rmf-r5_all.csv

IMPLEMENTED BY,RMF CONTROL FAMILY,RMF CONTROL NUMBER,RMF CONTROL NAME - CONTROL ENHANCEMENT NAME,BASELINE IMPACT,CSF FUNCTION,CSF CATEGORY,CSF SUBCATEGORY,PRIVACY,HVA,FSA,FPKI
O,ACCESS CONTROL,AC-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,ACCESS CONTROL,AC-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,ACCESS CONTROL,AC-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,ACCESS CONTROL,AC-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.AC,PR.AC-3,YES,NO,YES,YES
O,ACCESS CONTROL,AC-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.AC,PR.AC-4,YES,NO,YES,YES
O,ACCESS CONTROL,AC-14,PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION,l/M/H,NA,NA,NA,NO,NO,YES,YES
O,ACCESS CONTROL,AC-14,PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION,l/M/H,PROTECT,PR.AC,PR.AC-4,NO,NO,YES,YES
O,ACCESS CONTROL,AC-14,PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION,l/M/H,PROTECT,PR.AC,PR.AC-7,NO,NO,YES,YES
O,ACCESS CONTROL,AC-16,SECURITY AND PRIVACY ATTRIBUTES,NA,PROTECT,PR.AC,PR.AC-4,NO,NO,YES,YES
O,ACCESS CONTROL,AC-16,SECURITY AND PRIVACY ATTRIBUTES,NA,PROTECT,PR.AC,PR.AC-6,NO,NO,YES,YES
O,ACCESS CONTROL,AC-16(10),ATTRIBUTE CONFIGURATION BY AUTHORIZED INDIVIDUALS,NA,NA,NA,NA,NO,NO,YES,NO
O,ACCESS CONTROL,AC-16(6),MAINTENANCE OF ATTRIBUTE ASSOCIATION,NA,NA,NA,NA,NO,NO,YES,NO
O,ACCESS CONTROL,AC-16(7),CONSISTENT ATTRIBUTE INTERPRETATION,NA,NA,NA,NA,NO,NO,YES,NO
O,ACCESS CONTROL,AC-16(9),ATTRIBUTE REASSIGNMENT – REGRADING MECHANISMS,NA,NA,NA,NA,NO,NO,YES,NO
O,ACCESS CONTROL,AC-17,REMOTE ACCESS,l/M/H,PROTECT,PR.AC,PR.AC-3,NO,YES,YES,NO
O,ACCESS CONTROL,AC-17,REMOTE ACCESS,l/M/H,PROTECT,PR.PT,PR.PT-4,NO,YES,YES,NO
O,ACCESS CONTROL,AC-17(4),PRIVILEGED COMMANDS AND ACCESS,M/H,NA,NA,NA,NO,NO,YES,NO
O,ACCESS CONTROL,AC-17(6),PROTECTION OF MECHANISM INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-17(9),DISCONNECT OR DISABLE ACCESS,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-18,WIRELESS ACCESS,l/M/H,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,YES
O,ACCESS CONTROL,AC-18(4),RESTRICT CONFIGURATIONS BY USERS,H,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-18(5),ANTENNAS AND TRANSMISSION POWER LEVELS,H,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-19,ACCESS CONTROL FOR MOBILE DEVICES,L/M/H,PROTECT,PR.AC,PR.AC-3,NO,NO,YES,YES
O,ACCESS CONTROL,AC-19(4),RESTRICTIONS FOR CLASSIFIED INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-19(5),FULL DEVICE OR CONTAINER-BASED ENCRYPTION,H,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-2,ACCOUNT MANAGEMENT,L/M/H,DETECT,DE.CM,DE.CM-3,NO,YES,YES,YES
O,ACCESS CONTROL,AC-2,ACCOUNT MANAGEMENT,L/M/H,PROTECT,PR.AC,PR.AC-4,NO,YES,YES,NO
O,ACCESS CONTROL,AC-2(1),AUTOMATED SYSTEM ACCOUNT MANAGEMENT,M/H,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-2(13),DISABLE ACCOUNTS FOR HIGH-RISK INDIVIDUALS,M/H,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-2(7),PRIVILEGED USER ACCOUNTS,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-2(9),RESTRICTIONS ON USE OF SHARED AND GROUP ACCOUNTS,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-20,USE OF EXTERNAL SYSTEMS,L/M/H,IDENTIFY,ID.AM,ID.AM-4,NO,YES,YES,YES
O,ACCESS CONTROL,AC-20,USE OF EXTERNAL SYSTEMS,L/M/H,PROTECT,PR.AC,PR.AC-3,NO,YES,YES,YES
O,ACCESS CONTROL,AC-20(1),LIMITS ON AUTHORIZED USE,M/H,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-20(2),PORTABLE STORAGE DEVICES — RESTRICTED USE,M/H,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-20(3),NON-ORGANIZATIONALLY OWNED SYSTEMS — RESTRICTED USE,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-20(4),NETWORK ACCESSIBLE STORAGE DEVICES — PROHIBITED USE,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-20(5),PORTABLE STORAGE DEVICES — PROHIBITED USE,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-21,INFORMATION SHARING,M/H,PROTECT,PR.IP,PR.IP-8,NO,NO,YES,YES
O,ACCESS CONTROL,AC-22,PUBLICLY ACCESSIBLE CONTENT,L/M/H,NA,NA,NA,NO,NO,NO,YES
O,ACCESS CONTROL,AC-23,DATA MINING PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-24,ACCESS CONTROL DECISIONS,NA,PROTECT,PR.AC,PR.AC-4,NO,NO,YES,NO
O,ACCESS CONTROL,AC-3(10),AUDITED OVERRIDE OF ACCESS CONTROL MECHANISMS,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-4(20),APPROVED SOLUTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-5,SEPARATION OF DUTIES,M/H,PROTECT,PR.AC,PR.AC-4,NO,YES,YES,YES
O,ACCESS CONTROL,AC-5,SEPARATION OF DUTIES,M/H,PROTECT,PR.DS,PR.DS-5,NO,YES,YES,YES
O,ACCESS CONTROL,AC-6,LEAST PRIVILEGE,M/H,PROTECT,PR.AC,PR.AC-4,NO,YES,YES,YES
O,ACCESS CONTROL,AC-6,LEAST PRIVILEGE,M/H,PROTECT,PR.DS,PR.DS-5,NO,YES,YES,YES
O,ACCESS CONTROL,AC-6(1),AUTHORIZE ACCESS TO SECURITY FUNCTIONS,M/H,NA,NA,NA,NO,NO,NO,YES
O,ACCESS CONTROL,AC-6(2),NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS,M/H,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-6(3),NETWORK ACCESS TO PRIVILEGED COMMANDS,H,NA,NA,NA,NO,NO,NO,NO
O,ACCESS CONTROL,AC-6(5),PRIVILEGED ACCOUNTS,M/H,NA,NA,NA,NO,YES,NO,YES
O,ACCESS CONTROL,AC-6(6),PRIVILEGED ACCESS BY NON-ORGANIZATIONAL USERS,NA,NA,NA,NA,NO,NO,NO,YES
O,ACCESS CONTROL,AC-6(7),REVIEW OF USER PRIVILEGES,M/H,NA,NA,NA,NO,YES,NO,YES
O,ACCESS CONTROL,AC-7(3),BIOMETRIC ATTEMPT LIMITING,NA,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-1,POLICY AND PROCEDURES,L/M/H,RESPOND,RS.AN,RS.AN-5,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,DETECT,DE.DP,DE.DP-1,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,DETECT,DE.DP,DE.DP-3,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,DETECT,DE.DP,DE.DP-4,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,DETECT,DE.DP,DE.DP-5,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,IDENTIFY,ID.RA,ID.RA-1,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,IDENTIFY,ID.RA,ID.RA-5,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,IDENTIFY,ID.SC,ID.SC-4,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,PROTECT,PR.IP,PR.IP-7,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,RESPOND,RS.AN,RS.AN-5,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2,CONTROL ASSESSMENTS,L/M/H,RESPOND,RS.MI,RS.MI-3,YES,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2(1),INDEPENDENT ASSESSORS,M/H,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2(2),SPECIALIZED ASSESSMENTS,H,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-2(3),LEVERAGING RESULTS FROM EXTERNAL ORGANIZATIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-3,INFORMATION EXCHANGE,L,DETECT,DE.AE,DE.AE-1,NO,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-3,INFORMATION EXCHANGE,L,IDENTIFY,ID.AM,ID.AM-3,NO,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-5,PLAN OF ACTION AND MILESTONES,L/M/H,IDENTIFY,ID.RA,ID.RA-1,YES,YES,NO,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-5,PLAN OF ACTION AND MILESTONES,L/M/H,IDENTIFY,ID.RA,ID.RA-6,YES,YES,NO,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-5(1),AUTOMATION SUPPORT FOR ACCURACY AND CURRENCY,NA,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-6,AUTHORIZATION,L/M/H,NA,NA,NA,YES,YES,NO,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-6(1),JOINT AUTHORIZATION — INTRA-ORGANIZATION,NA,NA,NA,NA,NO,YES,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-6(2),JOINT AUTHORIZATION — INTER-ORGANIZATION,NA,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.AE,DE.AE-2,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.AE,DE.AE-3,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.CM,DE.CM-1,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.CM,DE.CM-2,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.CM,DE.CM-3,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.CM,DE.CM-6,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.CM,DE.CM-7,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.DP,DE.DP-1,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.DP,DE.DP-2,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.DP,DE.DP-3,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.DP,DE.DP-4,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,DETECT,DE.DP,DE.DP-5,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,IDENTIFY,ID.RA,ID.RA-1,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,IDENTIFY,ID.RA,ID.RA-5,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,IDENTIFY,ID.SC,ID.SC-4,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,PROTECT,PR.IP,PR.IP-7,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,PROTECT,PR.IP,PR.IP-8,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,RESPOND,RS.AN,RS.AN-1,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7,CONTINUOUS MONITORING,L/M/H,RESPOND,RS.MI,RS.MI-3,YES,YES,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7(1),INDEPENDENT ASSESSMENT,M/H,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7(3),TREND ANALYSES,NA,NA,NA,NA,NO,YES,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7(5),CONSISTENCY ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-8,PENETRATION TESTING,H,IDENTIFY,ID.RA,ID.RA-1,NO,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-8,PENETRATION TESTING,H,PROTECT,PR.IP,PR.IP-7,NO,NO,YES,YES
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-8(1),INDEPENDENT PENETRATION TESTING AGENT OR TEAM,H,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-8(2),RED TEAM EXERCISES,NA,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-8(3),FACILITY PENETRATION TESTING,NA,NA,NA,NA,NO,NO,NO,NO
O,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-9,INTERNAL SYSTEM CONNECTIONS,L/M/H,IDENTIFY,ID.AM,ID.AM-3,NO,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-1,POLICY AND PROCEDURES,L/M/H,NA,NA,NA,YES,NO,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.PT,PR.PT-1,YES,NO,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-11,AUDIT RECORD RETENTION,L/M/H,NA,NA,NA,YES,NO,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-11(1),LONG-TERM RETRIEVAL CAPABILITY,NA,NA,NA,NA,NO,NO,NO,YES
O,AUDIT AND ACCOUNTABILITY,AU-13,MONITORING FOR INFORMATION DISCLOSURE,NA,DETECT,DE.CM,DE.CM-3,NO,NO,YES,NO
O,AUDIT AND ACCOUNTABILITY,AU-13,MONITORING FOR INFORMATION DISCLOSURE,NA,PROTECT,PR.DS,PR.DS-5,NO,NO,YES,NO
O,AUDIT AND ACCOUNTABILITY,AU-13,MONITORING FOR INFORMATION DISCLOSURE,NA,PROTECT,PR.PT,PR.PT-1,NO,NO,YES,NO
O,AUDIT AND ACCOUNTABILITY,AU-13(2),REVIEW OF MONITORED SITES,NA,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-16,CROSS-ORGANIZATIONAL AUDIT LOGGING,NA,PROTECT,PR.PT,PR.PT-1,NO,YES,YES,NO
O,AUDIT AND ACCOUNTABILITY,AU-16(1),IDENTITY PRESERVATION,NA,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-16(2),SHARING OF AUDIT INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-16(3),DISASSOCIABILITY,NA,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-2,EVENT LOGGING,L/M/H,PROTECT,PR.PT,PR.PT-1,YES,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-3(3),LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS,NA,NA,NA,NA,YES,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-5(5),ALTERNATE AUDIT LOGGING CAPABILITY,NA,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-6,"AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING",L/M/H,DETECT,DE.AE,DE.AE-2,NO,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-6,"AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING",L/M/H,DETECT,DE.AE,DE.AE-3,NO,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-6,"AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING",L/M/H,DETECT,DE.DP,DE.DP-4,NO,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-6,"AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING",L/M/H,IDENTIFY,ID.SC,ID.SC-4,NO,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-6,"AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING",L/M/H,NA,NA,NA,NO,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-6,"AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING",L/M/H,PROTECT,PR.PT,PR.PT-1,NO,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-6,"AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING",L/M/H,RESPOND,RS.AN,RS.AN-1,NO,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-6,"AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING",L/M/H,RESPOND,RS.CO,RS.CO-2,NO,YES,YES,YES
O,AUDIT AND ACCOUNTABILITY,AU-6(1),AUTOMATED PROCESS INTEGRATION,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-6(3),CORRELATE AUDIT RECORD REPOSITORIES,L/M/H,NA,NA,NA,NO,YES,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-6(5),INTEGRATED ANALYSIS OF AUDIT RECORDS,L/M/H,NA,NA,NA,NO,YES,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-6(6),CORRELATION WITH PHYSICAL MONITORING,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-6(7),PERMITTED ACTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-6(8),FULL TEXT ANALYSIS OF PRIVILEGED COMMANDS,NA,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-6(9),CORRELATION WITH INFORMATION FROM NONTECHNICAL SOURCES,NA,NA,NA,NA,NO,NO,NO,NO
O,AUDIT AND ACCOUNTABILITY,AU-9(4),ACCESS BY SUBSET OF PRIVILEGED USERS,M/H,NA,NA,NA,NO,NO,NO,YES
O,AUDIT AND ACCOUNTABILITY,AU-9(7),STORE ON COMPONENT WITH DIFFERENT OPERATING SYSTEM,NA,NA,NA,NA,NO,NO,NO,NO
O,AWARENESS AND TRAINING,AT-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,AWARENESS AND TRAINING,AT-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,AWARENESS AND TRAINING,AT-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,AWARENESS AND TRAINING,AT-2,LITERACY TRAINING AND AWARENESS,L/M/H,PROTECT,PR.AT,PR.AT-1,YES,NO,YES,YES
O,AWARENESS AND TRAINING,AT-2(1),PRACTICAL EXERCISES,NA,NA,NA,NA,NO,YES,NO,NO
O,AWARENESS AND TRAINING,AT-2(2),INSIDER THREAT,M/H,NA,NA,NA,NO,NO,NO,NO
O,AWARENESS AND TRAINING,AT-2(3),SOCIAL ENGINEERING AND MINING,M/H,NA,NA,NA,NO,NO,NO,NO
O,AWARENESS AND TRAINING,AT-2(4),SUSPICIOUS COMMUNICATIONS AND ANOMALOUS SYSTEM BEHAVIOR,NA,NA,NA,NA,NO,NO,NO,NO
O,AWARENESS AND TRAINING,AT-2(5),ADVANCED PERSISTENT THREAT,NA,NA,NA,NA,NO,NO,NO,NO
O,AWARENESS AND TRAINING,AT-2(6),CYBER THREAT ENVIRONMENT,NA,NA,NA,NA,NO,NO,NO,NO
O,AWARENESS AND TRAINING,AT-3,ROLE-BASED TRAINING,L/M/H,PROTECT,PR.AT,PR.AT-2,YES,NO,YES,YES
O,AWARENESS AND TRAINING,AT-3,ROLE-BASED TRAINING,L/M/H,PROTECT,PR.AT,PR.AT-3,YES,NO,YES,YES
O,AWARENESS AND TRAINING,AT-3,ROLE-BASED TRAINING,L/M/H,PROTECT,PR.AT,PR.AT-4,YES,NO,YES,YES
O,AWARENESS AND TRAINING,AT-3,ROLE-BASED TRAINING,L/M/H,PROTECT,PR.AT,PR.AT-5,YES,NO,YES,YES
O,AWARENESS AND TRAINING,AT-3(1),ENVIRONMENTAL CONTROLS,NA,NA,NA,NA,NO,NO,NO,NO
O,AWARENESS AND TRAINING,AT-3(2),PHYSICAL SECURITY CONTROLS,NA,NA,NA,NA,NO,NO,NO,NO
O,AWARENESS AND TRAINING,AT-3(3),PRACTICAL EXERCISES,NA,NA,NA,NA,NO,NO,NO,NO
O,AWARENESS AND TRAINING,AT-3(5),PROCESSING PERSONALLY IDENTIFIABLE INFORMATION,NA,NA,NA,NA,YES,NO,NO,NO
O,AWARENESS AND TRAINING,AT-4,TRAINING RECORDS,L/M/H,NA,NA,NA,YES,NO,YES,YES
O,AWARENESS AND TRAINING,AT-6,TRAINING FEEDBACK,NA,NA,NA,NA,NO,NO,NO,YES
O,CONFIGURATION MANAGEMENT,CM-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.IP,PR.IP-1,YES,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-10,SOFTWARE USAGE RESTRICTIONS,L/M/H,DETECT,DE.CM,DE.CM-3,NO,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-10(1),OPEN-SOURCE SOFTWARE,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-11,USER-INSTALLED SOFTWARE,L/M/H,DETECT,DE.CM,DE.CM-3,NO,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-12,INFORMATION LOCATION,M/H,NA,NA,NA,NO,NO,NO,YES
O,CONFIGURATION MANAGEMENT,CM-12(1),AUTOMATED TOOLS TO SUPPORT INFORMATION LOCATION,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-13,DATA ACTION MAPPING,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-2,BASELINE CONFIGURATION,L/M/H,DETECT,DE.AE,DE.AE-1,NO,YES,YES,YES
O,CONFIGURATION MANAGEMENT,CM-2,BASELINE CONFIGURATION,L/M/H,PROTECT,PR.DS,PR.DS-7,NO,YES,YES,YES
O,CONFIGURATION MANAGEMENT,CM-2,BASELINE CONFIGURATION,L/M/H,PROTECT,PR.IP,PR.IP-1,NO,YES,YES,YES
O,CONFIGURATION MANAGEMENT,CM-2(2),AUTOMATION SUPPORT FOR ACCURACY AND CURRENCY,M/H,NA,NA,NA,NO,NO,NO,YES
O,CONFIGURATION MANAGEMENT,CM-2(3),RETENTION OF PREVIOUS CONFIGURATIONS,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-2(6),DEVELOPMENT AND TEST ENVIRONMENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-2(7),CONFIGURE SYSTEMS AND COMPONENTS FOR HIGH-RISK AREAS,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-3,CONFIGURATION CHANGE CONTROL,L/M/H,DETECT,DE.CM,DE.CM-1,NO,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-3,CONFIGURATION CHANGE CONTROL,L/M/H,DETECT,DE.CM,DE.CM-7,NO,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-3,CONFIGURATION CHANGE CONTROL,L/M/H,PROTECT,PR.IP,PR.IP-1,NO,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-3,CONFIGURATION CHANGE CONTROL,L/M/H,PROTECT,PR.IP,PR.IP-3,NO,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-3(1),"AUTOMATED DOCUMENTATION, NOTIFICATION, AND PROHIBITION OF CHANGES",NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-3(2),"TESTING, VALIDATION, AND DOCUMENTATION OF CHANGES",M/H,NA,NA,NA,NO,YES,NO,NO
O,CONFIGURATION MANAGEMENT,CM-3(3),AUTOMATED CHANGE IMPLEMENTATION,NA,NA,NA,NA,NO,NO,NO,YES
O,CONFIGURATION MANAGEMENT,CM-3(4),SECURITY AND PRIVACY REPRESENTATIVES,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-3(6),CRYPTOGRAPHY MANAGEMENT,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-3(7),REVIEW SYSTEM CHANGES,NA,NA,NA,NA,NO,YES,NO,YES
O,CONFIGURATION MANAGEMENT,CM-4,IMPACT ANALYSES,L/M/H,PROTECT,PR.IP,PR.IP-1,YES,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-4,IMPACT ANALYSES,L/M/H,PROTECT,PR.IP,PR.IP-3,YES,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-4(1),SEPARATE TEST ENVIRONMENTS,H,NA,NA,NA,NO,YES,NO,NO
O,CONFIGURATION MANAGEMENT,CM-4(2),VERIFICATION OF CONTROLS,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-5,ACCESS RESTRICTIONS FOR CHANGE,L/M/H,PROTECT,PR.IP,PR.IP-1,NO,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-5(5),PRIVILEGE LIMITATION FOR PRODUCTION AND OPERATION,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-6(1),"AUTOMATED MANAGEMENT, APPLICATION, AND VERIFICATION",H,NA,NA,NA,NO,NO,NO,YES
O,CONFIGURATION MANAGEMENT,CM-6(2),RESPOND TO UNAUTHORIZED CHANGES,H,NA,NA,NA,NO,YES,NO,YES
O,CONFIGURATION MANAGEMENT,CM-7(3),REGISTRATION COMPLIANCE,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-7(6),CONFINED ENVIRONMENTS WITH LIMITED PRIVILEGES,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-8,SYSTEM COMPONENT INVENTORY,L/M/H,DETECT,DE.CM,DE.CM-7,NO,YES,YES,YES
O,CONFIGURATION MANAGEMENT,CM-8,SYSTEM COMPONENT INVENTORY,L/M/H,IDENTIFY,ID.AM,ID.AM-1,NO,YES,YES,YES
O,CONFIGURATION MANAGEMENT,CM-8,SYSTEM COMPONENT INVENTORY,L/M/H,IDENTIFY,ID.AM,ID.AM-2,NO,YES,YES,YES
O,CONFIGURATION MANAGEMENT,CM-8,SYSTEM COMPONENT INVENTORY,L/M/H,PROTECT,PR.DS,PR.DS-3,NO,YES,YES,YES
