Search
Family
| ID | Family | Determination Statement |
|---|---|---|
| 3.1.1e[a] | Access Control | Critical or sensitive system and organizational operations for which dual authorization is to be enforced are identified. |
| 3.1.1e[b] | Access Control | Dual authorization is employed to execute critical or sensitive system and organizational operations. |
| 3.1.2e[a] | Access Control | Information resources that are owned, provisioned, or issued by the organization are identified. |
| 3.1.2e[b] | Access Control | Access to systems and system components is restricted to only those information resources that are owned, provisioned, or issued by the organization. |
| 3.1.3e_ODP[1] | Access Control | Secure information transfer solutions are defined. |
| 3.1.3e[a] | Access Control | Information flows between security domains on connected systems are identified. |
| 3.1.3e[b] | Access Control | <3.1.3e_ODP[1]: solutions> are employed to control information flows between security domains on connected systems. |
| 3.2.1e_ODP[1] | Awareness and Training | The frequency of providing awareness training is defined. |
| 3.2.1e_ODP[2] | Awareness and Training | The frequency of updating awareness training is defined. |
| 3.2.1e[a] | Awareness and Training | Threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors are identified. |
| 3.2.1e[b] | Awareness and Training | Awareness training focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors is provided <3.2.1e_ODP[1]: frequency>. |
| 3.2.1e[c] | Awareness and Training | Significant changes to the threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors are identified. |
| 3.2.1e[d] | Awareness and Training | Awareness training is updated <3.2.1e_ODP[2]: frequency> or when there are significant changes to the threat. |
| 3.2.2e_ODP[1] | Awareness and Training | Roles to be included in awareness training practical exercises are defined. |
| 3.2.2e[a] | Awareness and Training | Practical exercises are identified. |
| 3.2.2e[b] | Awareness and Training | Current threat scenarios are identified. |
| 3.2.2e[c] | Awareness and Training | Individuals involved in training and their supervisors are identified. |
| 3.2.2e[d] | Awareness and Training | Practical exercises that are aligned with current threat scenarios are included in awareness training for <3.2.2e_ODP[1]: roles>. |
| 3.2.2e[e] | Awareness and Training | Feedback is provided to individuals involved in the training and their supervisors. |
| 3.4.1e[a] | Configuration Management | Approved system components are identified. |
| 3.4.1e[b] | Configuration Management | Implemented system components are identified. |
| 3.4.1e[c] | Configuration Management | An authoritative source and repository are established to provide a trusted source and accountability for approved and implemented system components. |
| 3.4.1e[d] | Configuration Management | An authoritative source and repository are maintained to provide a trusted source and accountability for approved and implemented system components. |
| 3.4.2e_ODP[1] | Configuration Management | One or more of the following is/are selected: remove the components; place the components in a quarantine or remediation network. |
| 3.4.2e[a] | Configuration Management | Automated mechanisms to detect misconfigured or unauthorized system components are identified. |
| 3.4.2e[b] | Configuration Management | Automated mechanisms are employed to detect misconfigured or unauthorized system components. |
| 3.4.2e[c] | Configuration Management | Misconfigured or unauthorized system components are detected. |
| 3.4.2e[d] | Configuration Management | After detection, system components are <3.4.2.e_ODP[1]: removed and/or placed in a quarantine or remediation network> to facilitate patching, re-configuration, or other mitigations. |
| 3.4.3e[a] | Configuration Management | Automated discovery and management tools for the inventory of system components are identified. |
| 3.4.3e[b] | Configuration Management | An up-to-date, complete, accurate, and readily available inventory of system components exists. |
| 3.4.3e[c] | Configuration Management | Automated discovery and management tools are employed to maintain an up-to-date, complete, accurate, and readily available inventory of system components. |
| 3.5.1e_ODP[1] | Identification and Authentication | Systems and system components to identify and authenticate are defined. |
| 3.5.1e[a] | Identification and Authentication | Bidirectional authentication that is cryptographically-based is implemented. |
| 3.5.1e[b] | Identification and Authentication | Bidirectional authentication that is replay-resistant is implemented. |
| 3.5.1e[c] | Identification and Authentication | <3.5.1e_ODP[1]: systems and system components> are identified and authenticated before establishing a network connection using bidirectional authentication that is cryptographically-based and replay-resistant. |
