALLY IDENTIFIABLE INFORMATION				PT-7 (1) (2)
PT-8	COMPUTER MATCHING REQUIREMENTS				PT-8
RISK ASSESSMENT
RA-1	POLICY AND PROCEDURES	RA-1	RA-1	RA-1	RA-1
RA-2	SECURITY CATEGORIZATION	RA-2	RA-2	RA-2
RA-3	RISK ASSESSMENT	RA-3 (1)	RA-3 (1)	RA-3 (1)	RA-3
RA-4	RISK ASSESSMENT UPDATE
RA-5	VULNERABILITY MONITORING AND SCANNING	RA-5 (2) (11)	RA-5 (2) (5) (11)	RA-5 (2) (4) (5) (11)
RA-6	TECHNICAL SURVEILLANCE COUNTERMEASURES SURVEY
RA-7	RISK RESPONSE	RA-7	RA-7	RA-7	RA-7
RA-8	PRIVACY IMPACT ASSESSMENTS				RA-8
RA-9	CRITICALITY ANALYSIS		RA-9	RA-9
RA-10	THREAT HUNTING
SYSTEM AND SERVICES AQUISITION
SA-1	POLICY AND PROCEDURES	SA-1	SA-1	SA-1	SA-1
SA-2	ALLOCATION OF RESOURCES	SA-2	SA-2	SA-2	SA-2
SA-3	SYSTEM DEVELOPMENT LIFE CYCLE	SA-3	SA-3	SA-3	SA-3
SA-4	ACQUISITION PROCESS	SA-4 (10)	SA-4 (1) (2) (9) (10)	SA-4 (1) (2) (5) (9) (10)	SA-4
SA-5	SYSTEM DOCUMENTATION	SA-5	SA-5	SA-5
SA-6	SOFTWARE USAGE RESTRICTIONS
SA-7	USER-INSTALLED SOFTWARE
SA-8	SECURITY AND PRIVACY ENGINEERING PRINCIPLES	SA-8	SA-8	SA-8	SA-8 (33)
SA-9	EXTERNAL SYSTEM SERVICES	SA-9	SA-9 (2)	SA-9 (2)	SA-9
SA-10	DEVELOPER CONFIGURATION MANAGEMENT		SA-10	SA-10
SA-11	DEVELOPER TESTING AND EVALUATION		SA-11	SA-11	SA-11
SA-12	SUPPLY CHAIN PROTECTION
SA-13	TRUSTWORTHINESS
SA-14	CRITICALITY ANALYSIS
SA-15	DEVELOPMENT PROCESS, STANDARDS, AND TOOLS		SA-15 (3)	SA-15 (3)
SA-16	DEVELOPER-PROVIDED TRAINING			SA-16
SA-17	DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN			SA-17
SA-18	TAMPER RESISTANCE AND DETECTION
SA-19	COMPONENT AUTHENTICITY
SA-20	CUSTOMIZED DEVELOPMENT OF CRITICAL COMPONENTS
SA-21	DEVELOPER SCREENING			SA-21
SA-22	UNSUPPORTED SYSTEM COMPONENTS	SA-22	SA-22	SA-22
SA-23	SPECIALIZATION
SYSTEM AND COMMUNICATIONS PROTECTION
SC-1	POLICY AND PROCEDURES	SC-1	SC-1	SC-1
SC-2	SEPARATION OF SYSTEM AND USER FUNCTIONALITY		SC-2	SC-2
SC-3	SECURITY FUNCTION ISOLATION			SC-3
SC-4	INFORMATION IN SHARED SYSTEM RESOURCES		SC-4	SC-4
SC-5	DENIAL-OF-SERVICE PROTECTION	SC-5	SC-5	SC-5
SC-6	RESOURCE AVAILABILITY
SC-7	BOUNDARY PROTECTION	SC-7	SC-7 (3) (4) (5) (7) (8)	SC-7 (3) (4) (5) (7) (8) (18) (21)	SC-7 (24)
SC-8	TRANSMISSION CONFIDENTIALITY AND INTEGRITY		SC-8 (1)	SC-8 (1)
SC-9	TRANSMISSION CONFIDENTIALITY
SC-10	NETWORK DISCONNECT		SC-10	SC-10
SC-11	TRUSTED PATH
SC-12	CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT	SC-12	SC-12	SC-12 (1)
SC-13	CRYPTOGRAPHIC PROTECTION	SC-13	SC-13	SC-13
SC-14	PUBLIC ACCESS PROTECTIONS
SC-15	COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS	SC-15	SC-15	SC-15
SC-16	TRANSMISSION OF SECURITY AND PRIVACY ATTRIBUTES
SC-17	PUBLIC KEY INFRASTRUCTURE CERTIFICATES		SC-17	SC-17
SC-18	MOBILE CODE		SC-18	SC-18
SC-19	VOICE OVER INTERNET PROTOCOL
SC-20	SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE)	SC-20	SC-20	SC-20
SC-21	SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER)	SC-21	SC-21	SC-21