O,CONFIGURATION MANAGEMENT,CM-8(1),UPDATES DURING INSTALLATION AND REMOVAL,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-8(2),AUTOMATED MAINTENANCE,H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-8(3),AUTOMATED UNAUTHORIZED COMPONENT DETECTION,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-8(4),ACCOUNTABILITY INFORMATION,H,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-8(6),ASSESSED CONFIGURATIONS AND APPROVED DEVIATIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-8(7),CENTRALIZED REPOSITORY,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-8(8),AUTOMATED LOCATION TRACKING,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-8(9),ASSIGNMENT OF COMPONENTS TO SYSTEMS,NA,NA,NA,NA,NO,NO,NO,NO
O,CONFIGURATION MANAGEMENT,CM-9,CONFIGURATION MANAGEMENT PLAN,M/H,PROTECT,PR.IP,PR.IP-1,NO,NO,YES,YES
O,CONFIGURATION MANAGEMENT,CM-9(1),ASSIGNMENT OF RESPONSIBILITY,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.IP,PR.IP-9,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-10,SYSTEM RECOVERY AND RECONSTITUTION,L/M/H,PROTECT,PR.IP,PR.IP-9,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-10,SYSTEM RECOVERY AND RECONSTITUTION,L/M/H,RESPOND,RC.RP,RC.RP-1,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-10,SYSTEM RECOVERY AND RECONSTITUTION,L/M/H,RESPOND,RS.RP,RS.RP-1,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-10(2),TRANSACTION RECOVERY,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-10(4),RESTORE WITHIN TIME PERIOD,H,NA,NA,NA,NO,YES,NO,YES
O,CONTINGENCY PLANNING,CP-10(6),COMPONENT PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-11,ALTERNATE COMMUNICATIONS PROTOCOLS,NA,IDENTIFY,ID.BE,ID.BE-5,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-11,ALTERNATE COMMUNICATIONS PROTOCOLS,NA,PROTECT,PR.PT,PR.PT-5,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,DETECT,DE.AE,DE.AE-3,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,DETECT,DE.AE,DE.AE-4,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,IDENTIFY,ID.AM,ID.AM-5,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,IDENTIFY,ID.AM,ID.AM-6,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,IDENTIFY,ID.BE,ID.BE-4,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,IDENTIFY,ID.BE,ID.BE-5,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,IDENTIFY,ID.RA,ID.RA-4,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,IDENTIFY,ID.SC,ID.SC-5,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,PROTECT,PR.DS,PR.DS-4,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,PROTECT,PR.IP,PR.IP-7,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,PROTECT,PR.IP,PR.IP-8,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,PROTECT,PR.IP,PR.IP-9,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RECOVER,RC.CO,RC.CO-3,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RC.IM,RC.IM-1,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RC.IM,RC.IM-2,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RS.AN,RS.AN-2,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RS.AN,RS.AN-4,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RS.CO,RS.CO-1,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RS.CO,RS.CO-3,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RS.CO,RS.CO-4,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RS.IM,RS.IM-1,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RS.IM,RS.IM-2,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2,CONTINGENCY PLAN,L/M/H,RESPOND,RS.RP,RS.RP-1,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-2(1),COORDINATE WITH RELATED PLANS,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-2(2),CAPACITY PLANNING,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-2(3),RESUME MISSION AND BUSINESS FUNCTIONS,M/H,NA,NA,NA,NO,NO,NO,YES
O,CONTINGENCY PLANNING,CP-2(5),CONTINUE MISSION AND BUSINESS FUNCTIONS,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-2(6),ALTERNATE PROCESSING AND STORAGE SITES,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-2(7),COORDINATE WITH EXTERNAL SERVICE PROVIDERS,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-2(8),IDENTIFY CRITICAL ASSETS,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-3,CONTEINGENCY TRAINING,L/M/H,PROTECT,PR.AT,PR.AT-5,NO,NO,YES,NO
O,CONTINGENCY PLANNING,CP-3,CONTEINGENCY TRAINING,L/M/H,RESPOND,RS.CO,RS.CO-1,NO,NO,YES,NO
O,CONTINGENCY PLANNING,CP-3(1),SIMULATED EVENTS,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-3(2),MECHANISMS USED IN TRAINING ENVIRONMENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-4,CONTINGENCY PLAN TESTING,L/M/H,IDENTIFY,ID.SC,ID.SC-5,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-4,CONTINGENCY PLAN TESTING,L/M/H,PROTECT,PR.IP,PR.IP-10,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-4,CONTINGENCY PLAN TESTING,L/M/H,PROTECT,PR.IP,PR.IP-4,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-4,CONTINGENCY PLAN TESTING,L/M/H,PROTECT,PR.IP,PR.IP-7,NO,YES,YES,YES
O,CONTINGENCY PLANNING,CP-4(1),COORDINATE WITH RELATED PLANS,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-4(2),ALTERNATE PROCESSING SITE,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-4(3),AUTOMATED TESTING,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-4(4),FULL RECOVERY AND RECONSTITUTION,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-6,ALTERNATIVE STORAGE SITE,M/H,PROTECT,PR.IP,PR.IP-4,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-6(1),SEPARATION FROM PRIMARY SITE,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-6(2),RECOVERY TIME AND RECOVERY POINT OBJECTIVES,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-6(3),ACCESSIBILITY,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-7,ALTERNATE PROCESSING SITE,M/H,PROTECT,PR.IP,PR.IP-9,NO,YES,NO,YES
O,CONTINGENCY PLANNING,CP-7,ALTERNATE PROCESSING SITE,M/H,PROTECT,PR.PT,PR.PT-5,NO,YES,NO,YES
O,CONTINGENCY PLANNING,CP-7(1),SEPARATION FROM PRIMARY SITE,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-7(2),ACCESSIBILITY,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-7(3),PRIORITY OF SERVICE,M/H,NA,NA,NA,NO,YES,NO,NO
O,CONTINGENCY PLANNING,CP-7(4),PREPARATION FOR USE,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-7(6),INABILITY TO RETURN TO PRIMARY SITE,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-8,TELECOMMUNICATIONS SERVICES,M/H,IDENTIFY,ID.BE,ID.BE-4,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-8,TELECOMMUNICATIONS SERVICES,M/H,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-8,TELECOMMUNICATIONS SERVICES,M/H,PROTECT,PR.PT,PR.PT-5,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-8(1),PRIORITY OF SERVICE PROVISIONS,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-8(2),SINGLE POINTS OF FAILURE,M/H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-8(3),SEPARATION OF PRIMARY AND ALTERNATE PROVIDERS,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-8(4),PROVIDER CONTINGENCY PLAN,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-8(5),ALTERNATE TELECOMMUNICATION SERVICE TESTING,NA,NA,NA,NA,NO,YES,NO,NO
O,CONTINGENCY PLANNING,CP-9,SYSTEM BACKUP,L/M/H,PROTECT,PR.IP,PR.IP-4,NO,NO,YES,YES
O,CONTINGENCY PLANNING,CP-9(1),TESTING FOR RELIABILITY AND INTEGRITY,M/H,NA,NA,NA,NO,YES,NO,NO
O,CONTINGENCY PLANNING,CP-9(2),TEST RESTORATION USING SAMPLING,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-9(3),SEPARATE STORAGE FOR CRITICAL INFORMATION,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-9(5),TRANSFER TO ALTERNATE STORAGE SITE,H,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-9(6),REDUNDANT SECONDARY SYSTEM,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-9(7),DUAL AUTHORIZATION FOR DELETION OR DESTRUCTION,NA,NA,NA,NA,NO,NO,NO,NO
O,CONTINGENCY PLANNING,CP-9(8),CRYPTOGRAPHIC PROTECTION,M/H,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,NO,NO,YES,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,NO,NO,YES,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,NO,NO,YES,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.AC,PR.AC-1,NO,NO,YES,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.AC,PR.AC-6,NO,NO,YES,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.AC,PR.AC-7,NO,NO,YES,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-10,ADAPTIVE AUTHENTICATION,NA,PROTECT,PR.AC,PR.AC-1,NO,NO,YES,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-10,ADAPTIVE AUTHENTICATION,NA,PROTECT,PR.AC,PR.AC-7,NO,NO,YES,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-12,IDENTITY PROOFING,M/H,PROTECT,PR.AC,PR.AC-1,NO,NO,NO,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-12,IDENTITY PROOFING,M/H,PROTECT,PR.AC,PR.AC-6,NO,NO,NO,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-12(1),SUPERVISOR AUTHORIZATION,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-12(2),IDENTITY EVIDENCE,M/H,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-12(3),IDENTITY EVIDENCE VALIDATION AND VERIFICATION,M/H,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-12(4),IN-PERSON VALIDATION AND VERIFICATION,H,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-12(5),ADDRESS CONFIRMATION,M/H,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-12(6),ACCEPT EXTERNALLY-PROOFED IDENTITIES,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-3(3),DYNAMIC ADDRESS ALLOCATION,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-3(4),DEVICE ATTESTATION,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-4,IDENTIFIER MANAGEMENT,L/M/H,PROTECT,PR.AC,PR.AC-1,NO,NO,YES,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-4,IDENTIFIER MANAGEMENT,L/M/H,PROTECT,PR.AC,PR.AC-6,NO,NO,YES,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-4(1),PROHIBIT ACCOUNT IDENTIFIERS AS PUBLIC IDENTIFIERS,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-4(4),IDENTIFY USER STATUS,M/H,NA,NA,NA,NO,NO,NO,YES
O,IDENTIFICATION AND AUTHENTICATION,IA-4(6),CROSS-ORGANIZATION MANAGEMENT,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-4(8),PAIRWISE PSEUDONYMOUS IDENTIFIERS,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-5(14),MANAGING CONTENT OF PKI TRUST STORES,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-5(15),GSA-APPROVED PRODUCTS AND SERVICES,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-5(16),IN-PERSON OR TRUSTED EXTERNAL PARTY AUTHENTICATOR ISSUANCE,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-5(5),CHANGE AUTHENTICATORS PRIOR TO DELIVERY,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-5(6),PROTECTION OF AUTHENTICATORS,M/H,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-5(7),NO EMBEDDED UNENCRYPTED STATIC AUTHENTICATORS,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-5(8),MULTIPLE SYSTEM ACCOUNTS,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-5(9),FEDERATED CREDENTIAL MANAGEMENT,NA,NA,NA,NA,NO,NO,NO,NO
O,IDENTIFICATION AND AUTHENTICATION,IA-8(6),DISASSOCIABILITY,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.IP,PR.IP-9,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-2,INCIDENT RESPONSE TRAINING,L/M/H,PROTECT,PR.AT,PR.AT-5,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-2(1),SIMULATED EVENTS,M,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-2(2),AUTOMATED TRAINING ENVIRONMENTS,M,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-2(3),BREACH,H,NA,NA,NA,YES,NO,NO,NO
O,INCIDENT RESPONSE,IR-3,INCIDENT RESPONSE TESTING,M/H,IDENTIFY,ID.SC,ID.SC-5,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-3,INCIDENT RESPONSE TESTING,M/H,PROTECT,PR.IP,PR.IP-10,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-3,INCIDENT RESPONSE TESTING,M/H,PROTECT,PR.IP,PR.IP-7,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-3,INCIDENT RESPONSE TESTING,M/H,RESPOND,RS.CO,RS.CO-1,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-3(1),AUTOMATED TESTING,M/H,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-3(2),COORDINATION WITH RELATED PLANS,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-3(3),CONTINUOUS IMPROVEMENT,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,DETECT,DE.AE,DE.AE-2,YES,YES,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,DETECT,DE.AE,DE.AE-3,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,DETECT,DE.AE,DE.AE-4,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,DETECT,DE.AE,DE.AE-5,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,IDENTIFY,ID.SC,ID.SC-5,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RECOVER,RC.CO,RC.CO-1,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RECOVER,RC.CO,RC.CO-2,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RECOVER,RC.CO,RC.CO-3,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RC.IM,RC.IM-1,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RC.IM,RC.IM-2,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RC.RP,RC.RP-1,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.AN,RS.AN-1,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.AN,RS.AN-2,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.AN,RS.AN-3,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.AN,RS.AN-4,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.CO,RS.CO-3,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.CO,RS.CO-4,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.IM,RS.IM-1,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.IM,RS.IM-2,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.MI,RS.MI-1,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.MI,RS.MI-2,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4,INCIDENT HANDLING,L/M/H,RESPOND,RS.RP,RS.RP-1,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-4(1),AUTOMATED INCIDENT HANDLING PROCESSES,M/H,NA,NA,NA,NO,NO,NO,YES
O,INCIDENT RESPONSE,IR-4(10),SUPPLY CHAIN COORDINATION,NA,NA,NA,NA,NO,YES,NO,NO
O,INCIDENT RESPONSE,IR-4(11),INTEGRATED INCIDENT RESPONSE TEAM,H,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-4(12),MALICIOUS CODE AND FORENSIC ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-4(13),BEHAVIOR ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-4(15),PUBLIC RELATIONS AND REPUTATION REPAIR,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-4(2),DYNAMIC RECONFIGURATION,NA,NA,NA,NA,NO,YES,NO,YES
O,INCIDENT RESPONSE,IR-4(3),CONTINUITY OF OPERATIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-4(4),INFORMATION CORRELATION,H,NA,NA,NA,NO,YES,NO,NO
O,INCIDENT RESPONSE,IR-4(6),INSIDER THREATS,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-4(7),INSIDER THREATS — INTRA-ORGANIZATION COORDINATION,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-4(8),CORRELATION WITH EXTERNAL ORGANIZATIONS,NA,NA,NA,NA,NO,YES,NO,NO
O,INCIDENT RESPONSE,IR-4(9),DYNAMIC RESPONSE CAPABILITY,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-5,INCIDENT MONITORING,L/M/H,DETECT,DE.AE,DE.AE-3,YES,YES,YES,YES
O,INCIDENT RESPONSE,IR-5,INCIDENT MONITORING,L/M/H,DETECT,DE.AE,DE.AE-5,YES,YES,YES,YES
O,INCIDENT RESPONSE,IR-5,INCIDENT MONITORING,L/M/H,RESPOND,RS.AN,RS.AN-1,YES,YES,YES,YES
O,INCIDENT RESPONSE,IR-5,INCIDENT MONITORING,L/M/H,RESPOND,RS.AN,RS.AN-4,YES,YES,YES,YES
O,INCIDENT RESPONSE,IR-5(1),"AUTOMATED TRACKING, DATA COLLECTION, AND ANALYSIS",H,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-6,INCIDENT REPORTING,L/M/H,RESPOND,RS.CO,RS.CO-2,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-6(1),AUTOMATED REPORTING,M/H,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-6(2),VULNERABILITIES RELATED TO INCIDENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-6(3),SUPPLY CHAIN COORDINATION,M/H,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-7,INCIDENT RESPONSE ASSISTANCE,L/M/H,PROTECT,PR.IP,PR.IP-9,YES,NO,YES,YES
O,INCIDENT RESPONSE,IR-7(1),AUTOMATION SUPPORT FOR AVAILABILITY OF INFORMATION AND SUPPORT,M/H,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-7(2),COORDINATION WITH EXTERNAL PROVIDERS,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,DETECT,DE.AE,DE.AE-3,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,DETECT,DE.AE,DE.AE-5,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,IDENTIFY,ID.SC,ID.SC-5,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,PROTECT,PR.IP,PR.IP-7,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,PROTECT,PR.IP,PR.IP-8,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,PROTECT,PR.IP,PR.IP-9,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RC.IM,RC.IM-1,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RC.IM,RC.IM-2,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RC.RP,RC.RP-1,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RS.AN,RS.AN-4,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RS.CO,RS.CO-1,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RS.CO,RS.CO-2,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RS.CO,RS.CO-3,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RS.CO,RS.CO-4,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RS.IM,RS.IM-1,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RS.IM,RS.IM-2,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8,INCIDENT RESPONSE PLAN,L/M/H,RESPOND,RS.RP,RS.RP-1,NO,NO,YES,YES
O,INCIDENT RESPONSE,IR-8(1),BREACHES,H,NA,NA,NA,YES,NO,NO,NO
O,INCIDENT RESPONSE,IR-9,INFORMATION SPILLAGE RESPONSE,NA,IDENTIFY,ID.SC,ID.SC-5,NO,NO,YES,NO
O,INCIDENT RESPONSE,IR-9,INFORMATION SPILLAGE RESPONSE,NA,PROTECT,PR.IP,PR.IP-9,NO,NO,YES,NO
O,INCIDENT RESPONSE,IR-9(2),TRAINING,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-9(3),POST-SPILL OPERATIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,INCIDENT RESPONSE,IR-9(4),EXPOSURE TO UNAUTHORIZED PERSONNEL,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,NO,NO,YES,YES
O,MAINTENANCE FAMILY,MA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,NO,NO,YES,YES
O,MAINTENANCE FAMILY,MA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,NO,NO,YES,YES
O,MAINTENANCE FAMILY,MA-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.MA,PR.MA-1,NO,NO,YES,YES
O,MAINTENANCE FAMILY,MA-2,CONTROLLED MAINTENANCE,L/M/H,PROTECT,PR.MA,PR.MA-1,NO,NO,YES,YES
O,MAINTENANCE FAMILY,MA-2(2),AUTOMATED MAINTENANCE ACTIVITIES,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-3,MAINTENANCE TOOLS,L/M/H,PROTECT,PR.MA,PR.MA-1,NO,NO,YES,YES
O,MAINTENANCE FAMILY,MA-3(1),INSPECT TOOLS,M/H,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-3(2),INSPECT MEDIA,M/H,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-3(3),PREVENT UNAUTHORIZED REMOVAL,M/H,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-4,NONLOCAL MAINTENANCE,L/M/H,PROTECT,PR.MA,PR.MA-2,NO,NO,YES,YES
O,MAINTENANCE FAMILY,MA-4(1),LOGGING AND REVIEW,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-4(3),COMPARABLE SECURITY AND SANITIZATION,H,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-4(4),AUTHENTICATION AND SEPARATION OF MAINTENANCE SESSIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-4(5),APPROVALS AND NOTIFICATIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-5,MAINTENANCE PERSONNEL,L/M/H,PROTECT,PR.MA,PR.MA-1,NO,NO,YES,YES