| 3.5.2e[a] | Identification and Authentication | Systems and system components that do not support multifactor authentication or complex account management are identified. |
| 3.5.2e[b] | Identification and Authentication | Automated mechanisms for the generation, protection, rotation, and management of passwords for systems and system components that do not support multifactor authentication or complex account management are identified. |
| 3.5.2e[c] | Identification and Authentication | Automated mechanisms for the generation, protection, rotation, and management of passwords for systems and system components that do not support multifactor authentication or complex account management are employed. |
| 3.5.3e[a] | Identification and Authentication | System components that are known, authenticated, in a properly configured state, or in a trust profile are identified. |
| 3.5.3e[b] | Identification and Authentication | Automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems are identified. |
| 3.5.3e[c] | Identification and Authentication | Automated or manual/procedural mechanisms are employed to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile. |
| 3.6.1e_ODP[1] | Incident Response | A time period to operate a security operations center capability is defined. |
| 3.6.1e[a] | Incident Response | A security operations center capability is established. |
| 3.6.1e[b] | Incident Response | The security operations center capability operates <3.6.1e_ODP[1]: time period>. |
| 3.6.1e[c] | Incident Response | The security operations center capability is maintained. |
| 3.6.2e_ODP[1] | Incident Response | A time period for deploying a cyber incident response team is defined. |
| 3.6.2e[a] | Incident Response | A cyber incident response team is established. |
| 3.6.2e[b] | Incident Response | The cyber incident response team can be deployed by the organization within <3.6.2e_ODP[1]: time period>. |
| 3.6.2e[c] | Incident Response | The cyber incident response team is maintained. |
| 3.9.1e_ODP[1] | Personnel Security | Enhanced personnel screening for individuals is defined. |
| 3.9.1e_ODP[2] | Personnel Security | The frequency with which to reassess individual positions and access to CUI is defined. |
| 3.9.1e[a] | Personnel Security | Individuals that require enhanced personnel screening are identified. |
| 3.9.1e[b] | Personnel Security | Positions that require access to CUI are identified. |
| 3.9.1e[c] | Personnel Security | <3.9.1e_ODP[1]: enhanced personnel screening> is conducted for individuals. |
| 3.9.1e[d] | Personnel Security | Individual positions and access to CUI is reassessed <3.9.1e_ODP[2]: frequency>. |
| 3.9.2e[a] | Personnel Security | Individuals with access to CUI are identified. |
| 3.9.2e[b] | Personnel Security | Adverse information about individuals with access to CUI is defined. |
| 3.9.2e[c] | Personnel Security | Organizational systems to which individuals have access are identified. |
| 3.9.2e[d] | Personnel Security | Mechanisms are in place to protect organizational systems if adverse information develops or is obtained about individuals with access to CUI. |
| 3.11.1e_ODP[1] | Risk Assessment | Sources of threat intelligence are defined. |
| 3.11.1e[a] | Risk Assessment | A risk assessment methodology is identified. |
| 3.11.1e[b] | Risk Assessment | <3.11.1e_ODP[1]: sources of threat intelligence> are employed as part of a risk assessment to guide and inform the development of organizational systems and security architectures. |
| 3.11.1e[c] | Risk Assessment | <3.11.1e_ODP[1]: sources of threat intelligence> are employed as part of a risk assessment to guide and inform the selection of security solutions. |
| 3.11.1e[d] | Risk Assessment | <3.11.1e_ODP[1]: sources of threat intelligence> are employed as part of a risk assessment to guide and inform system monitoring activities. |
| 3.11.1e[e] | Risk Assessment | <3.11.1e_ODP[1]: sources of threat intelligence> are employed as part of a risk assessment to guide and inform threat hunting activities. |
| 3.11.2e_ODP[1] | Risk Assessment | One or more of the following is/are selected: the frequency with which to conduct cyber threat hunting activities; the event triggering cyber threat hunting activities. |
| 3.11.2e_ODP[2] | Risk Assessment | The frequency with which to conduct cyber threat hunting activities is defined. (If selected in 3.11.2e_ODP[1]) |
| 3.11.2e_ODP[3] | Risk Assessment | The event triggering cyber threat hunting activities is defined. (If selected in 3.11.2e_ODP[1]) |
| 3.11.2e_ODP[4] | Risk Assessment | Organizational systems to search for indicators of compromise are defined. |
| 3.11.2e[a] | Risk Assessment | Indicators of compromise are identified. |
| 3.11.2e[b] | Risk Assessment | Cyber threat hunting activities are conducted <3.11.2e_ODP[2] frequency and/or 3.11.2e_ODP[3] event> to search for indicators of compromise in <3.11.2e_ODP[4]: systems>. |