SC-22	ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION SERVICE	SC-22	SC-22	SC-22
SC-23	SESSION AUTHENTICITY		SC-23	SC-23
SC-24	FAIL IN KNOWN STATE			SC-24
SC-25	THIN NODES
SC-26	DECOYS
SC-27	PLATFORM-INDEPENDENT APPLICATIONS
SC-28	PROTECTION OF INFORMATION AT REST		SC-28 (1)	SC-28 (1)
SC-29	HETEROGENEITY
SC-30	CONCEALMENT AND MISDIRECTION
SC-31	COVERT CHANNEL ANALYSIS
SC-32	SYSTEM PARTITIONING
SC-33	TRANSMISSION PREPARATION INTEGRITY
SC-34	NON-MODIFIABLE EXECUTABLE PROGRAMS
SC-35	EXTERNAL MALICIOUS CODE IDENTIFICATION
SC-36	DISTRIBUTED PROCESSING AND STORAGE
SC-37	OUT-OF-BAND CHANNELS
SC-38	OPERATIONS SECURITY
SC-39	PROCESS ISOLATION	SC-39	SC-39	SC-39
SC-40	WIRELESS LINK PROTECTION
SC-41	PORT AND I/O DEVICE ACCESS
SC-42	SENSOR CAPABILITY AND DATA
SC-43	USAGE RESTRICTIONS
SC-44	DETONATION CHAMBERS
SC-45	SYSTEM TIME SYNCHRONIZATION
SC-46	CROSS DOMAIN POLICY ENFORCEMENT
SC-47	ALTERNATE COMMUNICATIONS PATHS
SC-48	SENSOR RELOCATION
SC-49	HARDWARE-ENFORCED SEPARATION AND POLICY ENFORCEMENT
SC-50	SOFTWARE-ENFORCED SEPARATION AND POLICY ENFORCEMENT
SC-51	HARDWARE-BASED PROTECTION
SYSTEM AND INFORMATION INTEGRITY
SI-1	POLICY AND PROCEDURES	SI-1	SI-1	SI-1	SI-1
SI-2	FLAW REMEDIATION	SI-2	SI-2 (2)	SI-2 (2)
SI-3	MALICIOUS CODE PROTECTION	SI-3	SI-3	SI-3
SI-4	SYSTEM MONITORING	SI-4	SI-4 (2) (4) (5)	SI-4 (2) (4) (5) (10) (12) (14) (20) (22)
SI-5	SECURITY ALERTS, ADVISORIES, AND DIRECTIVES	SI-5	SI-5	SI-5 (1)
SI-6	SECURITY AND PRIVACY FUNCTION VERIFICATION			SI-6
SI-7	SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY		SI-7 (1) (7)	SI-7 (1) (2) (5) (7) (15)
SI-8	SPAM PROTECTION		SI-8 (2)	SI-8 (2)
SI-9	INFORMATION INPUT RESTRICTIONS
SI-10	INFORMATION INPUT VALIDATION		SI-10	SI-10
SI-11	ERROR HANDLING		SI-11	SI-11
SI-12	INFORMATION MANAGEMENT AND RETENTION	SI-12	SI-12	SI-12	SI-12 (1) (2) (3)
SI-13	PREDICTABLE FAILURE PREVENTION
SI-14	NON-PERSISTENCE
SI-15	INFORMATION OUTPUT FILTERING
SI-16	MEMORY PROTECTION		SI-16	SI-16
SI-17	FAIL-SAFE PROCEDURES
SI-18	PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS				SI-18 (4)
SI-19	DE-IDENTIFICATION				SI-19
SI-20	TAINTING
SI-21	INFORMATION REFRESH
SI-22	INFORMATION DIVERSITY
SI-23	INFORMATION FRAGMENTATION
SUPPLY CHAIN RISK MANAGEMENT
SR-1	POLICY AND PROCEDURES	SR-1	SR-1	SR-1
SR-2	SUPPLY CHAIN RISK MANAGEMENT PLAN	SR-2 (1)	SR-2 (1)	SR-2 (1)
SR-3	SUPPLY CHAIN CONTROLS AND PROCESSES	SR-3	SR-3	SR-3
SR-4	PROVENANCE
SR-5	ACQUISITION STRATEGIES, TOOLS, AND METHODS	SR-5	SR-5	SR-5
SR-6	SUPPLIER ASSESSMENTS AND REVIEWS		SR-6	SR-6
SR-7	SUPPLY CHAIN OPERATIONS SECURITY
SR-8	NOTIFICATION AGREEMENTS	SR-8	SR-8	SR-8
SR-9	TAMPER RESISTANCE AND DETECTION			SR-9 (1)
SR-10	INSPECTION OF SYSTEMS OR COMPONENTS	SR-10	SR-10	SR-10
SR-11	COMPONENT AUTHENTICITY	SR-11 (1) (2)	SR-11 (1) (2)	SR-11 (1) (2)
SR-12	COMPONENT DISPOSAL	SR-12	SR-12	SR-12

11