O,MAINTENANCE FAMILY,MA-5(1),INDIVIDUALS WITHOUT APPROPRIATE ACCESS,H,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-5(2),SECURITY CLEARANCES FOR CLASSIFIED SYSTEMS,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-5(3),CITIZENSHIP REQUIREMENTS FOR CLASSIFIED SYSTEMS,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-5(4),FOREIGN NATIONALS,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-5(5),NON-SYSTEM MAINTENANCE,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-6,TIMELY MAINTENANCE,M/H,PROTECT,PR.MA,PR.MA-1,NO,NO,YES,YES
O,MAINTENANCE FAMILY,MA-6(1),PREVENTIVE MAINTENANCE,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-6(2),PREDICTIVE MAINTENANCE,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-6(3),AUTOMATED SUPPORT FOR PREDICTIVE MAINTENANCE,NA,NA,NA,NA,NO,NO,NO,NO
O,MAINTENANCE FAMILY,MA-7,FIELD MAINTENANCE,NA,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,MEDIA PROTECTION,MP-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,MEDIA PROTECTION,MP-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,MEDIA PROTECTION,MP-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.PT,PR.PT-2,YES,NO,YES,YES
O,MEDIA PROTECTION,MP-2,MEDIA ACCESS,L/M/H,PROTECT,PR.DS,PR.DS-1,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-2,MEDIA ACCESS,L/M/H,PROTECT,PR.PT,PR.PT-2,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-3,MEDIA MARKING,M/H,PROTECT,PR.DS,PR.DS-1,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-3,MEDIA MARKING,M/H,PROTECT,PR.PT,PR.PT-2,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-4,MEDIA STORAGE,M/H,PROTECT,PR.DS,PR.DS-1,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-4,MEDIA STORAGE,M/H,PROTECT,PR.PT,PR.PT-2,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-4(2),AUTOMATED RESTRICTED ACCESS,NA,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-5,MEDIA TRANSPORT,M/H,PROTECT,PR.DS,PR.DS-1,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-5,MEDIA TRANSPORT,M/H,PROTECT,PR.PT,PR.PT-2,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-5(3),CUSTODIANS,NA,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-6,MEDIA SANITIZATION,L/M/H,PROTECT,PR.DS,PR.DS-1,YES,YES,YES,YES
O,MEDIA PROTECTION,MP-6,MEDIA SANITIZATION,L/M/H,PROTECT,PR.DS,PR.DS-3,YES,YES,YES,YES
O,MEDIA PROTECTION,MP-6,MEDIA SANITIZATION,L/M/H,PROTECT,PR.IP,PR.IP-6,YES,YES,YES,YES
O,MEDIA PROTECTION,MP-6(1),"REVIEW, APPROVE, TRACK, DOCUMENT, AND VERIFY",H,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-6(2),EQUIPMENT TESTING,H,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-6(3),NONDESTRUCTIVE TECHNIQUES,H,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-6(7),DUAL AUTHORIZATION,NA,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-6(8),REMOTE PURGING OR WIPING OF INFORMATION,NA,NA,NA,NA,NO,YES,NO,NO
O,MEDIA PROTECTION,MP-7,MEDIA USE,L/M/H,PROTECT,PR.DS,PR.DS-1,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-7,MEDIA USE,L/M/H,PROTECT,PR.PT,PR.PT-2,NO,NO,YES,YES
O,MEDIA PROTECTION,MP-7(2),PROHIBIT USE OF SANITIZATION-RESISTANT MEDIA,NA,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-8,MEDIA DOWNGRADING,NA,PROTECT,PR.DS,PR.DS-1,NO,NO,YES,NO
O,MEDIA PROTECTION,MP-8,MEDIA DOWNGRADING,NA,PROTECT,PR.PT,PR.PT-2,NO,NO,YES,NO
O,MEDIA PROTECTION,MP-8(1),DOCUMENTATION OF PROCESS,NA,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-8(2),EQUIPMENT TESTING,NA,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-8(3),CONTROLLED UNCLASSIFIED INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,MEDIA PROTECTION,MP-8(4),CLASSIFIED INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-1,POLICY AND PROCEDURES,NA,DETECT,DE.DP,DE.DP-2,YES,NO,YES,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-1,POLICY AND PROCEDURES,NA,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-1,POLICY AND PROCEDURES,NA,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-2,AUTHORITY TO PROCESS PERSONALLY IDENTIFIABLE INFORMATION,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-2(2),AUTOMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-3,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING PURPOSES,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-3(2),AUTOMATION,NA,NA,NA,NA,NO,YES,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-4,CONSENT,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-4(1),TAILORED CONSENT,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-4(2),JUST-IN-TIME CONSENT,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-4(3),REVOCATION,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-5,PRIVACY NOTICE,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-5(1),JUST-IN-TIME NOTICE,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-5(2),PRIVACY ACT STATEMENTS,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-6,SYSTEM OF RECORDS NOTICE,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-6(1),ROUTINE USES,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-6(2),EXEMPTION RULES,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-7,SPECIFIC CATEGORIES OF PERSONALLY IDENTIFIABLE INFORMATION,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-7(1),SOCIAL SECURITY NUMBERS,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-7(2),FIRST AMENDMENT INFORMATION,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-8,COMPUTER MATCHING REQUIREMENTS,NA,NA,NA,NA,YES,NO,NO,NO
O,PERSONNEL SECURITY,PS-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.IP,PR.IP-11,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-2,POSITION RISK DESIGNATION,L/M/H,PROTECT,PR.IP,PR.IP-11,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-3,PERSONNEL SCREENING,L/M/H,PROTECT,PR.AC,PR.AC-6,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-3,PERSONNEL SCREENING,L/M/H,PROTECT,PR.IP,PR.IP-11,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-3(1),CLASSIFIED INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONNEL SECURITY,PS-3(2),FORMAL INDOCTRINATION,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONNEL SECURITY,PS-3(3),INFORMATION REQUIRING SPECIAL PROTECTION MEASURES,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONNEL SECURITY,PS-3(4),CITIZENSHIP REQUIREMENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONNEL SECURITY,PS-4,PERSONNEL TERMINATION,L/M/H,PROTECT,PR.IP,PR.IP-11,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-4(1),POST-EMPLOYMENT REQUIREMENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONNEL SECURITY,PS-4(2),AUTOMATED ACTIONS,H,NA,NA,NA,NO,NO,NO,NO
O,PERSONNEL SECURITY,PS-5,PERSONNEL TRANSFER,L/M/H,PROTECT,PR.IP,PR.IP-11,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-6,ACCESS AGREEMENTS,L/M/H,PROTECT,PR.DS,PR.DS-5,YES,NO,YES,YES
O,PERSONNEL SECURITY,PS-6,ACCESS AGREEMENTS,L/M/H,PROTECT,PR.IP,PR.IP-11,YES,NO,YES,YES
O,PERSONNEL SECURITY,PS-6(2),CLASSIFIED INFORMATION REQUIRING SPECIAL PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONNEL SECURITY,PS-6(3),POST-EMPLOYMENT REQUIREMENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,PERSONNEL SECURITY,PS-7,EXTERNAL PERSONNEL SECURITY,L/M/H,DETECT,DE.CM,DE.CM-6,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-7,EXTERNAL PERSONNEL SECURITY,L/M/H,IDENTIFY,ID.AM,ID.AM-6,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-7,EXTERNAL PERSONNEL SECURITY,L/M/H,IDENTIFY,ID.GV,ID.GV-2,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-7,EXTERNAL PERSONNEL SECURITY,L/M/H,IDENTIFY,ID.SC,ID.SC-4,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-7,EXTERNAL PERSONNEL SECURITY,L/M/H,PROTECT,PR.AT,PR.AT-3,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-7,EXTERNAL PERSONNEL SECURITY,L/M/H,PROTECT,PR.IP,PR.IP-11,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-8,PERSONNEL SANCTIONS,L/M/H,PROTECT,PR.IP,PR.IP-11,NO,NO,YES,YES
O,PERSONNEL SECURITY,PS-9,POSITION DESCRIPTIONS,L/M/H,IDENTIFY,ID.GV,ID.GV-2,NO,NO,NO,YES
O,PERSONNEL SECURITY,PS-9,POSITION DESCRIPTIONS,L/M/H,PROTECT,PR.IP,PR.IP-11,NO,NO,NO,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.AC,PR.AC-2,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.IP,PR.IP-5,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-10,EMERGENCY SHUTOFF,M/H,NA,NA,NA,NO,NO,YES,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-11,EMERGENCY POWER,M/H,IDENTIFY,ID.BE,ID.BE-4,NO,NO,NO,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-11,EMERGENCY POWER,M/H,NA,NA,NA,NO,NO,NO,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-11,EMERGENCY POWER,M/H,PROTECT,PR.DS,PR.DS-4,NO,NO,NO,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-11,EMERGENCY POWER,M/H,PROTECT,PR.PT,PR.PT-5,NO,NO,NO,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-11(1),ALTERNATE POWER SUPPLY — MINIMAL OPERATIONAL CAPABILITY,H,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-11(2),ALTERNATE POWER SUPPLY — SELF-CONTAINED,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-12,EMERGENCY LIGHTING,L/M/H,NA,NA,NA,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-12(1),ESSENTIAL MISSION AND BUSINESS FUNCTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-13,FIRE PROTECTION,L/M/H,NA,NA,NA,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-13(1),DETECTION SYSTEMS — AUTOMATIC ACTIVATION AND NOTIFICATION,M/H,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-13(2),SUPPRESSION SYSTEMS — AUTOMATIC ACTIVATION AND NOTIFICATION,H,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-13(4),INSPECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-14,ENVIRONMENTAL CONTROLS,L/M/H,NA,NA,NA,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-14(1),AUTOMATIC CONTROLS,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-14(2),MONITORING WITH ALARMS AND NOTIFICATIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-15,WATER DAMAGE PROTECTION,L/M/H,NA,NA,NA,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-15(1),AUTOMATION SUPPORT,H,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-16,DELIVERY AND REMOVAL,L/M/H,PROTECT,PR.DS,PR.DS-3,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-17,ALTERNATE WORK SITE,M/H,NA,NA,NA,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-18,LOCATION OF SYSTEM COMPONENTS,H,NA,NA,NA,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-19,INFORMATION LEAKAGE,NA,PROTECT,PR.DS,PR.DS-5,NO,NO,YES,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-19(1),NATIONAL EMISSIONS POLICIES AND PROCEDURES,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-2,PHYSICAL ACCESS AUTHORIZATIONS,L/M/H,PROTECT,PR.AC,PR.AC-2,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-2,PHYSICAL ACCESS AUTHORIZATIONS,L/M/H,PROTECT,PR.AC,PR.AC-6,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-2(1),ACCESS BY POSITION AND ROLE,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-2(2),TWO FORMS OF IDENTIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-2(3),RESTRICT UNESCORTED ACCESS,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-20,ASSET MONITORING AND TRACKING,NA,DETECT,DE.CM,DE.CM-2,NO,NO,YES,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-20,ASSET MONITORING AND TRACKING,NA,DETECT,DE.CM,DE.CM-7,NO,NO,YES,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-20,ASSET MONITORING AND TRACKING,NA,PROTECT,PR.DS,PR.DS-3,NO,NO,YES,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-21,ELECTROMAGNETIC PULSE PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-22,COMPONENT MARKING,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-23,FACILITY LOCATION,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-3,PHYSICAL ACCESS CONTROL,L/M/H,PROTECT,PR.AC,PR.AC-2,NO,YES,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-3(1),SYSTEM ACCESS,H,NA,NA,NA,NO,YES,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-3(2),FACILITY AND SYSTEMS,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-3(3),CONTINUOUS GUARDS,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-3(4),LOCKABLE CASINGS,NA,NA,NA,NA,NO,NO,NO,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-3(5),TAMPER PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-3(7),PHYSICAL BARRIERS,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-3(8),ACCESS CONTROL VESTIBULES,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-4,ACCESS CONTROL FOR TRANSMISSION,M/H,PROTECT,PR.AC,PR.AC-2,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-5,ACCESS CONTROL FOR OUTPUT DEVICES,M/H,PROTECT,PR.AC,PR.AC-2,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-6,MONITORING PHYSICAL ACCESS,L/M/H,DETECT,DE.CM,DE.CM-2,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-6,MONITORING PHYSICAL ACCESS,L/M/H,DETECT,DE.CM,DE.CM-7,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-6,MONITORING PHYSICAL ACCESS,L/M/H,PROTECT,PR.AC,PR.AC-2,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-6,MONITORING PHYSICAL ACCESS,L/M/H,RESPOND,RS.AN,RS.AN-1,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-6,MONITORING PHYSICAL ACCESS,L/M/H,RESPOND,RS.CO,RS.CO-4,NO,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-6(1),INTRUSION ALARMS AND SURVEILLANCE EQUIPMENT,M/H,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-6(2),AUTOMATED INTRUSION RECOGNITION AND RESPONSES,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-6(3),VIDEO SURVEILLANCE,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-6(4),MONITORING PHYSICAL ACCESS TO SYSTEMS,H,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-8,VISITOR ACCESS RECORDS,L/M/H,PROTECT,PR.AC,PR.AC-2,YES,NO,YES,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-8(1),AUTOMATED RECORDS MAINTENANCE AND REVIEW,H,NA,NA,NA,NO,NO,NO,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-8(3),LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS,NA,NA,NA,NA,YES,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-9,POWER EQUIPMENT AND CABLING,M/H,IDENTIFY,ID.BE,ID.BE-4,NO,NO,NO,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-9,POWER EQUIPMENT AND CABLING,M/H,PROTECT,PR.AC,PR.AC-2,NO,NO,NO,YES
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-9(1),REDUNDANT CABLING,NA,NA,NA,NA,NO,NO,NO,NO
O,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-9(2),AUTOMATIC VOLTAGE CONTROLS,NA,NA,NA,NA,NO,NO,NO,NO
O,PLANNING,PL-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,PLANNING,PL-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,PLANNING,PL-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,PLANNING,PL-10,BASELINE SELECTION,L/M/H,NA,NA,NA,NO,YES,YES,YES
O,PLANNING,PL-11,BASELINE TAILORING,L/M/H,NA,NA,NA,NO,NO,YES,YES
O,PLANNING,PL-2,SYSTEM SECURITY AND PRIVACY PLANS,L/M/H,DETECT,DE.DP,DE.DP-5,YES,YES,YES,YES
O,PLANNING,PL-2,SYSTEM SECURITY AND PRIVACY PLANS,L/M/H,PROTECT,PR.IP,PR.IP-7,YES,YES,YES,YES
O,PLANNING,PL-4,RULES OF BEHAVIOR,L/M/H,NA,NA,NA,YES,NO,NO,NO
O,PLANNING,PL-4(1),SOCIAL MEDIA AND EXTERNAL SITE/APPLICATION USAGE RESTRICTIONS,L/M/H,NA,NA,NA,YES,NO,NO,NO
O,PLANNING,PL-7,CONCEPT OF OPERATIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,PLANNING,PL-8,SECURITY AND PRIVACY ARCHITECTURES,M/H,IDENTIFY,ID.AM,ID.AM-3,YES,YES,YES,YES
O,PLANNING,PL-8,SECURITY AND PRIVACY ARCHITECTURES,M/H,PROTECT,PR.PT,PR.PT-5,YES,YES,YES,YES
O,PLANNING,PL-8(1),DEFENSE IN DEPTH,NA,NA,NA,NA,NO,YES,NO,NO
O,PLANNING,PL-8(2),SUPPLIER DIVERSITY,NA,NA,NA,NA,NO,NO,NO,NO
O,PLANNING,PL-9,CENTRAL MANAGEMENT,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-1,INFORMATION SECURITY PROGRAM PLAN,NA,DETECT,DE.DP,DE.DP-2,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-1,INFORMATION SECURITY PROGRAM PLAN,NA,IDENTIFY,ID.GV,ID.GV-1,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-1,INFORMATION SECURITY PROGRAM PLAN,NA,IDENTIFY,ID.GV,ID.GV-2,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-1,INFORMATION SECURITY PROGRAM PLAN,NA,IDENTIFY,ID.GV,ID.GV-3,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-10,AUTHORIZATION PROCESS,NA,IDENTIFY,ID.GV,ID.GV-4,YES,YES,YES,NO
O,PROGRAM MANAGEMENT,PM-11,MISSION AND BUSINESS PROCESS DEFINITION,NA,IDENTIFY,ID.BE,ID.BE-3,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-11,MISSION AND BUSINESS PROCESS DEFINITION,NA,IDENTIFY,ID.GV,ID.GV-4,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-11,MISSION AND BUSINESS PROCESS DEFINITION,NA,IDENTIFY,ID.RA,ID.RA-4,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-11,MISSION AND BUSINESS PROCESS DEFINITION,NA,IDENTIFY,ID.RM,ID.RM-3,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-12,INSIDER THREAT PROGRAM,NA,IDENTIFY,ID.RA,ID.RA-3,NO,YES,YES,NO