| 3.11.2e[c] | Risk Assessment | Cyber threat hunting activities are conducted <3.11.2e_ODP[2] frequency and/or 3.11.2e_ODP[3] event> to detect, track, and disrupt threats that evade existing controls. |
| 3.11.3e[a] | Risk Assessment | Advanced automation and analytics capabilities to predict and identify risks to organizations, systems, and system components are identified. |
| 3.11.3e[b] | Risk Assessment | Analysts to predict and identify risks to organizations, systems, and system components are identified. |
| 3.11.3e[c] | Risk Assessment | Advanced automation and analytics capabilities are employed in support of analysts to predict and identify risks to organizations, systems, and system components. |
| 3.11.4e[a] | Risk Assessment | The system security plan documents or references the security solution selected. |
| 3.11.4e[b] | Risk Assessment | The system security plan documents or references the rationale for the security solution. |
| 3.11.4e[c] | Risk Assessment | The system security plan documents or references the risk determination. |
| 3.11.5e_ODP[1] | Risk Assessment | The frequency to assess the effectiveness of security solutions is defined. |
| 3.11.5e[a] | Risk Assessment | Security solutions are identified. |
| 3.11.5e[b] | Risk Assessment | Current and accumulated threat intelligence is identified. |
| 3.11.5e[c] | Risk Assessment | Anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence is identified. |
| 3.11.5e[d] | Risk Assessment | The effectiveness of security solutions is assessed <3.11.5e_ODP[1]: frequency> to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence. |
| 3.11.6e[a] | Risk Assessment | Supply chain risks associated with organizational systems and system components are identified. |
| 3.11.6e[b] | Risk Assessment | Supply chain risks associated with organizational systems and system components are assessed. |
| 3.11.6e[c] | Risk Assessment | Supply chain risks associated with organizational systems and system components are responded to. |
| 3.11.6e[d] | Risk Assessment | Supply chain risks associated with organizational systems and system components are monitored. |
| 3.11.7e_ODP[1] | Risk Assessment | The frequency for updating the supply chain risk management plan is defined. |
| 3.11.7e[a] | Risk Assessment | Supply chain risks associated with organizational systems and system components are identified. |
| 3.11.7e[b] | Risk Assessment | Organizational systems and system components to include in a supply chain risk management plan are identified. |
| 3.11.7e[c] | Risk Assessment | A plan for managing supply chain risks associated with organizational systems and system components is developed. |
| 3.11.7e[d] | Risk Assessment | The plan for managing supply chain risks is updated <3.11.7e_ODP[1]: frequency>. |
| 3.12.1e_ODP[1] | Security Assessment | The frequency to conduct penetration testing is defined. |
| 3.12.1e[a] | Security Assessment | Automated scanning tools are identified. |
| 3.12.1e[b] | Security Assessment | Ad hoc tests using subject matter experts are identified. |
| 3.12.1e[c] | Security Assessment | Penetration testing is conducted <3.12.1e_ODP[1]: frequency> leveraging automated scanning tools and ad hoc tests using subject matter experts. |
| 3.13.1e_ODP[1] | System and Communications Protection | System components that require diversity are defined. |
| 3.13.1e[a] | System and Communications Protection | Diversity in <3.13.1e_ODP[1]: system components> is created to reduce the extent of malicious code propagation. |
| 3.13.2e_ODP[1] | System and Communications Protection | Changes to organizational systems and system components to introduce a degree of unpredictability into operations are defined. |
| 3.13.2e_ODP[2] | System and Communications Protection | The frequency of changes by system and system components is defined. |
| 3.13.2e[a] | System and Communications Protection | Organizational systems and system components necessitating unpredictability are identified. |
| 3.13.2e[b] | System and Communications Protection | <3.13.2e_ODP[1]: changes> to organizational systems and system components are implemented <3.13.2e_ODP[2]: frequency> to introduce a degree of unpredictability into operations. |
| 3.13.3e_ODP[1] | System and Communications Protection | Technical and procedural means to confuse and mislead adversaries are defined. |
| 3.13.3e[a] | System and Communications Protection | <3.13.3e_ODP[1]: technical and procedural means> are employed to confuse and mislead adversaries. |
| 3.13.4e_ODP[1] | System and Communications Protection | One or more of the following is/are selected: physical isolation techniques; logical isolation techniques. |
| 3.13.4e_ODP[2] | System and Communications Protection | Physical isolation techniques are defined. (If selected in 3.13.4e_ODP[1]) |
| 3.13.4e_ODP[3] | System and Communications Protection | Logical isolation techniques are defined. (If selected in 3.13.4e_ODP[1]) |