O,PROGRAM MANAGEMENT,PM-13,SECURITY AND PRIVACY WORKFORCE,NA,PROTECT,PR.AT,PR.AT-1,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-13,SECURITY AND PRIVACY WORKFORCE,NA,PROTECT,PR.AT,PR.AT-2,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-13,SECURITY AND PRIVACY WORKFORCE,NA,PROTECT,PR.AT,PR.AT-4,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-13,SECURITY AND PRIVACY WORKFORCE,NA,PROTECT,PR.AT,PR.AT-5,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-14,"TESTING, TRAINING, AND MONITORING",NA,DETECT,DE.DP,DE.DP-1,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-14,"TESTING, TRAINING, AND MONITORING",NA,DETECT,DE.DP,DE.DP-2,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-14,"TESTING, TRAINING, AND MONITORING",NA,DETECT,DE.DP,DE.DP-3,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-14,"TESTING, TRAINING, AND MONITORING",NA,DETECT,DE.DP,DE.DP-5,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-14,"TESTING, TRAINING, AND MONITORING",NA,PROTECT,PR.AT,PR.AT-1,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-14,"TESTING, TRAINING, AND MONITORING",NA,PROTECT,PR.IP,PR.IP-10,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-15,SECURITY AND PRIVACY GROUPS AND ASSOCIATIONS,NA,IDENTIFY,ID.RA,ID.RA-1,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-15,SECURITY AND PRIVACY GROUPS AND ASSOCIATIONS,NA,IDENTIFY,ID.RA,ID.RA-2,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-15,SECURITY AND PRIVACY GROUPS AND ASSOCIATIONS,NA,NA,NA,NA,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-15,SECURITY AND PRIVACY GROUPS AND ASSOCIATIONS,NA,RESPOND,RS.AN,RS.AN-5,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-15,SECURITY AND PRIVACY GROUPS AND ASSOCIATIONS,NA,RESPOND,RS.CO,RS.CO-5,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-16,THREAT AWARENESS PROGRAM,NA,IDENTIFY,ID.RA,ID.RA-2,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-16,THREAT AWARENESS PROGRAM,NA,IDENTIFY,ID.RA,ID.RA-3,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-16,THREAT AWARENESS PROGRAM,NA,IDENTIFY,ID.RA,ID.RA-5,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-16(1),AUTOMATED MEANS FOR SHARING THREAT INTELLIGENCE,NA,NA,NA,NA,NO,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-17,PROTECTING CONTROLLED UNCLASSIFIED INFORMATION ON EXTERNAL SYSTEMS,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-18,PRIVACY PROGRAM PLAN,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-19,PRIVACY PROGRAM LEADERSHIP ROLE,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-2,INFORMATION SECURITY PROGRAM LEADERSHIP ROLE,NA,IDENTIFY,ID.AM,ID.AM-6,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-2,INFORMATION SECURITY PROGRAM LEADERSHIP ROLE,NA,IDENTIFY,ID.GV,ID.GV-2,NO,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-20,DISSEMINATION OF PRIVACY PROGRAM INFORMATION,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-20(1),"PRIVACY POLICIES ON WEBSITES, APPLICATIONS, AND DIGITAL SERVICES",NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-21,ACCOUNTING OF DISCLOSURES,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-22,PERSONALLY IDENTIFIABLE INFORMATION QUALITY MANAGEMENT,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-23,DATA GOVERNANCE BODY,NA,NA,NA,NA,NO,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-24,DATA INTEGRITY BOARD,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-25,"MINIMIZE OF PERSONALLY IDENTIFIABLE INFORMATION USED IN TESTING, TRAINING, AND RESEARCH",NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-26,COMPLAINT MANAGEMENT,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-27,PRIVACY REPORTING,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-28,RISK FRAMING,NA,IDENTIFY,ID.GV,ID.GV-4,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-28,RISK FRAMING,NA,IDENTIFY,ID.RA,ID.RA-5,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-28,RISK FRAMING,NA,IDENTIFY,ID.RA,ID.RA-6,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-28,RISK FRAMING,NA,IDENTIFY,ID.RM,ID.RM-1,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-29,RISK MANAGEMENT PROGRAM LEADERSHIP ROLES,NA,IDENTIFY,ID.AM,ID.AM-6,NO,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-29,RISK MANAGEMENT PROGRAM LEADERSHIP ROLES,NA,IDENTIFY,ID.GV,ID.GV-2,NO,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-3,INFORMATION SECURITY AND PRIVACY RESOURCES,NA,IDENTIFY,ID.GV,ID.GV-4,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-30,SUPPLY CHAIN RISK MANAGEMENT STRATEGY,NA,IDENTIFY,ID.SC,ID.SC-1,NO,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-30(1),SUPPLIERS OF CRITICAL OR MISSION-ESSENTIAL ITEMS,NA,NA,NA,NA,NO,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-31,CONTINUOUS MONITORING STRATEGY,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-32,PURPOSING,NA,NA,NA,NA,NO,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-4,PLAN OF ACTION AND MILESTONES PROCESS,NA,IDENTIFY,ID.RA,ID.RA-1,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-4,PLAN OF ACTION AND MILESTONES PROCESS,NA,IDENTIFY,ID.RA,ID.RA-6,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-4,PLAN OF ACTION AND MILESTONES PROCESS,NA,RESPOND,RS.AN,RS.AN-5,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-5,SYSTEM INVENTORY,NA,IDENTIFY,ID.AM,ID.AM-1,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-5,SYSTEM INVENTORY,NA,IDENTIFY,ID.AM,ID.AM-4,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-5(1),INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION,NA,NA,NA,NA,YES,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-6,MEASURES OF PERFORMANCE,NA,PROTECT,PR.IP,PR.IP-7,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-7,ENTERPRISE ARCHITECTURE,NA,IDENTIFY,ID.GV,ID.GV-4,YES,YES,YES,NO
O,PROGRAM MANAGEMENT,PM-7(1),OFFLOADING,NA,NA,NA,NA,NO,NO,NO,NO
O,PROGRAM MANAGEMENT,PM-8,CRITICAL INFRASTRUCTURE PLAN,NA,IDENTIFY,ID.BE,ID.BE-2,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-8,CRITICAL INFRASTRUCTURE PLAN,NA,IDENTIFY,ID.BE,ID.BE-4,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-8,CRITICAL INFRASTRUCTURE PLAN,NA,IDENTIFY,ID.RM,ID.RM-3,YES,NO,YES,NO
O,PROGRAM MANAGEMENT,PM-9,RISK MANAGEMENT STRATEGY,NA,IDENTIFY,ID.GV,ID.GV-4,YES,YES,YES,NO
O,PROGRAM MANAGEMENT,PM-9,RISK MANAGEMENT STRATEGY,NA,IDENTIFY,ID.RA,ID.RA-4,YES,YES,YES,NO
O,PROGRAM MANAGEMENT,PM-9,RISK MANAGEMENT STRATEGY,NA,IDENTIFY,ID.RA,ID.RA-6,YES,YES,YES,NO
O,PROGRAM MANAGEMENT,PM-9,RISK MANAGEMENT STRATEGY,NA,IDENTIFY,ID.RM,ID.RM-1,YES,YES,YES,NO
O,PROGRAM MANAGEMENT,PM-9,RISK MANAGEMENT STRATEGY,NA,IDENTIFY,ID.RM,ID.RM-2,YES,YES,YES,NO
O,PROGRAM MANAGEMENT,PM-9,RISK MANAGEMENT STRATEGY,NA,IDENTIFY,ID.RM,ID.RM-3,YES,YES,YES,NO
O,PROGRAM MANAGEMENT,PM-9,RISK MANAGEMENT STRATEGY,NA,IDENTIFY,ID.SC,ID.SC-2,YES,YES,YES,NO
O,RISK ASSESSMENT,RA-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,RISK ASSESSMENT,RA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,RISK ASSESSMENT,RA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,RISK ASSESSMENT,RA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-4,YES,NO,YES,YES
O,RISK ASSESSMENT,RA-1,POLICY AND PROCEDURES,L/M/H,PROTECT,PR.IP,PR.IP-12,YES,NO,YES,YES
O,RISK ASSESSMENT,RA-1,POLICY AND PROCEDURES,L/M/H,RESPOND,RS.AN,RS.AN-5,YES,NO,YES,YES
O,RISK ASSESSMENT,RA-2,SECURITY CATEGORIZATION,L/M/H,IDENTIFY,ID.AM,ID.AM-5,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-2,SECURITY CATEGORIZATION,L/M/H,IDENTIFY,ID.GV,ID.GV-4,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-2,SECURITY CATEGORIZATION,L/M/H,IDENTIFY,ID.RA,ID.RA-4,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-2,SECURITY CATEGORIZATION,L/M/H,IDENTIFY,ID.RA,ID.RA-5,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-2(1),IMPACT-LEVEL PRIORITIZATION,NA,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,DETECT,DE.AE,DE.AE-4,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,IDENTIFY,ID.GV,ID.GV-4,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,IDENTIFY,ID.RA,ID.RA-1,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,IDENTIFY,ID.RA,ID.RA-3,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,IDENTIFY,ID.RA,ID.RA-4,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,IDENTIFY,ID.RA,ID.RA-5,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,IDENTIFY,ID.SC,ID.SC-2,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,PROTECT,PR.IP,PR.IP-12,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,RESPOND,RS.AN,RS.AN-2,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,RESPOND,RS.AN,RS.AN-4,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3,RISK ASSESSMENT,L/M/H,RESPOND,RS.MI,RS.MI-3,YES,YES,YES,YES
O,RISK ASSESSMENT,RA-3(1),SUPPLY CHAIN RISK ASSESSMENT,L/M/H,NA,NA,NA,NO,YES,NO,NO
O,RISK ASSESSMENT,RA-3(2),USE OF ALL-SOURCE INTELLIGENCE,NA,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-3(3),DYNAMIC THREAT AWARENESS,NA,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-3(4),PREDICTIVE CYBER ANALYTICS,NA,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-5,VULNERABILITY MONITORING AND SCANNING,L/M/H,DETECT,DE.AE,DE.AE-2,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-5,VULNERABILITY MONITORING AND SCANNING,L/M/H,DETECT,DE.CM,DE.CM-8,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-5,VULNERABILITY MONITORING AND SCANNING,L/M/H,DETECT,DE.DP,DE.DP-4,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-5,VULNERABILITY MONITORING AND SCANNING,L/M/H,DETECT,DE.DP,DE.DP-5,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-5,VULNERABILITY MONITORING AND SCANNING,L/M/H,IDENTIFY,ID.RA,ID.RA-1,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-5,VULNERABILITY MONITORING AND SCANNING,L/M/H,PROTECT,PR.IP,PR.IP-12,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-5,VULNERABILITY MONITORING AND SCANNING,L/M/H,RESPOND,RS.AN,RS.AN-1,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-5,VULNERABILITY MONITORING AND SCANNING,L/M/H,RESPOND,RS.MI,RS.MI-3,NO,YES,YES,YES
O,RISK ASSESSMENT,RA-5(10),CORRELATE SCANNING INFORMATION,NA,NA,NA,NA,NO,YES,NO,NO
O,RISK ASSESSMENT,RA-5(11),PUBLIC DISCLOSURE PROGRAM,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-5(2),UPDATE VULNERABILITIES TO BE SCANNED,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-5(3),BREADTH AND DEPTH OF COVERAGE,NA,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-5(4),DISCOVERABLE INFORMATION,H,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-5(5),PRIVILEGED ACCESS,M/H,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-5(6),AUTOMATED TREND ANALYSES,NA,NA,NA,NA,NO,YES,NO,NO
O,RISK ASSESSMENT,RA-5(8),REVIEW HISTORIC AUDIT LOGS,NA,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-6,TECHNICAL SURVEILLANCE COUNTERMEASURES SURVEY,NA,NA,NA,NA,NO,NO,NO,NO
O,RISK ASSESSMENT,RA-7,RISK RESPONSE,L/M/H,IDENTIFY,ID.RA,ID.RA-6,YES,NO,NO,YES
O,RISK ASSESSMENT,RA-7,RISK RESPONSE,L/M/H,RESPOND,RS.AN,RS.AN-5,YES,NO,NO,YES
O,RISK ASSESSMENT,RA-7,RISK RESPONSE,L/M/H,RESPOND,RS.MI,RS.MI-3,YES,NO,NO,YES
O,RISK ASSESSMENT,RA-8,PRIVACY IMPACT ASSESSMENTS,NA,NA,NA,NA,YES,NO,NO,NO
O,RISK ASSESSMENT,RA-9,CRITICALITY ANALYSIS,M/H,IDENTIFY,ID.AM,ID.AM-5,NO,NO,NO,YES
O,RISK ASSESSMENT,RA-9,CRITICALITY ANALYSIS,M/H,IDENTIFY,ID.BE,ID.BE-4,NO,NO,NO,YES
O,RISK ASSESSMENT,RA-9,CRITICALITY ANALYSIS,M/H,IDENTIFY,ID.BE,ID.BE-5,NO,NO,NO,YES
O,RISK ASSESSMENT,RA-9,CRITICALITY ANALYSIS,M/H,IDENTIFY,ID.RA,ID.RA-4,NO,NO,NO,YES
O,RISK ASSESSMENT,RA-9,CRITICALITY ANALYSIS,M/H,IDENTIFY,ID.RM,ID.RM-3,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.BE,ID.BE-1,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.SC,ID.SC-1,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-10,INSPECTION OF SYSTEMS OR COMPONENTS,L/M/H,DETECT,DE.DP,DE.DP-2,NO,YES,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-11,COMPONENT AUTHENTICITY,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-11(1),ANTI-COUNTERFEIT TRAINING,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-11(2),CONFIGURATION CONTROL FOR COMPONENT SERVICE AND REPAIR,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-11(3),ANTI-COUNTERFEIT SCANNING,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-12,COMPONENT DISPOSAL,L/M/H,PROTECT,PR.IP,PR.IP-6,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-2,SUPPLY CHAIN RISK MANAGEMENT PLAN,L/M/H,IDENTIFY,ID.BE,ID.BE-4,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-2,SUPPLY CHAIN RISK MANAGEMENT PLAN,L/M/H,IDENTIFY,ID.SC,ID.SC-1,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-2,SUPPLY CHAIN RISK MANAGEMENT PLAN,L/M/H,IDENTIFY,ID.SC,ID.SC-2,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-2,SUPPLY CHAIN RISK MANAGEMENT PLAN,L/M/H,IDENTIFY,ID.SC,ID.SC-3,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-2(1),ESTABLISH SCRM TEAM,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-3(1),DIVERSE SUPPLY BASE,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-3(2),LIMITATION OF HARM,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-3(3),SUB-TIER FLOW DOWN,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-4,PROVENANCE,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-4(1),IDENTITY,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-4(2),TRACK AND TRACE,NA,NA,NA,NA,NO,YES,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-4(3),VALIDATE AS GENUINE AND NOT ALTERED,NA,NA,NA,NA,NO,YES,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-4(4),SUPPLY CHAIN INTEGRITY — PEDIGREE,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-5,"ACQUISITION STRATEGIES, TOOLS, AND METHODS",L/M/H,IDENTIFY,ID.SC,ID.SC-1,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-5,"ACQUISITION STRATEGIES, TOOLS, AND METHODS",L/M/H,IDENTIFY,ID.SC,ID.SC-2,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-5,"ACQUISITION STRATEGIES, TOOLS, AND METHODS",L/M/H,IDENTIFY,ID.SC,ID.SC-3,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-5(1),ADEQUATE SUPPLY,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-5(2),"ASSESSMENTS PRIOR TO SELECTION, ACCEPTANCE, MODIFICATION, OR UPDATE",NA,NA,NA,NA,NO,YES,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-6,SUPPLIER ASSESSMENTS AND REVIEWS,M/H,IDENTIFY,ID.SC,ID.SC-2,NO,YES,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-6,SUPPLIER ASSESSMENTS AND REVIEWS,M/H,RESPOND,RS.AN,RS.AN-5,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-6(1),TESTING AND ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-7,SUPPLY CHAIN OPERATIONS SECURITY,NA,NA,NA,NA,NO,NO,NO,NO
O,SUPPLY CHAIN RISK MANAGEMENT,SR-8,NOTIFICATION AGREEMENTS,L/M/H,NA,NA,NA,NO,NO,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-9,TAMPER RESISTANCE AND DETECTION,H,DETECT,DE.DP,DE.DP-2,NO,YES,NO,YES
O,SUPPLY CHAIN RISK MANAGEMENT,SR-9(1),MULTIPLE STAGES OF SYSTEM DEVELOPMENT LIFE CYCLE,H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,NO,NO,YES,YES
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,NO,NO,YES,YES
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,NO,NO,YES,YES
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-15(3),DISABLING AND REMOVAL IN SECURE WORK AREAS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-18,MOBILE CODE,M/H,DETECT,DE.CM,DE.CM-5,NO,NO,YES,YES
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-18(2),"ACQUISITION, DEVELOPMENT, AND USE",NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-28(2),OFFLINE STORAGE,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-29,HETEROGENEITY,NA,NA,NA,NA,NO,NO,YES,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-29(1),VIRTUALIZATION TECHNIQUES,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-30,CONCEALMENT AND MISDIRECTION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-30(2),RANDOMNESS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-30(3),CHANGE PROCESSING AND STORAGE LOCATIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-30(4),MISLEADING INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-30(5),CONCEALMENT OF SYSTEM COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-31,COVERT CHANNEL ANALYSIS,NA,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-31(1),TEST COVERT CHANNELS FOR EXPLOITABILITY,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-31(2),MAXIMUM BANDWIDTH,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-31(3),MEASURE BANDWIDTH IN OPERATIONAL ENVIRONMENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-34(1),NO WRITABLE STORAGE,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-34(2),INTEGRITY PROTECTION AND READ-ONLY MEDIA,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-36,DISTRIBUTED PROCESSING AND STORAGE,NA,NA,NA,NA,NO,NO,YES,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-36(1),POLLING TECHNIQUES,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-36(2),SYNCHRONIZATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-37,OUT-OF-BAND CHANNELS,NA,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-37(1),ENSURE DELIVERY AND TRANSMISSION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-38,OPERATIONS SECURITY,NA,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-42(1),REPORTING TO AUTHORIZED INDIVIDUALS OR ROLES,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-42(2),AUTHORIZED USE,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-42(4),NOTICE OF COLLECTION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-42(5),COLLECTION MINIMIZATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(25),UNCLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(26),CLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(27),UNCLASSIFIED NON-NATIONAL SECURITY SYSTEM CONNECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(28),CONNECTIONS TO PUBLIC NETWORKS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(4),EXTERNAL TELECOMMUNICATIONS SERVICES,M/H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-10(2),REVIEW AND RESOLVE ERRORS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-12,INFORMATION MANAGEMENT AND RETENTION,L/M/H,NA,NA,NA,YES,NO,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-12(1),LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS,NA,NA,NA,NA,YES,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-12(2),"MINIMIZE PERSONALLY IDENTIFIABLE INFORMATION IN TESTING, TRAINING, AND RESEARCH",NA,NA,NA,NA,YES,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-12(3),INFORMATION DISPOSAL,NA,NA,NA,NA,YES,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-13,PREDICTABLE FAILURE PREVENTION,NA,NA,NA,NA,NO,NO,YES,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-13(1),TRANSFERRING COMPONENT RESPONSIBILITIES,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-13(3),MANUAL TRANSFER BETWEEN COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-13(5),FAILOVER CAPABILITY,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-14,NON-PERSISTENCE,NA,NA,NA,NA,NO,NO,YES,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-14(1),REFRESH FROM TRUSTED SOURCES,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-14(2),NON-PERSISTENT INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-14(3),NON-PERSISTENT CONNECTIVITY,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-19(7),VALIDATED ALGORITHMS AND SOFTWARE,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-2,FLAW REMEDIATION,L/M/H,IDENTIFY,ID.RA,ID.RA-1,NO,YES,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-2,FLAW REMEDIATION,L/M/H,PROTECT,PR.IP,PR.IP-12,NO,YES,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-2(2),AUTOMATED FLAW REMEDIATION STATUS,M/H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-2(3),TIME TO REMEDIATE FLAWS AND BENCHMARKS FOR CORRECTIVE ACTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-3(10),MALICIOUS CODE ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-3(6),TESTING AND VERIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-4(10),VISIBILITY OF ENCRYPTED COMMUNICATIONS,H,NA,NA,NA,NO,YES,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-4(17),INTEGRATED SITUATIONAL AWARENESS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-4(19),RISK FOR INDIVIDUALS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-4(21),PROBATIONARY PERIODS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-4(23),HOST-BASED DEVICES,NA,NA,NA,NA,NO,YES,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-4(9),TESTING OF MONITORING TOOLS AND MECHANISMS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-5,"SEURITY ALERTS, ADVISORIES, AND DIRECTIVES",L/M/H,IDENTIFY,ID.RA,ID.RA-1,NO,YES,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-5,"SEURITY ALERTS, ADVISORIES, AND DIRECTIVES",L/M/H,IDENTIFY,ID.RA,ID.RA-2,NO,YES,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-5,"SEURITY ALERTS, ADVISORIES, AND DIRECTIVES",L/M/H,IDENTIFY,ID.RA,ID.RA-3,NO,YES,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-5,"SEURITY ALERTS, ADVISORIES, AND DIRECTIVES",L/M/H,RESPOND,RS.AN,RS.AN-5,NO,YES,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-5,"SEURITY ALERTS, ADVISORIES, AND DIRECTIVES",L/M/H,RESPOND,RS.CO,RS.CO-5,NO,YES,YES,YES
O,SYSTEM AND INFORMATION INTEGRITY,SI-5(1),AUTOMATED ALERTS AND ADVISORIES,H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-6(3),REPORT VERIFICATION RESULTS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-7(16),TIME LIMIT ON PROCESS EXECUTION WITHOUT SUPERVISION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-7(3),CENTRALLY MANAGED INTEGRITY TOOLS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-7(7),INTEGRATION OF DETECTION AND RESPONSE,M/H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND INFORMATION INTEGRITY,SI-8,SPAM PROTECTION,M/H,DETECT,DE.CM,DE.CM-4,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-1,POLICY AND PROCEDURES,L/M/H,DETECT,DE.DP,DE.DP-2,YES,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-1,YES,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-1,POLICY AND PROCEDURES,L/M/H,IDENTIFY,ID.GV,ID.GV-3,YES,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-10,DEVELOPER CONFIGURATION MANAGEMENT,M/H,PROTECT,PR.DS,PR.DS-8,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-10,DEVELOPER CONFIGURATION MANAGEMENT,M/H,PROTECT,PR.IP,PR.IP-1,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-10,DEVELOPER CONFIGURATION MANAGEMENT,M/H,PROTECT,PR.IP,PR.IP-2,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-10,DEVELOPER CONFIGURATION MANAGEMENT,M/H,PROTECT,PR.IP,PR.IP-3,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-10(1),SOFTWARE AND FIRMWARE INTEGRITY VERIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-10(2),ALTERNATIVE CONFIGURATION MANAGEMENT PROCESSES,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-10(3),HARDWARE INTEGRITY VERIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-10(4),TRUSTED GENERATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-10(5),MAPPING INTEGRITY FOR VERSION CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-10(6),TRUSTED DISTRIBUTION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-10(7),SECURITY AND PRIVACY REPRESENTATIVES,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-11,DEVELOPER TESTING AND EVALUATION,M/H,IDENTIFY,ID.RA,ID.RA-1,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-11,DEVELOPER TESTING AND EVALUATION,M/H,IDENTIFY,ID.SC,ID.SC-4,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-11,DEVELOPER TESTING AND EVALUATION,M/H,PROTECT,PR.IP,PR.IP-2,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-11(1),STATIC CODE ANALYSIS,NA,NA,NA,NA,NO,YES,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-11(2),THREAT MODELING AND VULNERABILITY ANALYSES,NA,NA,NA,NA,NO,YES,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-11(3),INDEPENDENT VERIFICATION OF ASSESSMENT PLANS AND EVIDENCE,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-11(4),MANUAL CODE REVIEWS,NA,NA,NA,NA,NO,YES,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-11(5),PENETRATION TESTING,NA,NA,NA,NA,NO,YES,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-11(6),ATTACK SURFACE REVIEWS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-11(7),VERIFY SCOPE OF TESTING AND EVALUATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-11(8),DYNAMIC CODE ANALYSIS,NA,NA,NA,NA,NO,YES,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-11(9),INTERACTIVE APPLICATION SECURITY TESTING,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15,"DEVELOPMENT PROCESS, STANDARDS, AND TOOLS",M/H,IDENTIFY,ID.SC,ID.SC-2,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-15,"DEVELOPMENT PROCESS, STANDARDS, AND TOOLS",M/H,NA,NA,NA,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-15(1),QUALITY METRICS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15(10),INCIDENT RESPONSE PLAN,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15(11),ARCHIVE SYSTEM OR COMPONENT,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15(12),MINIMIZE PERSONALLY IDENTIFIABLE INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15(2),SECURITY AND PRIVACY TRACKING TOOLS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15(3),CRITICALITY ANALYSIS,M/H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15(5),ATTACK SURFACE REDUCTION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15(6),CONTINUOUS IMPROVEMENT,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15(7),AUTOMATED VULNERABILITY ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-15(8),REUSE OF THREAT AND VULNERABILITY INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-16,DEVELOPER-PROVIDED TRAINING,H,NA,NA,NA,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-17,DEVELOPER SECURITY AND PRIVACY ARCHITECTURE DESIGN,H,IDENTIFY,ID.AM,ID.AM-3,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-17,DEVELOPER SECURITY AND PRIVACY ARCHITECTURE DESIGN,H,NA,NA,NA,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-17(1),FORMAL POLICY MODEL,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-17(2),SECURITY-RELEVANT COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-17(3),FORMAL CORRESPONDENCE,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-17(4),INFORMAL CORRESPONDENCE,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-17(5),CONCEPTUALLY SIMPLE DESIGN,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-17(6),STRUCTURE FOR TESTING,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-17(7),STRUCTURE FOR LEAST PRIVILEGE,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-17(8),ORCHESTRATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-17(9),DESIGN DIVERSITY,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-2,ALLOCATION OF RESOURCES,L/M/H,IDENTIFY,ID.GV,ID.GV-4,YES,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-20,CUSTOMIZED DEVELOPMENT OF CRITICAL COMPONENTS,NA,IDENTIFY,ID.AM,ID.AM-5,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-20,CUSTOMIZED DEVELOPMENT OF CRITICAL COMPONENTS,NA,IDENTIFY,ID.BE,ID.BE-4,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-20,CUSTOMIZED DEVELOPMENT OF CRITICAL COMPONENTS,NA,IDENTIFY,ID.BE,ID.BE-5,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-20,CUSTOMIZED DEVELOPMENT OF CRITICAL COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-21,DEVELOPER SCREENING,H,PROTECT,PR.IP,PR.IP-11,NO,NO,NO,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-22,UNSUPPORTED SYSTEM COMPONENTS,L/M/H,NA,NA,NA,NO,NO,NO,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-23,SPECIALIZATION,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-3,SYSTEM DEVELOPMENT LIFE CYCLE,L/M/H,PROTECT,PR.IP,PR.IP-2,YES,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-3(1),MANAGE PREPRODUCTION ENVIRONMENT,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-3(2),USE OF LIVE OR OPERATIONAL DATA,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-3(3),TECHNOLOGY REFRESH,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4,ACQUISITION PROCESS,L/M/H,DETECT,DE.CM,DE.CM-6,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-4,ACQUISITION PROCESS,L/M/H,IDENTIFY,ID.SC,ID.SC-3,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-4,ACQUISITION PROCESS,L/M/H,PROTECT,PR.IP,PR.IP-2,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-4(1),FUNCTIONAL PROPERTIES OF CONTROLS,M/H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(10),USE OF APPROVED PIV PRODUCTS,L/M/H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(11),SYSTEM OF RECORDS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(12),DATA OWNERSHIP,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(2),DESIGN AND IMPLEMENTATION INFORMATION FOR CONTROLS,M/H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(3),"DEVELOPMENT METHODS, TECHNIQUES, AND PRACTICES",NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(5),"SYSTEM, COMPONENT, AND SERVICE CONFIGURATIONS",H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(6),USE OF INFORMATION ASSURANCE PRODUCTS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(7),NIAP-APPROVED PROTECTION PROFILES,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(8),CONTINUOUS MONITORING PLAN FOR CONTROLS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-4(9),"FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES IN USE",M/H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-5,SYSTEM DOCUMENTATION,L/M/H,IDENTIFY,ID.RA,ID.RA-1,NO,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-8,SECURITY AND PRIVACY ENGINEERING PRINCIPLES,L/M/H,IDENTIFY,ID.BE,ID.BE-5,YES,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-8,SECURITY AND PRIVACY ENGINEERING PRINCIPLES,L/M/H,NA,NA,NA,YES,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-8,SECURITY AND PRIVACY ENGINEERING PRINCIPLES,L/M/H,PROTECT,PR.IP,PR.IP-2,YES,NO,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-9,EXTERNAL SYSTEM SERVICES,L/M/H,DETECT,DE.CM,DE.CM-6,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-9,EXTERNAL SYSTEM SERVICES,L/M/H,IDENTIFY,ID.AM,ID.AM-4,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-9,EXTERNAL SYSTEM SERVICES,L/M/H,IDENTIFY,ID.SC,ID.SC-1,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-9,EXTERNAL SYSTEM SERVICES,L/M/H,IDENTIFY,ID.SC,ID.SC-3,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-9,EXTERNAL SYSTEM SERVICES,L/M/H,IDENTIFY,ID.SC,ID.SC-4,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-9,EXTERNAL SYSTEM SERVICES,L/M/H,PROTECT,PR.AT,PR.AT-3,YES,YES,YES,YES
O,SYSTEM AND SERVICES ACQUISITION,SA-9(1),RISK ASSESSMENTS AND ORGANIZATIONAL APPROVALS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-9(2),"IDENTIFICATION OF FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES",M/H,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-9(3),ESTABLISH AND MAINTAIN TRUST RELATIONSHIP WITH PROVIDERS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-9(4),CONSISTENT INTERESTS OF CONSUMERS AND PROVIDERS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-9(5),"PROCESSING, STORAGE, AND SERVICE LOCATION",NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-9(6),ORGANIZATION-CONTROLLED CRYPTOGRAPHIC KEYS,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-9(7),ORGANIZATION-CONTROLLED INTEGRITY CHECKING,NA,NA,NA,NA,NO,NO,NO,NO
O,SYSTEM AND SERVICES ACQUISITION,SA-9(8),PROCESSING AND STORAGE LOCATION — U.S. JURISDICTION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-12(1),USER-INITIATED LOGOUTS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-17(1),MONITORING AND CONTROL,M/H,NA,NA,NA,NO,NO,YES,NO
O/S,ACCESS CONTROL,AC-18(3),DISABLE WIRELESS NETWORKING,L/M/H,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-2(12),ACCOUNT MONITORING FOR ATYPICAL USAGE,H,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-2(5),INACTIVITY LOGOUT,M/H,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-3(7),ROLE-BASED ACCESS CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-3(8),REVOCATION OF ACCESS AUTHORIZATIONS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-3(9),CONTROLLED RELEASE,NA,NA,NA,NA,NO,YES,NO,NO
O/S,ACCESS CONTROL,AC-4(21),PHYSICAL OR LOGICAL SEPARATION OF INFORMATION FLOWS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-4(23),MODIFY NON-RELEASABLE INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-4(26),AUDIT FILTERING ACTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-4(29),FILTER ORCHESTRATION ENGINES,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-4(9),HUMAN REVIEWS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-6(4),SEPARATE PROCESSING DOMAINS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-7(4),USE OF ALTERNATE AUTHENTICATION FACTOR,NA,NA,NA,NA,NO,NO,NO,NO
O/S,ACCESS CONTROL,AC-8,SYSTEM USE NOTIFICATION,L/M/H,NA,NA,NA,NO,NO,YES,YES
O/S,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-3(6),TRANSFER AUTHORIZATIONS,H,NA,NA,NA,NO,NO,NO,NO
O/S,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-3(7),TRANSITIVE INFORMATION EXCHANGES,NA,NA,NA,NA,NO,NO,NO,NO
O/S,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7(4),RISK MONITORING,L/M/H,NA,NA,NA,YES,NO,NO,NO
O/S,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7(6),AUTOMATION SUPPORT FOR MONITORING,NA,NA,NA,NA,NO,NO,NO,NO
O/S,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-9(1),COMPLIANCE CHECKS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,AUDIT AND ACCOUNTABILITY,AU-10(3),CHAIN OF CUSTODY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,AUDIT AND ACCOUNTABILITY,AU-13(1),USE OF AUTOMATED TOOLS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,AUDIT AND ACCOUNTABILITY,AU-13(3),UNAUTHORIZED REPLICATION OF INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,AUDIT AND ACCOUNTABILITY,AU-4,AUDIT LOG STORAGE CAPACITY,L/M/H,PROTECT,PR.DS,PR.DS-4,NO,NO,YES,YES
O/S,AUDIT AND ACCOUNTABILITY,AU-4(1),TRANSFER TO ALTERNATE STORAGE,NA,NA,NA,NA,NO,NO,NO,NO
O/S,AUDIT AND ACCOUNTABILITY,AU-9(5),DUAL AUTHORIZATION,NA,NA,NA,NA,NO,YES,NO,NO
O/S,AUDIT AND ACCOUNTABILITY,AU-9(6),READ-ONLY ACCESS,NA,NA,NA,NA,NO,YES,NO,NO
O/S,CONFIGURATION MANAGEMENT,CM-14,SIGNED COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,CONFIGURATION MANAGEMENT,CM-5(4),DUAL AUTHORIZATION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,CONFIGURATION MANAGEMENT,CM-5(6),LIMIT LIBRARY PRIVILEGES,NA,NA,NA,NA,NO,NO,NO,NO
O/S,CONFIGURATION MANAGEMENT,CM-6,CONFIGURATION SETTINGS,L/M/H,PROTECT,PR.IP,PR.IP-1,NO,YES,YES,YES
O/S,CONFIGURATION MANAGEMENT,CM-7,LEAST FUNCTIONALITY,L/M/H,PROTECT,PR.IP,PR.IP-1,NO,NO,YES,YES
O/S,CONFIGURATION MANAGEMENT,CM-7,LEAST FUNCTIONALITY,L/M/H,PROTECT,PR.PT,PR.PT-3,NO,NO,YES,YES
O/S,CONFIGURATION MANAGEMENT,CM-7(1),PERIODIC REVIEW,L/M/H,NA,NA,NA,NO,YES,NO,NO
O/S,CONFIGURATION MANAGEMENT,CM-7(4),UNAUTHORIZED SOFTWARE — DENY-BY-EXCEPTION,NA,NA,NA,NA,NO,NO,NO,YES
O/S,CONFIGURATION MANAGEMENT,CM-7(5),AUTHORIZED SOFTWARE — ALLOW-BY-EXCEPTION,L/M/H,NA,NA,NA,NO,NO,NO,NO
O/S,CONFIGURATION MANAGEMENT,CM-7(7),CODE EXECUTION IN PROTECTED ENVIRONMENTS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,CONFIGURATION MANAGEMENT,CM-7(8),BINARY OR MACHINE EXECUTABLE CODE,NA,NA,NA,NA,NO,NO,NO,NO
O/S,CONFIGURATION MANAGEMENT,CM-7(9),PROHIBITING THE USE OF UNAUTHORIZED HARDWARE,NA,NA,NA,NA,NO,NO,NO,NO
O/S,CONTINGENCY PLANNING,CP-13,ALTERNATIVE SECURITY MECHANISMS,NA,PROTECT,PR.PT,PR.PT-5,NO,NO,NO,NO
O/S,CONTINGENCY PLANNING,CP-4(5),SELF-CHALLENGE,NA,NA,NA,NA,NO,NO,NO,NO
O/S,IDENTIFICATION AND AUTHENTICATION,IA-11,RE-AUTHENTICATION,L/M/H,PROTECT,PR.AC,PR.AC-1,NO,NO,YES,YES
O/S,IDENTIFICATION AND AUTHENTICATION,IA-11,RE-AUTHENTICATION,L/M/H,PROTECT,PR.AC,PR.AC-7,NO,NO,YES,YES
O/S,IDENTIFICATION AND AUTHENTICATION,IA-2,IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS),L/M/H,PROTECT,PR.AC,PR.AC-1,NO,YES,YES,YES
O/S,IDENTIFICATION AND AUTHENTICATION,IA-2,IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS),L/M/H,PROTECT,PR.AC,PR.AC-6,NO,YES,YES,YES
O/S,IDENTIFICATION AND AUTHENTICATION,IA-2,IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS),L/M/H,PROTECT,PR.AC,PR.AC-7,NO,YES,YES,YES
O/S,IDENTIFICATION AND AUTHENTICATION,IA-2(5),INDIVIDUAL AUTHENTICATION WITH GROUP AUTHENTICATION,H,NA,NA,NA,NO,NO,NO,NO
O/S,IDENTIFICATION AND AUTHENTICATION,IA-4(9),ATTRIBUTE MAINTENANCE AND PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,IDENTIFICATION AND AUTHENTICATION,IA-5,AUTHENTICATOR MANAGEMENT,L/M/H,PROTECT,PR.AC,PR.AC-1,NO,YES,YES,YES
O/S,IDENTIFICATION AND AUTHENTICATION,IA-5,AUTHENTICATOR MANAGEMENT,L/M/H,PROTECT,PR.AC,PR.AC-6,NO,YES,YES,YES
O/S,IDENTIFICATION AND AUTHENTICATION,IA-5,AUTHENTICATOR MANAGEMENT,L/M/H,PROTECT,PR.AC,PR.AC-7,NO,YES,YES,YES
O/S,IDENTIFICATION AND AUTHENTICATION,IA-5(1),PASSWORD-BASED AUTHENTICATION,L/M/H,NA,NA,NA,NO,YES,NO,NO
O/S,IDENTIFICATION AND AUTHENTICATION,IA-9,SERVICE IDENTIFICATION AND AUTHENTICATION,NA,PROTECT,PR.AC,PR.AC-1,NO,NO,YES,NO
O/S,IDENTIFICATION AND AUTHENTICATION,IA-9,SERVICE IDENTIFICATION AND AUTHENTICATION,NA,PROTECT,PR.AC,PR.AC-7,NO,NO,YES,NO
O/S,INCIDENT RESPONSE,IR-4(14),SECURITY OPERATIONS CENTER,NA,NA,NA,NA,NO,NO,NO,NO
O/S,INCIDENT RESPONSE,IR-4(5),AUTOMATIC DISABLING OF SYSTEM,NA,NA,NA,NA,NO,NO,NO,NO
O/S,MAINTENANCE FAMILY,MA-3(4),RESTRICTED TOOL USE,NA,NA,NA,NA,NO,NO,NO,NO
O/S,MAINTENANCE FAMILY,MA-3(5),EXECUTION WITH PRIVILEGE,NA,NA,NA,NA,NO,NO,NO,NO
O/S,MAINTENANCE FAMILY,MA-3(6),SOFTWARE UPDATES AND PATCHES,NA,NA,NA,NA,NO,NO,NO,NO
O/S,MAINTENANCE FAMILY,MA-4(6),CRYPTOGRAPHIC PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,RISK ASSESSMENT,RA-10,THREAT HUNTING,NA,IDENTIFY,ID.RA,ID.RA-2,NO,NO,NO,NO
O/S,RISK ASSESSMENT,RA-10,THREAT HUNTING,NA,IDENTIFY,ID.RA,ID.RA-3,NO,NO,NO,NO
O/S,SUPPLY CHAIN RISK MANAGEMENT,SR-3,SUPPLY CHAIN CONTROLS AND PROCESSES,L/M/H,IDENTIFY,ID.BE,ID.BE-1,NO,NO,NO,YES
O/S,SUPPLY CHAIN RISK MANAGEMENT,SR-3,SUPPLY CHAIN CONTROLS AND PROCESSES,L/M/H,IDENTIFY,ID.SC,ID.SC-1,NO,NO,NO,YES
O/S,SUPPLY CHAIN RISK MANAGEMENT,SR-3,SUPPLY CHAIN CONTROLS AND PROCESSES,L/M/H,IDENTIFY,ID.SC,ID.SC-2,NO,NO,NO,YES
O/S,SUPPLY CHAIN RISK MANAGEMENT,SR-3,SUPPLY CHAIN CONTROLS AND PROCESSES,L/M/H,IDENTIFY,ID.SC,ID.SC-3,NO,NO,NO,YES
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-12,CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT,L/M/H,NA,NA,NA,NO,NO,YES,YES
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-12(1),AVAILABILITY,H,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-12(2),SYMMETRIC KEYS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-12(3),ASYMMETRIC KEYS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-12(6),PHYSICAL CONTROL OF KEYS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-17,PUBLIC KEY INFRASTRUCTURE CERTI,M/H,NA,NA,NA,NO,NO,NO,YES
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-28(3),CRYPTOGRAPHIC KEYS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-3(3),MINIMIZE NONSECURITY FUNCTIONALITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-3(4),MODULE COUPLING AND COHESIVENESS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-3(5),LAYERED STRUCTURES,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-32,SYSTEM PARTITIONING,NA,NA,NA,NA,NO,NO,YES,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-32(1),SEPARATE PHYSICAL DOMAINS FOR PRIVILEGED FUNCTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-41,PORT AND I/O DEVICE ACCESS,NA,NA,NA,NA,NO,NO,YES,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-43,USAGE RESTRICTIONS,NA,NA,NA,NA,NO,NO,YES,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-47,ALTERNATE COMMUNICATIONS PATH,NA,PROTECT,PR.PT,PR.PT-4,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-48,SENSOR RELOCATION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-48(1),DYNAMIC RELOCATION OF SENSORS OR MONITORING CAPABILITIES,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-49,HARDWARE-ENFORCED SEPARATION AND POLICY ENFORCEMENT,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-50,SOFTWARE-ENFORCED SEPARATION AND POLICY ENFORCEMENT,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-51,HARDWARE-BASED PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(21),ISOLATION OF SYSTEM COMPONENTS,H,NA,NA,NA,NO,YES,NO,NO