| 3.13.4e[a] | System and Communications Protection | <3.13.4e_ODP[2]: physical isolation techniques and/or 3.13.4e_ODP[3] logical isolation techniques> are employed in organizational systems and system components. |
| 3.13.5e_ODP[1] | System and Communications Protection | System functions or resources to distribute and relocate are defined. |
| 3.13.5e_ODP[2] | System and Communications Protection | Frequency to distribute and relocate system functions or resources is defined. |
| 3.13.5e[a] | System and Communications Protection | <3.13.5e_ODP[1]: system functions or resources> are distributed and relocated <3.13.5e_ODP[2]: frequency>. |
| 3.14.1e_ODP[1] | System and Information Integrity | Security critical or essential software is defined. |
| 3.14.1e[a] | System and Information Integrity | Root of trust mechanisms or cryptographic signatures are identified. |
| 3.14.1e[b] | System and Information Integrity | The integrity of <3.14.1e_ODP[1]: security critical or essential software> is verified using root of trust mechanisms or cryptographic signatures. |
| 3.14.2e[a] | System and Information Integrity | Anomalous or suspicious behavior is defined. |
| 3.14.2e[b] | System and Information Integrity | Organizational systems and system components are monitored on an ongoing basis for anomalous or suspicious behavior. |
| 3.14.3e_ODP[1] | System and Information Integrity | Systems and system components included in the scope of the specified enhanced security requirements are identified. |
| 3.14.3e[a] | System and Information Integrity | <3.14.3e_ODP[1]: systems and system components> are included in the scope of the specified enhanced security requirements. |
| 3.14.3e[b] | System and Information Integrity | Systems and system components that are not included in <3.14.3e_ODP[1]: systems and system components> are segregated in purpose-specific networks. |
| 3.14.4e_ODP[1] | System and Information Integrity | Systems and system components to refresh from a known, trusted state are defined. |
| 3.14.4e_ODP[2] | System and Information Integrity | The frequency to refresh systems and systems components is defined. |
| 3.14.4e[a] | System and Information Integrity | A known, trusted state is identified for <3.14.4e_ODP[1]: systems and system components>. |
| 3.14.4e[b] | System and Information Integrity | <3.14.4e_ODP[1]: systems and system components> are refreshed from a known, trusted state |
| 3.14.5e_ODP[1] | System and Information Integrity | The frequency with which to conduct reviews of persistent organizational storage locations is defined. |
| 3.14.5e[a] | System and Information Integrity | Persistent organizational storage locations are identified. |
| 3.14.5e[b] | System and Information Integrity | Reviews of persistent organizational storage locations are conducted <3.14.5e_ODP[1]: frequency> to identify CUI that is no longer needed. |
| 3.14.5e[c] | System and Information Integrity | CUI that is no longer needed is removed. |
| 3.14.6e_ODP[1] | System and Information Integrity | External organizations from which to obtain threat indicator information and effective mitigations are defined. |
| 3.14.6e[a] | System and Information Integrity | Threat indicator information is identified. |
| 3.14.6e[b] | System and Information Integrity | Effective mitigations are identified. |
| 3.14.6e[c] | System and Information Integrity | Intrusion detection approaches are identified. |
| 3.14.6e[d] | System and Information Integrity | Threat hunting activities are identified. |
| 3.14.6e[e] | System and Information Integrity | Threat indicator information and effective mitigations obtained from <3.14.6e_ODP[1]: external organizations> are used to guide and inform intrusion detection and threat hunting. |
| 3.14.7e_ODP[1] | System and Information Integrity | Security critical or essential software components for which to verify correctness are defined. |
| 3.14.7e_ODP[2] | System and Information Integrity | Security critical or essential firmware components for which to verify correctness are defined. |
| 3.14.7e_ODP[3] | System and Information Integrity | Security critical or essential hardware components for which to verify correctness are defined. |
| 3.14.7e_ODP[4] | System and Information Integrity | Verification methods or techniques are defined. |
| 3.14.7e[a] | System and Information Integrity | The correctness of <3.14.7e_ODP[1]: security critical or essential software components> is verified using <3.14.7e_ODP[4]: verification methods or techniques>. |
| 3.14.7e[b] | System and Information Integrity | The correctness of <3.14.7e_ODP[2]: security critical or essential firmware components> is verified using <3.14.7e_ODP[4]: verification methods or techniques>. |
| 3.14.7e[c] | System and Information Integrity | The correctness of <3.14.7e_ODP[3]: security critical or essential hardware components> is verified using <3.14.7e_ODP[4]: verification methods or techniques>. |