O/S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(24),PERSONALLY IDENTIFIABLE INFORMATION,NA,NA,NA,NA,YES,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-10(1),MANUAL OVERRIDE CAPABILITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-10(3),PREDICTABLE BEHAVIOR,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-13(4),STANDBY COMPONENT INSTALLATION AND NOTIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-18,PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS,NA,NA,NA,NA,YES,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-18(1),AUTOMATION SUPPORT,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-18(2),DATA TAGS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-18(3),COLLECTION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-18(4),INDIVIDUAL REQUESTS,NA,NA,NA,NA,YES,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-18(5),NOTICE OF CORRECTION OR DELETION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-19,DE-IDENTIFICATION,NA,NA,NA,NA,YES,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-19(1),COLLECTION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-19(2),ARCHIVING,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-19(3),RELEASE,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-19(5),STATISTICAL DISCLOSURE CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-19(6),DIFFERENTIAL PRIVACY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-19(8),MOTIVATED INTRUDER,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-2(4),AUTOMATED PATCH MANAGEMENT TOOLS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-2(5),AUTOMATIC SOFTWARE AND FIRMWARE UPDATES,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-2(6),REMOVAL OF PREVIOUS VERSIONS OF SOFTWARE AND FIRMWARE,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-20,TAINTING,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-21,INFORMATION REFRESH,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-22,INFORMATION DIVERSITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-23,INFORMATION FRAGMENTATION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-3,MALICIOUS CODE PROTECTION,L/M/H,DETECT,DE.CM,DE.CM-4,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-3,MALICIOUS CODE PROTECTION,L/M/H,DETECT,DE.DP,DE.DP-3,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-3(4),UPDATES ONLY BY PRIVILEGED USERS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.AE,DE.AE-1,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.AE,DE.AE-2,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.AE,DE.AE-3,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.AE,DE.AE-4,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.CM,DE.CM-1,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.CM,DE.CM-4,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.CM,DE.CM-5,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.CM,DE.CM-6,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.CM,DE.CM-7,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.DP,DE.DP-2,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.DP,DE.DP-3,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.DP,DE.DP-4,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,DETECT,DE.DP,DE.DP-5,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,IDENTIFY,ID.RA,ID.RA-1,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,PROTECT,PR.DS,PR.DS-5,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,PROTECT,PR.IP,PR.IP-8,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4,SYSTEM MONITORING,L/M/H,RESPOND,RS.AN,RS.AN-1,NO,YES,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4(1),SYSTEM-WIDE INTRUSION DETECTION SYSTEM,NA,NA,NA,NA,NO,YES,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4(11),ANALYZE COMMUNICATIONS TRAFFIC ANOMALIES,NA,NA,NA,NA,NO,YES,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4(12),AUTOMATED ORGANIZATION-GENERATED ALERTS,H,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4(13),ANALYZE TRAFFIC AND EVENT PATTERNS,NA,NA,NA,NA,NO,YES,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4(16),CORRELATE MONITORING INFORMATION,NA,NA,NA,NA,NO,YES,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-4(18),ANALYZE TRAFFIC AND COVERT EXFILTRATION,NA,NA,NA,NA,NO,YES,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-7,"SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY",M/H,PROTECT,PR.DS,PR.DS-6,NO,NO,YES,YES
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-7(12),INTEGRITY VERIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND INFORMATION INTEGRITY,SI-7(17),RUNTIME APPLICATION SELF-PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(1),CLEAR ABSTRACTIONS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(10),HIERARCHICAL TRUST,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(11),INVERSE MODIFICATION THRESHOLD,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(12),HIERARCHICAL PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(13),MINIMIZED SECURITY ELEMENTS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(14),LEAST PRIVILEGE,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(15),PREDICATE PERMISSION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(16),SELF-RELIANT TRUSTWORTHINESS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(17),SECURE DISTRIBUTED COMPOSITION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(18),TRUSTED COMMUNICATIONS CHANNELS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(19),CONTINUOUS PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(2),LEAST COMMON MECHANISM,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(20),SECURE METADATA MANAGEMENT,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(21),SELF-ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(22),ACCOUNTABILITY AND TRACEABILITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(23),SECURE DEFAULTS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(24),SECURE FAILURE AND RECOVERY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(25),ECONOMIC SECURITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(26),PERFORMANCE SECURITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(27),HUMAN FACTORED SECURITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(28),ACCEPTABLE SECURITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(29),REPEATABLE AND DOCUMENTED PROCEDURES,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(3),MODULARITY AND LAYERING,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(30),PROCEDURAL RIGOR,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(31),SECURE SYSTEM MODIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(32),SUFFICIENT DOCUMENTATION,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(33),MINIMIZATION,NA,NA,NA,NA,YES,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(4),PARTIALLY ORDERED DEPENDENCIES,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(5),EFFICIENTLY MEDIATED ACCESS,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(6),MINIMIZED SHARING,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(7),REDUCED COMPLEXITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(8),SECURE EVOLVABILITY,NA,NA,NA,NA,NO,NO,NO,NO
O/S,SYSTEM AND SERVICES ACQUISITION,SA-8(9),TRUSTED COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-10,CONCURRENT SESSION CONTROL,H,PROTECT,PR.AC,PR.AC-5,NO,NO,YES,YES
S,ACCESS CONTROL,AC-11,DEVICE LOCK,M/H,NA,NA,NA,NO,NO,YES,YES
S,ACCESS CONTROL,AC-11(1),PATTERN-HIDING DISPLAYS,M/H,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-12,SESSION TERMINATION,M/H,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,YES
S,ACCESS CONTROL,AC-12(2),TERMINATION MESSAGE,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-12(3),TIMEOUT WARNING MESSAGE,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-16(1),DYNAMIC ATTRIBUTE ASSOCIATION,NA,NA,NA,NA,NO,NO,YES,NO
S,ACCESS CONTROL,AC-16(2),ATTRIBUTE VALUE CHANGES BY AUTHORIZED INDIVIDUALS,NA,NA,NA,NA,NO,NO,YES,YES
S,ACCESS CONTROL,AC-16(3),MAINTENANCE OF ATTRIBUTE ASSOCIATIONS BY SYSTEM,NA,NA,NA,NA,NO,NO,YES,NO
S,ACCESS CONTROL,AC-16(4),ASSOCIATION OF ATTRIBUTES BY AUTHORIZED INDIVIDUALS,NA,NA,NA,NA,NO,NO,YES,NO
S,ACCESS CONTROL,AC-16(5),ATTRIBUTE DISPLAYS ON OBJECTS TO BE OUTPUT,NA,NA,NA,NA,NO,NO,YES,NO
S,ACCESS CONTROL,AC-16(8),ASSOCIATION TECHNIQUES AND TECHNOLOGIES,NA,NA,NA,NA,NO,NO,YES,NO
S,ACCESS CONTROL,AC-17(10),AUTHENTICATE REMOTE COMMANDS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-17(2),PROTECTION OF CONFIDENTIALITY AND INTEGRITY USING ENCRYPTION,M/H,NA,NA,NA,NO,YES,YES,NO
S,ACCESS CONTROL,AC-17(3),MANAGED ACCESS CONTROL POINTS,M/H,NA,NA,NA,NO,NO,YES,NO
S,ACCESS CONTROL,AC-18(1),AUTHENTICATION AND ENCRYPTION,l/M/H,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-2(11),USAGE CONDITIONS,H,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-2(2),AUTOMATED TEMPORARY AND EMERGENCY ACCOUNT MANAGEMENT,M/H,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-2(3),DISABLE ACCOUNTS,M/H,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-2(4),AUTOMATED AUDIT ACTIONS,M/H,NA,NA,NA,NO,NO,NO,YES
S,ACCESS CONTROL,AC-2(6),DYNAMIC PRIVILEGE MANAGEMENT,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-2(8),DYNAMIC ACCOUNT MANAGEMENT,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-21(1),AUTOMATED DECISION SUPPORT,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-21(2),INFORMATION SEARCH AND RETRIEVAL,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-24(1),TRANSMIT ACCESS AUTHORIZATION INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-24(2),NO USER OR PROCESS IDENTITY,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-25,REFERENCE MONITOR,NA,NA,NA,NA,NO,NO,YES,NO
S,ACCESS CONTROL,AC-3,ACCESS ENFORCEMENT,L/M/H,NA,NA,NA,YES,YES,YES,YES
S,ACCESS CONTROL,AC-3,ACCESS ENFORCEMENT,L/M/H,PROTECT,PR.AC,PR.AC-4,YES,YES,YES,YES
S,ACCESS CONTROL,AC-3,ACCESS ENFORCEMENT,L/M/H,PROTECT,PR.PT,PR.PT-3,YES,YES,YES,YES
S,ACCESS CONTROL,AC-3(11),RESTRICT ACCESS TO SPECIFIC INFORMATION TYPES,NA,NA,NA,NA,NO,NO,NO,YES
S,ACCESS CONTROL,AC-3(12),ASSERT AND ENFORCE APPLICATION ACCESS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-3(13),ATTRIBUTE-BASED ACCESS CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-3(14),INDIVIDUAL ACCESS,H,NA,NA,NA,YES,NO,NO,NO
S,ACCESS CONTROL,AC-3(15),DISCRETIONARY AND MANDATORY ACCESS CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-3(2),DUAL AUTHORIZATION,M/H,NA,NA,NA,NO,NO,NO,YES
S,ACCESS CONTROL,AC-3(3),MANDATORY ACCESS CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-3(4),DISCRETIONARY ACCESS CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-3(5),SECURITY-RELEVANT INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4,INFORMATION FLOW ENFORCEMENT,M/H,DETECT,DE.AE,DE.AE-1,NO,YES,YES,YES
S,ACCESS CONTROL,AC-4,INFORMATION FLOW ENFORCEMENT,M/H,IDENTIFY,ID.AM,ID.AM-3,NO,YES,YES,YES
S,ACCESS CONTROL,AC-4,INFORMATION FLOW ENFORCEMENT,M/H,PROTECT,PR.AC,PR.AC-5,NO,YES,YES,YES
S,ACCESS CONTROL,AC-4,INFORMATION FLOW ENFORCEMENT,M/H,PROTECT,PR.DS,PR.DS-5,NO,YES,YES,YES
S,ACCESS CONTROL,AC-4(1),OBJECT SECURITY AND PRIVACY ATTRIBUTES,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(10),ENABLE AND DISABLE SECURITY OR PRIVACY POLICY FILTERS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(11),CONFIGURATION OF SECURITY OR PRIVACY POLICY FILTERS,NA,NA,NA,NA,NO,NO,NO,YES
S,ACCESS CONTROL,AC-4(12),DATA TYPE IDENTIFIERS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(13),DECOMPOSITION INTO POLICY-RELEVANT SUBCOMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(14),SECURITY OR PRIVACY POLICY FILTER CONSTRAINTS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(15),DETECTION OF UNSANCTIONED INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(17),DOMAIN AUTHENTICATION,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(19),VALIDATION OF METADATA,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(2),PROCESSING DOMAINS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(22),ACCESS ONLY,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(24),INTERNAL NORMALIZED FORMAT,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(25),DATA SANITIZATION,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(27),REDUNDANT/INDEPENDENT FILTERING MECHANISMS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(28),LINEAR FILTER PIPELINES,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(3),DYNAMIC INFORMATION FLOW CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(30),FILTER MECHANISMS USING MULTIPLE PROCESSES,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(31),FAILED CONTENT TRANSFER PREVENTION,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(32),PROCESS REQUIREMENTS FOR INFORMATION TRANSFER,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(4),FLOW CONTROL OF ENCRYPTED INFORMATION,H,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(5),EMBEDDED DATA TYPES,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(6),METADATA,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(7),ONE-WAY FLOW MECHANISMS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-4(8),SECURITY AND PRIVACY POLICY FILTERS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-6(10),PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED FUNCTIONS,M/H,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-6(8),PRIVILEGE LEVELS FOR CODE EXECUTION,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-6(9),LOG USE OF PRIVILEGED FUNCTIONS,M/H,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-7,UNSUCCESSFUL LOGON ATTEMPTS,L/M/H,NA,NA,NA,NO,NO,YES,YES
S,ACCESS CONTROL,AC-7(2),PURGE OR WIPE MOBILE DEVICE,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-9,PREVIOUS LOGON NOTIFICATION,NA,NA,NA,NA,NO,NO,YES,NO
S,ACCESS CONTROL,AC-9(1),UNSUCCESSFUL LOGONS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-9(2),SUCCESSFUL AND UNSUCCESSFUL LOGONS,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-9(3),NOTIFICATION OF ACCOUNT CHANGES,NA,NA,NA,NA,NO,NO,NO,NO
S,ACCESS CONTROL,AC-9(4),ADDITIONAL LOGON INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-10,NON-REPUDIATION,H,NA,NA,NA,NO,YES,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-10(1),ASSOCIATION OF IDENTITIES,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-10(2),VALIDATE BINDING OF INFORMATION PRODUCER IDENTITY,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-10(4),VALIDATE BINDING OF INFORMATION REVIEWER IDENTITY,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-12,AUDIT RECORD GENERATION,L/M/H,DETECT,DE.CM,DE.CM-1,NO,NO,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-12,AUDIT RECORD GENERATION,L/M/H,DETECT,DE.CM,DE.CM-3,NO,NO,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-12,AUDIT RECORD GENERATION,L/M/H,DETECT,DE.CM,DE.CM-7,NO,NO,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-12,AUDIT RECORD GENERATION,L/M/H,PROTECT,PR.PT,PR.PT-1,NO,NO,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-12(1),SYSTEM-WIDE AND TIME-CORRELATED AUDIT TRAIL,H,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-12(2),STANDARDIZED FORMATS,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-12(3),CHANGES BY AUTHORIZED INDIVIDUALS,H,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-12(4),QUERY PARAMETER AUDITS OF PERSONALLY IDENTIFIABLE INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-14,SESSION AUDIT,NA,PROTECT,PR.PT,PR.PT-1,NO,NO,YES,NO
S,AUDIT AND ACCOUNTABILITY,AU-14(1),SYSTEM START-UP,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-14(3),REMOTE VIEWING AND LISTENING,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-3,CONTENT OF AUDIT RECORDS,L/M/H,PROTECT,PR.PT,PR.PT-1,YES,NO,NO,YES
S,AUDIT AND ACCOUNTABILITY,AU-3(1),ADDITIONAL AUDIT INFORMATION,M/H,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-5,RESPONSE TO AUDIT LOGGING PROCESS FAILURES,L/M/H,NA,NA,NA,NO,NO,NO,YES
S,AUDIT AND ACCOUNTABILITY,AU-5(1),STORAGE CAPACITY WARNING,H,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-5(2),REAL-TIME ALERTS,H,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-5(3),CONFIGURABLE TRAFFIC VOLUME THRESHOLDS,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-5(4),SHUTDOWN ON FAILURE,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-6(4),CENTRAL REVIEW AND ANALYSIS,NA,NA,NA,NA,NO,YES,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-7,AUDIT RECORD REDUCTION AND REPORT GENERATION,M/H,NA,NA,NA,NO,NO,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-7,AUDIT RECORD REDUCTION AND REPORT GENERATION,M/H,PROTECT,PR.PT,PR.PT-1,NO,NO,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-7,AUDIT RECORD REDUCTION AND REPORT GENERATION,M/H,RESPOND,RS.AN,RS.AN-3,NO,NO,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-7(1),AUTOMATIC PROCESSING,M/H,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-8,TIME STAMPS,L/M/H,NA,NA,NA,NO,NO,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-9,PROTECTION OF AUDIT INFORMATION,L/M/H,NA,NA,NA,NO,YES,YES,YES
S,AUDIT AND ACCOUNTABILITY,AU-9(1),HARDWARE WRITE-ONCE MEDIA,NA,NA,NA,NA,NO,NO,NO,NO
S,AUDIT AND ACCOUNTABILITY,AU-9(2),STORE ON SEPARATE PHYSICAL SYSTEMS OR COMPONENTS,H,NA,NA,NA,NO,YES,NO,YES
S,AUDIT AND ACCOUNTABILITY,AU-9(3),CRYPTOGRAPHIC PROTECTION,H,NA,NA,NA,NO,YES,NO,NO
S,CONFIGURATION MANAGEMENT,CM-11(2),SOFTWARE INSTALLATION WITH PRIVILEGED STATUS,NA,NA,NA,NA,NO,NO,NO,NO
S,CONFIGURATION MANAGEMENT,CM-11(3),AUTOMATED ENFORCEMENT AND MONITORING,NA,NA,NA,NA,NO,NO,NO,NO
S,CONFIGURATION MANAGEMENT,CM-3(5),AUTOMATED SECURITY RESPONSE,NA,NA,NA,NA,NO,NO,NO,NO
S,CONFIGURATION MANAGEMENT,CM-3(8),PREVENT OR RESTRICT CONFIGURATION CHANGES,NA,NA,NA,NA,NO,NO,NO,NO
S,CONFIGURATION MANAGEMENT,CM-5(1),AUTOMATED ACCESS ENFORCEMENT AND AUDIT RECORDS,H,NA,NA,NA,NO,NO,NO,NO
S,CONFIGURATION MANAGEMENT,CM-7(2),PREVENT PROGRAM EXECUTION,L/M/H,NA,NA,NA,NO,NO,NO,NO
S,CONTINGENCY PLANNING,CP-12,SAFE MODE,NA,PROTECT,PR.PT,PR.PT-5,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-2(1),MULTI-FACTOR AUTHENTICATION TO PRIVILEGED ACCOUNTS,L/M/H,NA,NA,NA,NO,YES,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-2(10),SINGLE SIGN-ON,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-2(12),ACCEPTANCE OF PIV CREDENTIALS,L/M/H,NA,NA,NA,NO,YES,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-2(13),OUT-OF-BAND AUTHENTICATION,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-2(2),MULTI-FACTOR AUTHENTICATION TO NON-PRIVILEGED ACCOUNTS,L/M/H,NA,NA,NA,NO,YES,NO,YES
S,IDENTIFICATION AND AUTHENTICATION,IA-2(6),ACCESS TO ACCOUNTS — SEPARATE DEVICE,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-2(8),ACCESS TO ACCOUNTS — REPLAY RESISTANT,L/M/H,NA,NA,NA,NO,NO,NO,YES
S,IDENTIFICATION AND AUTHENTICATION,IA-3,DEVICE IDENTIFICATION AND AUTHENTICATION,M/H,PROTECT,PR.AC,PR.AC-1,NO,YES,YES,YES
S,IDENTIFICATION AND AUTHENTICATION,IA-3,DEVICE IDENTIFICATION AND AUTHENTICATION,M/H,PROTECT,PR.AC,PR.AC-7,NO,YES,YES,YES
S,IDENTIFICATION AND AUTHENTICATION,IA-3(1),CRYPTOGRAPHIC BIDIRECTIONAL AUTHENTICATION,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-4(5),DYNAMIC MANAGEMENT,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-5(10),DYNAMIC CREDENTIAL BINDING,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-5(12),BIOMETRIC AUTHENTICATION PERFORMANCE,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-5(13),EXPIRATION OF CACHED AUTHENTICATORS,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-5(17),PRESENTATION ATTACK DETECTION FOR BIOMETRIC AUTHENTICATORS,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-5(18),PASSWORD MANAGERS,NA,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-5(2),PUBLIC KEY-BASED AUTHENTICATION,M/H,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-6,AUTHENTICATION FEEDBACK,L/M/H,NA,NA,NA,NO,NO,YES,YES
S,IDENTIFICATION AND AUTHENTICATION,IA-7,CRYPTOGRAPHIC MODULE AUTHENTICATION,L/M/H,NA,NA,NA,NO,NO,YES,YES
S,IDENTIFICATION AND AUTHENTICATION,IA-7,CRYPTOGRAPHIC MODULE AUTHENTICATION,L/M/H,PROTECT,PR.AC,PR.AC-1,NO,NO,YES,YES
S,IDENTIFICATION AND AUTHENTICATION,IA-8,DENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS),L/M/H,PROTECT,PR.AC,PR.AC-1,NO,NO,YES,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-8,DENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS),L/M/H,PROTECT,PR.AC,PR.AC-6,NO,NO,YES,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-8,DENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS),L/M/H,PROTECT,PR.AC,PR.AC-7,NO,NO,YES,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-8(1),ACCEPTANCE OF PIV CREDENTIALS FROM OTHER AGENCIES,L/M/H,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-8(2),ACCEPTANCE OF EXTERNAL AUTHENTICATORS,L/M/H,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-8(4),USE OF DEFINED PROFILES,L/M/H,NA,NA,NA,NO,NO,NO,NO
S,IDENTIFICATION AND AUTHENTICATION,IA-8(5),ACCEPTANCE OF PIV-I CREDENTIALS,NA,NA,NA,NA,NO,NO,NO,NO
S,MAINTENANCE FAMILY,MA-4(7),DISCONNECT VERIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
S,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-2(1),DATA TAGGING,NA,NA,NA,NA,NO,NO,NO,NO
S,PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY,PT-3(1),DATA TAGGING,NA,NA,NA,NA,NO,YES,NO,NO
S,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-5(2),LINK TO INDIVIDUAL IDENTITY,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-10,NETWORK DISCONNECT,M/H,PROTECT,PR.AC,PR.AC-5,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-10,NETWORK DISCONNECT,M/H,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-11,TRUSTED PATH,NA,PROTECT,PR.DS,PR.DS-2,NO,NO,YES,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-11,TRUSTED PATH,NA,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-11(1),IRREFUTABLE COMMUNICATIONS PATH,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-13,CRYPTOGRAPHIC PROTECTION,L/M/H,NA,NA,NA,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-15,COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS,L/M/H,PROTECT,PR.AC,PR.AC-3,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-15(1),PHYSICAL OR LOGICAL DISCONNECT,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-15(4),EXPLICITLY INDICATE CURRENT PARTICIPANTS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-16,TRANSMISSION OF SECURITY AND PRIVACY ATTRIBUTES,NA,DETECT,DE.AE,DE.AE-1,NO,NO,YES,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-16(1),INTEGRITY VERIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-16(2),ANTI-SPOOFING MECHANISMS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-16(3),CRYPTOGRAPHIC BINDING,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-18(1),IDENTIFY UNACCEPTABLE CODE AND TAKE CORRECTIVE ACTIONS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-18(3),PREVENT DOWNLOADING AND EXECUTION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-18(4),PREVENT AUTOMATIC EXECUTION,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-18(5),ALLOW EXECUTION ONLY IN CONFINED ENVIRONMENTS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-2,SEPARATION OF SYSTEM AND USER FUNCTIONALITY,M/H,NA,NA,NA,NO,NO,NO,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-2(1),INTERFACES FOR NON-PRIVILEGED USERS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-2(2),DISASSOCIABILITY,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-20,SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE),L/M/H,PROTECT,PR.AC,PR.AC-5,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-20,SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE),L/M/H,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-20(2),DATA ORIGIN AND INTEGRITY,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-21,SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER),L/M/H,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-22,ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION SERVICE,L/M/H,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-23,SESSION AUTHENTICITY,M/H,PROTECT,PR.PT,PR.PT-4,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-23(1),INVALIDATE SESSION IDENTIFIERS AT LOGOUT,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-23(3),UNIQUE SYSTEM-GENERATED SESSION IDENTIFIERS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-23(5),ALLOWED CERTIFICATE AUTHORITIES,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-24,FAIL IN KNOWN STATE,H,NA,NA,NA,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-25,THIN NODES,NA,NA,NA,NA,NO,NO,YES,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-26,DECOYS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-27,PLATFORM-INDEPENDENT APPLICATIONS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-28,PROTECTION OF INFORMATION AT REST,M/H,PROTECT,PR.DS,PR.DS-1,NO,YES,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-28(1),CRYPTOGRAPHIC PROTECTION,M/H,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-3,SECURITY FUNCTION ISOLATION,H,NA,NA,NA,NO,YES,NO,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-3(1),HARDWARE SEPARATION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-3(2),ACCESS AND FLOW CONTROL FUNCTIONS,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-34,NON-MOFIDIABLE EXECUTABLE PROGRAMS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-35,EXTERNAL MALICIOUS CODE IDENTIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-39,PROCESS ISOLATION,L/M/H,NA,NA,NA,NO,NO,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-39(1),HARDWARE SEPARATION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-39(2),SEPARATE EXECUTION DOMAIN PER THREAD,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-4,INFORMATION IN SHARED SYSTEM RESOURCES,M/H,NA,NA,NA,NO,NO,NO,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-4(2),MULTILEVEL OR PERIODS PROCESSING,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-40,WIRELESS LINK PROTECTION,NA,NA,NA,NA,NO,NO,YES,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-40(1),ELECTROMAGNETIC INTERFERENCE,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-40(2),REDUCE DETECTION POTENTIAL,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-40(3),IMITATIVE OR MANIPULATIVE COMMUNICATIONS DECEPTION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-40(4),SIGNAL PARAMETER IDENTIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-42,SENSOR CAPABILITY AND DATA,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-44,DETONATION CHAMBERS,NA,DETECT,DE.CM,DE.CM-4,NO,NO,YES,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-44,DETONATION CHAMBERS,NA,DETECT,DE.CM,DE.CM-5,NO,NO,YES,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-45,SYSTEM TIME SYNCHRONIZATION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-45(1),SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-45(2),SECONDARY AUTHORITATIVE TIME SOURCE,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-46,CROSS DOMAIN POLICY ENFORCEMENT,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-5,DENIAL-OF-SERVICE PROTECTION,L/M/H,DETECT,DE.CM,DE.CM-1,NO,YES,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-5,DENIAL-OF-SERVICE PROTECTION,L/M/H,PROTECT,PR.DS,PR.DS-4,NO,YES,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-5,DENIAL-OF-SERVICE PROTECTION,L/M/H,PROTECT,PR.PT,PR.PT-4,NO,YES,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-5(1),RESTRICT ABILITY TO ATTACK OTHER SYSTEMS,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-5(2),"CAPACITY, BANDWIDTH, AND REDUNDANCY",NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-5(3),DETECTION AND MONITORING,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-6,RESOURCE AVAILABILITY,NA,IDENTIFY,ID.AM,ID.AM-5,NO,NO,YES,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-6,RESOURCE AVAILABILITY,NA,PROTECT,PR.PT,PR.PT-5,NO,NO,YES,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7,BOUNDARY PROTECTION,L/M/H,DETECT,DE.CM,DE.CM-1,YES,YES,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7,BOUNDARY PROTECTION,L/M/H,PROTECT,PR.AC,PR.AC-5,YES,YES,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7,BOUNDARY PROTECTION,L/M/H,PROTECT,PR.DS,PR.DS-5,YES,YES,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7,BOUNDARY PROTECTION,L/M/H,PROTECT,PR.PT,PR.PT-4,YES,YES,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(10),PREVENT EXFILTRATION,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(11),RESTRICT INCOMING COMMUNICATIONS TRAFFIC,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(12),HOST-BASED PROTECTION,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(13),"ISOLATION OF SECURITY TOOLS, MECHANISMS, AND SUPPORT COMPONENTS",NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(14),PROTECT AGAINST UNAUTHORIZED PHYSICAL CONNECTIONS,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(15),NETWORKED PRIVILEGED ACCESSES,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(16),PREVENT DISCOVERY OF SYSTEM COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(17),AUTOMATED ENFORCEMENT OF PROTOCOL FORMATS,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(18),FAIL SECURE,H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(19),BLOCK COMMUNICATION FROM NON-ORGANIZATIONALLY CONFIGURED HOSTS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(20),DYNAMIC ISOLATION AND SEGREGATION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(22),SEPARATE SUBNETS FOR CONNECTING TO DIFFERENT SECURITY DOMAINS,NA,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(23),DISABLE SENDER FEEDBACK ON PROTOCOL VALIDATION FAILURE,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(29),SEPARATE SUBNETS TO ISOLATE FUNCTIONS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(3),ACCESS POINTS,M/H,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(5),DENY BY DEFAULT — ALLOW BY EXCEPTION,M/H,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(7),SPLIT TUNNELING FOR REMOTE DEVICES,M/H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(8),ROUTE TRAFFIC TO AUTHENTICATED PROXY SERVERS,M/H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(9),RESTRICT THREATENING OUTGOING COMMUNICATIONS TRAFFIC,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-8,TRANSMISSION CONFIDENTIALITY AND INTEGRITY,M/H,PROTECT,PR.DS,PR.DS-2,NO,YES,YES,YES
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-8(1),CRYPTOGRAPHIC PROTECTION,M/H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-8(2),PRE- AND POST-TRANSMISSION HANDLING,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-8(3),CRYPTOGRAPHIC PROTECTION FOR MESSAGE EXTERNALS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-8(4),CONCEAL OR RANDOMIZE COMMUNICATIONS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND COMMUNICATIONS PROTECTION,SC-8(5),PROTECTED DISTRIBUTION SYSTEM,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-10,INFORMATION INPUT VALIDATION,M/H,NA,NA,NA,NO,NO,NO,YES
S,SYSTEM AND INFORMATION INTEGRITY,SI-10,INFORMATION INPUT VALIDATION,M/H,PROTECT,PR.DS,PR.DS-6,NO,NO,NO,YES
S,SYSTEM AND INFORMATION INTEGRITY,SI-10(4),TIMING INTERACTIONS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-10(5),RESTRICT INPUTS TO TRUSTED SOURCES AND APPROVED FORMATS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-10(6),INJECTION PREVENTION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-11,ERROR HANDLING,M/H,NA,NA,NA,NO,NO,NO,YES
S,SYSTEM AND INFORMATION INTEGRITY,SI-15,INFORMATION OUTPUT FILTERING,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-16,MEMORY PROTECTION,M/H,NA,NA,NA,NO,NO,YES,YES
S,SYSTEM AND INFORMATION INTEGRITY,SI-17,FAIL-SAFE PROCEDURES,NA,NA,NA,NA,NO,NO,YES,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-19(4),"REMOVAL, MASKING, ENCRYPTION, HASHING, OR REPLACEMENT OF DIRECT IDENTIFIERS",NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-3(8),DETECT UNAUTHORIZED COMMANDS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(14),WIRELESS INTRUSION DETECTION,H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(15),WIRELESS TO WIRELINE COMMUNICATIONS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(2),AUTOMATED TOOLS AND MECHANISMS FOR REAL-TIME ANALYSIS,M/H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(20),PRIVILEGED USERS,H,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(22),UNAUTHORIZED NETWORK SERVICES,H,NA,NA,NA,NO,YES,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(24),INDICATORS OF COMPROMISE,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(25),OPTIMIZE NETWORK TRAFFIC ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(3),AUTOMATED TOOL AND MECHANISM INTEGRATION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(4),INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC,M/H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(5),SYSTEM-GENERATED ALERTS,M/H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-4(7),AUTOMATED RESPONSE TO SUSPICIOUS EVENTS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-6,SECURITY AND PRIVACY FUNCTION VERIFICATION,H,NA,NA,NA,NO,NO,NO,YES
S,SYSTEM AND INFORMATION INTEGRITY,SI-6(2),AUTOMATION SUPPORT FOR DISTRIBUTED TESTING,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-7(1),INTEGRITY CHECKS,M/H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-7(10),PROTECTION OF BOOT FIRMWARE,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-7(15),CODE AUTHENTICATION,H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-7(2),AUTOMATED NOTIFICATIONS OF INTEGRITY VIOLATIONS,H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-7(5),AUTOMATED RESPONSE TO INTEGRITY VIOLATIONS,H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-7(6),CRYPTOGRAPHIC PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-7(8),AUDITING CAPABILITY FOR SIGNIFICANT EVENTS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-7(9),VERIFY BOOT PROCESS,NA,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-8(2),AUTOMATIC UPDATES,M/H,NA,NA,NA,NO,NO,NO,NO
S,SYSTEM AND INFORMATION INTEGRITY,SI-8(3),CONTINUOUS LEARNING CAPABILITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Addressed through tailoring.,CONTINGENCY PLANNING,CP-10(3),COMPENSATING SECURITY CONTROLS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-12(1).,SYSTEM AND COMMUNICATIONS PROTECTION,SC-23(2),USER-INITIATED LOGOUTS AND MESSAGE DISPLAYS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-14.,ACCESS CONTROL,AC-14(1),NECESSARY USES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-16.,ACCESS CONTROL,AC-4(18),SECURITY ATTRIBUTE BINDING,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-2 and AU-6.,ACCESS CONTROL,AC-13,SUPERVISION AND REVIEW-ACCESS CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
"W: Incorporated into AC-2, AC-3, AC-5, and  AC-6.",SYSTEM AND INFORMATION INTEGRITY,SI-9,INFORMATION INPUT RESTRICTIONS,NA,NA,NA,NA,NO,NO,NO,NO
"W: Incorporated into AC-2, AC-3, AC-5, SI 3, SI-4, SI-5, SI-7, and SI-10.",SYSTEM AND COMMUNICATIONS PROTECTION,SC-14,PROTECTIONS PUBLIC ACCESS PROTECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-2k.,ACCESS CONTROL,AC-2(10),SHARED AND GROUP ACCOUNT CREDENTIAL CHANGE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-3(10).,ACCESS CONTROL,AC-17(7),ADDITIONAL PROTECTION FOR SECURITY FUNCTION ACCESS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-4.,ACCESS CONTROL,AC-4(16),INFORMATION TRANSFERS ON INTERCONNECTED SYSTEMS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-6.,ACCESS CONTROL,AC-3(1),RESTRICTED ACCESS TO PRIVILEGED FUNCTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-6(10).,SYSTEM AND INFORMATION INTEGRITY,SI-3(3),NON-PRIVILEGED USERS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-6(10).,SYSTEM AND INFORMATION INTEGRITY,SI-4(6),RESTRICT NON-PRIVILEGED USERS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-6(9).,AUDIT AND ACCOUNTABILITY,AU-2(4),PRIVILEGED FUNCTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AC-7.,ACCESS CONTROL,AC-7(1),AUTOMATIC ACCOUNT LOCK,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AT-2(4).,AWARENESS AND TRAINING,AT-3(4),SUSPICIOUS COMMUNICATIONS AND ANOMALOUS SYSTEM BEHAVIOR,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AU-12.,AUDIT AND ACCOUNTABILITY,AU-2(1),COMPILATION OF AUDIT RECORDS FROM MULTIPLE SOURCES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AU-12.,AUDIT AND ACCOUNTABILITY,AU-2(2),SELECTION OF AUDIT EVENTS BY COMPONENT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AU-14.,AUDIT AND ACCOUNTABILITY,AU-14(2),CAPTURE AND RECORD CONTENT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AU-2.,AUDIT AND ACCOUNTABILITY,AU-2(3),REVIEWS AND UPDATES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AU-6.,AUDIT AND ACCOUNTABILITY,AU-6(10),AUDIT LEVEL ADJUSTMENT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into AU-7(1).,AUDIT AND ACCOUNTABILITY,AU-7(2),AUTOMATIC SORT AND SEARCH,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CA-2.,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-4,SECURITY CERTIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CA-2.,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-7(2),TYPES OF ASSESSMENTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CA-8.,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-3(6),FACILITY PENETRATION TESTING,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CA-8.,RISK ASSESSMENT,RA-5(9),PENETRATION TESTING AND ANALYSES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-10 and SI-7.,SYSTEM AND SERVICES ACQUISITION,SA-6,SOFTWARE USAGE RESTRICTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-11 and SI-7.,SYSTEM AND SERVICES ACQUISITION,SA-7,USER-INSTALLED SOFTWARE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-2.,CONFIGURATION MANAGEMENT,CM-2(1),REVIEWS AND UPDATES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-3(7).,CONFIGURATION MANAGEMENT,CM-5(2),REVIEW SYSTEM CHANGES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-4.,CONFIGURATION MANAGEMENT,CM-6(4),CONFORMANCE DEMONSTRATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-7.,ACCESS CONTROL,AC-17(8),DISABLE NONSECURE NETWORK PROTOCOLS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-7.,CONFIGURATION MANAGEMENT,CM-2(4),UNAUTHORIZED SOFTWARE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-7.,CONFIGURATION MANAGEMENT,CM-2(5),AUTHORIZED SOFTWARE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-8.,CONFIGURATION MANAGEMENT,CM-8(5),NO DUPLICATE ACCOUNTING OF COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-8.,RISK ASSESSMENT,RA-5(7),AUTOMATED DETECTION AND NOTIFICATION OF UNAUTHORIZED COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-8(3).,CONFIGURATION MANAGEMENT,CM-11(1),ALERTS FOR UNAUTHORIZED INSTALLATIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CM-8(9).,SYSTEM AND SERVICES ACQUISITION,SA-4(4),ASSIGNMENT OF COMPONENTS TO SYSTEMS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CP-2.,CONTINGENCY PLANNING,CP-5,CONTINGENCY PLAN UPDATE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CP-2(3).,CONTINGENCY PLANNING,CP-2(4),RESUME ALL MISSION AND BUSINESS FUNCTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CP-4.,CONTINGENCY PLANNING,CP-10(1),CONTINGENCY PLAN TESTING,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CP-7.,CONTINGENCY PLANNING,CP-7(5),EQUIVALENT INFORMATION SECURITY SAFEGUARDS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into CP-9.,CONTINGENCY PLANNING,CP-9(4),PROTECTION FROM UNAUTHORIZED MODIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-12(1).,IDENTIFICATION AND AUTHENTICATION,IA-4(2),SUPERVISOR AUTHORIZATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-12(2).,IDENTIFICATION AND AUTHENTICATION,IA-4(3),MULTIPLE FORMS OF CERTIFICATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-12(4).,IDENTIFICATION AND AUTHENTICATION,IA-4(7),IN-PERSON REGISTRATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-12(4).,IDENTIFICATION AND AUTHENTICATION,IA-5(3),IN-PERSON OR TRUSTED EXTERNAL PARTY REGISTRATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-2(1) and IA-2(2).,IDENTIFICATION AND AUTHENTICATION,IA-5(11),HARDWARE TOKEN-BASED AUTHENTICATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-2(1).,IDENTIFICATION AND AUTHENTICATION,IA-2(3),LOCAL ACCESS TO PRIVILEGED ACCOUNTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-2(2).,IDENTIFICATION AND AUTHENTICATION,IA-2(4),LOCAL ACCESS TO NON-PRIVILEGED ACCOUNTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-2(6).,IDENTIFICATION AND AUTHENTICATION,IA-2(11),REMOTE ACCESS — SEPARATE DEVICE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-2(6).,IDENTIFICATION AND AUTHENTICATION,IA-2(7),NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS — SEPARATE DEVICE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-2(8).,IDENTIFICATION AND AUTHENTICATION,IA-2(9),NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS — REPLAY RESISTANT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-3(1).,IDENTIFICATION AND AUTHENTICATION,IA-3(2),CRYPTOGRAPHIC BIDIRECTIONAL NETWORK AUTHENTICATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-5(1).,IDENTIFICATION AND AUTHENTICATION,IA-5(4),AUTOMATED SUPPORT FOR PASSWORD STRENGTH DETERMINATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-8(2).,IDENTIFICATION AND AUTHENTICATION,IA-8(3),USE OF FICAM-APPROVED PRODUCTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-9.,IDENTIFICATION AND AUTHENTICATION,IA-9(1),INFORMATION EXCHANGE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IA-9.,IDENTIFICATION AND AUTHENTICATION,IA-9(2),TRANSMISSION OF DECISIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into IR-9.,INCIDENT RESPONSE,IR-9(1),RESPONSIBLE PERSONNEL,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MA-1 and MA-4.,MAINTENANCE FAMILY,MA-4(2),DOCUMENT NONLOCAL MAINTENANCE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MA-2.,MAINTENANCE FAMILY,MA-2(1),RECORD CONTENT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MA-6 and RA-9.,SYSTEM AND SERVICES ACQUISITION,SA-12(13),CRITICAL INFORMATION SYSTEM COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-3.,ACCESS CONTROL,AC-15,AUTOMATED MARKING,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-4 and SC-28.,ACCESS CONTROL,AC-3(6),PROTECTION OF USER AND SYSTEM INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-4(2).,MEDIA PROTECTION,MP-2(1),AUTOMATED RESTRICTED ACCESS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-5.,MEDIA PROTECTION,MP-5(1),PROTECTION OUTSIDE OF CONTROLLED AREAS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-5.,MEDIA PROTECTION,MP-5(2),DOCUMENTATION OF ACTIVITIES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-6.,MEDIA PROTECTION,MP-6(4),CONTROLLED UNCLASSIFIED INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-6.,MEDIA PROTECTION,MP-6(5),CLASSIFIED INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-6.,MEDIA PROTECTION,MP-6(6),MEDIA DESTRUCTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-7.,ACCESS CONTROL,AC-19(1),USE OF WRITABLE AND PORTABLE STORAGE DEVICES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-7.,ACCESS CONTROL,AC-19(2),USE OF PERSONALLY OWNED PORTABLE STORAGE DEVICES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-7.,ACCESS CONTROL,AC-19(3),USE OF PORTABLE STORAGE DEVICES WITH NO IDENTIFIABLE OWNER,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-7.,MEDIA PROTECTION,MP-7(1),PROHIBIT USE WITHOUT OWNER,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into MP-7.,SYSTEM AND INFORMATION INTEGRITY,SI-3(5),PORTABLE STORAGE DEVICES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PE-10.,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-10(1),ACCIDENTAL AND UNAUTHORIZED ACTIVATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PE-13(2).,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-13(3),AUTOMATIC FIRE SUPPRESSION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PE-2 and PE-3.,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-7,VISITOR CONTROL,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PE-2.,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-8(2),PHYSICAL ACCESS RECORDS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PE-22.,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-5(3),MARKING OUTPUT DEVICES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PE-5.,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-5(1),ACCESS TO OUTPUT BY AUTHORIZED INDIVIDUALS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PL-2.,PLANNING,PL-2(3),PLAN AND COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PL-2.,PLANNING,PL-3,SYSTEM SECURITY PLAN UPDATE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PL-2.,PLANNING,PL-6,SECURITY-RELATED ACTIVITY PLANNING,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PL-7.,PLANNING,PL-2(1),CONCEPT OF OPERATIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PL-8.,PLANNING,PL-2(2),FUNCTIONAL ARCHITECTURE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PL-9.,AUDIT AND ACCOUNTABILITY,AU-3(2),CENTRALIZED MANAGEMENT OF PLANNED AUDIT RECORD CONTENT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PL-9.,SYSTEM AND INFORMATION INTEGRITY,SI-2(1),CENTRAL MANAGEMENT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PL-9.,SYSTEM AND INFORMATION INTEGRITY,SI-3(1),CENTRAL MANAGEMENT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PL-9.,SYSTEM AND INFORMATION INTEGRITY,SI-8(1),CENTRAL MANAGEMENT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into PM-15.,AWARENESS AND TRAINING,AT-5,CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS,NA,NA,NA,NA,NO,NO,NO,YES
W: Incorporated into PS-3.,PERSONNEL SECURITY,PS-6(1),INFORMATION REQUIRING SPECIAL PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into RA-3.,RISK ASSESSMENT,RA-4,RISK ASSESSMENT UPDATE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into RA-3(2).,SYSTEM AND SERVICES ACQUISITION,SA-12(8),USE OF ALL-SOURCE INTELLIGENCE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into RA-5.,RISK ASSESSMENT,RA-5(1),UPDATE TOOL CAPABILITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into RA-8.,PLANNING,PL-5,PRIVACY IMPACT ASSESSMENT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into RA-9.,SYSTEM AND SERVICES ACQUISITION,SA-14,CRITICAL ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-11(2).,SYSTEM AND SERVICES ACQUISITION,SA-15(4),THREAT MODELING AND VULNERABILITY ANALYSIS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-20.,SYSTEM AND SERVICES ACQUISITION,SA-14(1),CRITICAL COMPONENTS WITH NO VIABLE ALTERNATIVE SOURCING,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-21.,SYSTEM AND SERVICES ACQUISITION,SA-21(1),VALIDATION OF SCREENING,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-22.,SYSTEM AND SERVICES ACQUISITION,SA-22(1),ALTERNATIVE SOURCES FOR CONTINUED SUPPORT,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-3(2).,SYSTEM AND SERVICES ACQUISITION,SA-15(9),USE OF LIVE DATA,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-4(1).,SYSTEM AND SERVICES ACQUISITION,SA-5(1),FUNCTIONAL PROPERTIES OF SECURITY CONTROLS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-4(2).,SYSTEM AND SERVICES ACQUISITION,SA-5(2),SECURITY-RELEVANT EXTERNAL SYSTEM INTERFACES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-4(2).,SYSTEM AND SERVICES ACQUISITION,SA-5(3),HIGH-LEVEL DESIGN,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-4(2).,SYSTEM AND SERVICES ACQUISITION,SA-5(4),LOW-LEVEL DESIGN,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-4(2).,SYSTEM AND SERVICES ACQUISITION,SA-5(5),SOURCE CODE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SA-8.,SYSTEM AND SERVICES ACQUISITION,SA-13,TRUSTWORTHINESS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-12(3).,SYSTEM AND COMMUNICATIONS PROTECTION,SC-12(4),PKI CERTIFICATES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-12(3).,SYSTEM AND COMMUNICATIONS PROTECTION,SC-12(5),PKI CERTIFICATES / HARDWARE TOKENS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-13.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-13(1),FIPS-VALIDATED CRYPTOGRAPHY,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-13.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-13(2),NSA-APPROVED CRYPTOGRAPHY,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-13.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-13(3),INDIVIDUALS WITHOUT FORMAL ACCESS APPROVALS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-13.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-13(4),DIGITAL SIGNATURES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-20.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-20(1),CHILD SUBSPACES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-21.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-21(1),DATA ORIGIN AND INTEGRITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-23(3).,SYSTEM AND COMMUNICATIONS PROTECTION,SC-23(4),UNIQUE SESSION IDENTIFIERS WITH RANDOMIZATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-28(1).,MEDIA PROTECTION,MP-2(2),CRYPTOGRAPHIC PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-28(1).,MEDIA PROTECTION,MP-4(1),CRYPTOGRAPHIC PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-28(1).,MEDIA PROTECTION,MP-5(4),CRYPTOGRAPHIC PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-29(1).,SYSTEM AND COMMUNICATIONS PROTECTION,SC-30(1),VIRTUALIZATION TECHNIQUES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-35.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-26(1),DETECTION OF MALICIOUS CODE,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-4.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-4(1),SECURITY LEVELS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-42.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-42(3),PROHIBIT USE OF DEVICES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-7.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-15(2),BLOCKING INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-7.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(1),PHYSICALLY SEPARATED SUBNETWORKS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-7.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(2),PUBLIC ACCESS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-7(18).,SYSTEM AND COMMUNICATIONS PROTECTION,SC-7(6),RESPONSE TO RECOGNIZED FAILURES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-7(5).,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-3(5),RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-8.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-33,TRANSMISSION PREPARATION INTEGRITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SC-8.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-9,TRANSMISSION CONFIDENTIALITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-13.,CONTINGENCY PLANNING,CP-10(5),FAILOVER CAPABILITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-3.,SYSTEM AND INFORMATION INTEGRITY,SI-3(2),AUTOMATIC UPDATES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-3.,SYSTEM AND INFORMATION INTEGRITY,SI-3(7),NONSIGNATURE-BASED DETECTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-4.,ACCESS CONTROL,AC-17(5),MONITORING FOR UNAUTHORIZED CONNECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-4.,ACCESS CONTROL,AC-18(2),MONITORING UNAUTHORIZED CONNECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-4.,AUDIT AND ACCOUNTABILITY,AU-6(2),AUTOMATED SECURITY ALERTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-4.,SYSTEM AND INFORMATION INTEGRITY,SI-4(8),PROTECTION OF MONITORING INFORMATION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-6.,SYSTEM AND INFORMATION INTEGRITY,SI-6(1),NOTIFICATION OF FAILED SECURITY TESTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-7.,AUDIT AND ACCOUNTABILITY,AU-10(5),DIGITAL SIGNATURES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-7.,CONFIGURATION MANAGEMENT,CM-5(7),AUTOMATIC IMPLEMENTATION OF SECURITY SAFEGUARDS,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-7.,CONFIGURATION MANAGEMENT,CM-6(3),UNAUTHORIZED CHANGE DETECTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SI-7(16).,SYSTEM AND INFORMATION INTEGRITY,SI-13(2),TIME LIMIT ON PROCESS EXECUTION WITHOUT SUPERVISION,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SR-3.,SYSTEM AND SERVICES ACQUISITION,SA-12(15),PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIES,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SR-3.,SYSTEM AND SERVICES ACQUISITION,SA-12(3),TRUSTED SHIPPING AND WAREHOUSING,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SR-5(1).,SYSTEM AND SERVICES ACQUISITION,SA-12(6),MINIMIZING PROCUREMENT TIME,NA,NA,NA,NA,NO,NO,NO,NO
W: Incorporated into SR-9.,SYSTEM AND INFORMATION INTEGRITY,SI-7(4),TAMPER-EVIDENT PACKAGING,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to AC-17(10).,SYSTEM AND INFORMATION INTEGRITY,SI-3(9),AUTHENTICATE REMOTE COMMANDS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to AU-5(5).,AUDIT AND ACCOUNTABILITY,AU-15,ALTERNATE AUDIT LOGGING CAPABILITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to CM-14.,CONFIGURATION MANAGEMENT,CM-5(3),SIGNED COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to CM-7(6).,SYSTEM AND INFORMATION INTEGRITY,SI-7(11),CONFINED ENVIRONMENTS WITH LIMITED PRIVILEGES,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to CM-7(7).,SYSTEM AND INFORMATION INTEGRITY,SI-7(13),CODE EXECUTION IN PROTECTED ENVIRONMENTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to CM-7(8).,SYSTEM AND INFORMATION INTEGRITY,SI-7(14),BINARY OR MACHINE EXECUTABLE CODE,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to IR-4(11).,INCIDENT RESPONSE,IR-10,INTEGRATED INFORMATION SECURITY ANALYSIS TEAM,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to PE-23.,PHYSICAL AND ENVIRONMENTAL PROTECTION,PE-18(1),FACILITY SITE,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SC-45(1).,AUDIT AND ACCOUNTABILITY,AU-8(1),SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SC-45(2).,AUDIT AND ACCOUNTABILITY,AU-8(2),SECONDARY AUTHORITATIVE TIME SOURCE,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SC-51.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-34(3),HARDWARE-BASED PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SC-7(25).,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-3(1),UNCLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SC-7(26).,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-3(2),CLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SC-7(27).,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-3(3),UNCLASSIFIED NON-NATIONAL SECURITY SYSTEM CONNECTIONS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SC-7(28).,"ASSESSMENT, AUTHORIZATION, AND MONITORING",CA-3(4),CONNECTIONS TO PUBLIC NETWORKS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR Family.,SYSTEM AND SERVICES ACQUISITION,SA-12,SUPPLY CHAIN PROTECTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-10.,SYSTEM AND SERVICES ACQUISITION,SA-18(2),INSPECTION OF SYSTEMS OR COMPONENTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-11.,SYSTEM AND SERVICES ACQUISITION,SA-19,COMPONENT AUTHENTICITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-11(1).,SYSTEM AND SERVICES ACQUISITION,SA-19(1),ANTI-COUNTERFEIT TRAINING,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-11(2).,SYSTEM AND SERVICES ACQUISITION,SA-19(2),CONFIGURATION CONTROL FOR COMPONENT SERVICE AND REPAIR,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-11(3).,SYSTEM AND SERVICES ACQUISITION,SA-19(4),ANTI-COUNTERFEIT SCANNING,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-12.,SYSTEM AND SERVICES ACQUISITION,SA-19(3),COMPONENT DISPOSAL,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-3(1).,SYSTEM AND SERVICES ACQUISITION,SA-12(4),DIVERSITY OF SUPPLIERS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-3(2).,SYSTEM AND SERVICES ACQUISITION,SA-12(5),LIMITATION OF HARM,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-4(1) and SR-4(2).,SYSTEM AND SERVICES ACQUISITION,SA-12(14),IDENTITY AND TRACEABILITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-4(3).,SYSTEM AND SERVICES ACQUISITION,SA-12(10),VALIDATE AS GENUINE AND NOT ALTERED,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-5.,SYSTEM AND SERVICES ACQUISITION,SA-12(1),"ACQUISITION STRATEGIES, TOOLS, AND METHODS",NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-5(2).,SYSTEM AND SERVICES ACQUISITION,SA-12(7),ASSESSMENTS PRIOR TO SELECTION / ACCEPTANCE / UPDATE,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-6.,SYSTEM AND SERVICES ACQUISITION,SA-12(2),SUPPLIER REVIEWS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-6(1).,SYSTEM AND SERVICES ACQUISITION,SA-12(11),"PENETRATION TESTING / ANALYSIS OF ELEMENTS, PROCESSES, AND ACTORS",NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-7.,SYSTEM AND SERVICES ACQUISITION,SA-12(9),OPERATIONS SECURITY,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-8.,SYSTEM AND SERVICES ACQUISITION,SA-12(12),INTER-ORGANIZATIONAL AGREEMENTS,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-9.,SYSTEM AND SERVICES ACQUISITION,SA-18,TAMPER RESISTANCE AND DETECTION,NA,NA,NA,NA,NO,NO,NO,NO
W: Moved to SR-9(1).,SYSTEM AND SERVICES ACQUISITION,SA-18(1),MULTIPLE PHASES OF SYSTEM DEVELOPMENT LIFE CYCLE,NA,NA,NA,NA,NO,NO,NO,NO
W: Technology-specific; addressed as any other technology or protocol.,SYSTEM AND COMMUNICATIONS PROTECTION,SC-19,VOICE OVER INTERNET PROTOCOL,NA,NA,NA,NA,NO,NO,NO,NO