extracted_classified_information.json

{
  "AC-1": {
    "control_id": "AC-1",
    "name": "Policy and Procedures",
    "selected": true,
    "justification": "CNSSD No. 504 requires the implementation of standardized access control methodologies (e.g., Identify and Access Management) for classified information. Organizations that process classified information must include appropriate content in their access control policy and procedures.",
    "parameter_value": null,
    "guidance": "The tighter coupling of the identity to a trusted credential will enhance the ability to enforce, control, and manage the access of users on NSS and prevent the threat of a malicious insider inappropriately using another user's credentials in an attempt to obfuscate involvement in the misuse of national security information.",
    "references": "EO 13526, Sec. 4.1, para. (d); CNSSD No. 504."
  },
  "AC-3(2)": {
    "control_id": "AC-3(2)",
    "name": "Access Enforcement | Dual Authorization",
    "selected": true,
    "justification": "CNSSD No. 504 requires the implementation of two-person controls (review and concurrence of a second person) for operations when protection is necessary to prevent significant disruptions and reduce the risk related to insider threats.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13587, Sec 6.1.; CNSSD No. 504."
  },
  "AC-3(4)": {
    "control_id": "AC-3(4)",
    "name": "Access Enforcement | Discretionary Access Controls",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate need-to-know. Discretionary access controls provide a means to reduce the opportunities cleared individuals may have to gain access to information for which they do not have a need-to-know.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a)."
  },
  "AC-5": {
    "control_id": "AC-5",
    "name": "Separation of Duties",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure. CNSSD No. 504 requires the implementation of the separation of duties. Separation of duties provides a means to safeguard the information by reducing the opportunities individuals may have to gain access to information.",
    "parameter_value": null,
    "guidance": "Organizations should separate roles for network or database administration from other sensitive function, such as cryptographic key management, hardware management, removable media data transfer, system security management, or access to particularly sensitive information.",
    "references": "EO 13587, Sec 6.1; CNSSD No. 504."
  },
  "AC-6": {
    "control_id": "AC-6",
    "name": "Least Privilege",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate need-to-know. Implementing least privilege provides a means to reduce the opportunities individuals may have to gain access to information for which they do not have a need-to-know. CNSSD No. 504 requires the implementation of least privilege.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a); CNSSD No. 504."
  },
  "AC-6(7)": {
    "control_id": "AC-6(7)",
    "name": "Least Privilege | Review of User Privileges",
    "selected": true,
    "justification": "CNSSD No. 504 requires the review of all privileged users and ensures they have the appropriate clearances, roles, and scope to perform their duties and make changes as needed.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a); CNSSD No. 504."
  },
  "AC-11": {
    "control_id": "AC-11",
    "name": "Device Lock",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish uniform procedures to ensure systems that store, process, or transmit classified information prevent access by unauthorized persons. Requiring a device lock after a specified period of inactivity helps to prevent unauthorized users from physically using an authorized user's session as a means to gain unauthorized access to classified information.",
    "parameter_value": "a. Prevent further access to the system by initiating a device lock after a period not to exceed 15 minutes of inactivity, requiring the user to initiate a device lock before leaving the system unattended;",
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f).; EO 13587, Sec 5.2, para. (a)."
  },
  "AC-11(1)": {
    "control_id": "AC-11(1)",
    "name": "Device Lock | Pattern-Hiding Displays",
    "selected": true,
    "justification": "Requiring the system to conceal the information previously visible on the display after device lock helps to prevent unauthorized users from viewing an authorized user's display as a means to gain unauthorized access to classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f).; EO 13587, Sec 5.2, para. (a)."
  },
  "AC-16": {
    "control_id": "AC-16",
    "name": "Security and Privacy Attributes",
    "selected": true,
    "justification": "EO 13526 defines classification levels and requires organizations to label classified information to reflect its classification. Labeling refers to internal labels that the software can read, such as fields attached to information that might be used in a CDS or multilevel system, or for message routing.",
    "parameter_value": null,
    "guidance": "For classification and control labeling, the organization determines the permitted attributes and permitted values consistent with the policies applicable to the organization and based on the classification level and related security characteristics of the information stored, processed, or transmitted by the system. (For marking guidance, see MP-3.)",
    "references": "EO 13526, Sec 1.2, para. (a), Sec 1.6, para. (a), and Sec 2.1, para. (a-b)."
  },
  "AC-16(5)": {
    "control_id": "AC-16(5)",
    "name": "Security and Privacy Attributes | Attribute Displays on Objects to",
    "selected": true,
    "justification": "EO 13526 defines classification levels and requires organizations to mark classified information to reflect its classification.",
    "parameter_value": null,
    "guidance": "For classification and control markings, the organization determines the permitted attributes and permitted values consistent with the policies applicable to the organization and based on the classification level and related security characteristics of the information stored, processed, or transmitted by the system.",
    "references": "EO 13526, Sec 1.6, para. (a) and Sec 2.1, para. (a-b)."
  },
  "AC-16(6)": {
    "control_id": "AC-16(6)",
    "name": "Security and Privacy Attributes | Maintenance of Attribute",
    "selected": true,
    "justification": "EO 13526 defines classification levels and requires organizations to mark classified information to reflect its classification.",
    "parameter_value": null,
    "guidance": "For classification and control markings, the organization determines the permitted attributes and permitted values consistent with the policies applicable to the organization and based on the classification level and related security characteristics of the information stored, processed, or transmitted by the system.",
    "references": "EO 13526, Sec 1.6, para. (a) and Sec 2.1, para. (a-b)."
  },
  "AC-16(7)": {
    "control_id": "AC-16(7)",
    "name": "Security and Privacy Attributes | Consistent Attribute",
    "selected": true,
    "justification": "EO 13526 defines classification levels and requires organizations to mark classified information to reflect its classification.",
    "parameter_value": null,
    "guidance": "For classification and control markings, the organization determines the permitted attributes and permitted values consistent with the policies applicable to the organization and based on the classification level and related security characteristics of the information stored, processed, or transmitted by the system.",
    "references": "EO 13526, Sec 1.6, para. (a) and Sec 2.1, para. (a-b)."
  },
  "AC-18": {
    "control_id": "AC-18",
    "name": "Wireless Access",
    "selected": true,
    "justification": "Regardless of whether the organization intends to use wireless access for the system of interest, this control must be selected to ensure the organization defines the limitations on wireless access. Many information technology products are developed to have wireless capabilities. If those wireless capabilities are enabled, either inadvertently or intentionally, there is a risk of unauthorized access to, and exfiltration of, classified information. Selecting these controls does not imply intent to allow wireless access, but instead serves to ensure the organization takes conscious actions to either allow and to establish appropriate restrictions on its use or disallow its use. EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use, or potential for use, of wireless technologies presents unique challenges for protecting classified information; the AC-18 base control and its selected enhancements are needed to address these challenges.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f); (g). EO 13587, Sec 5.2, para. (a)."
  },
  "AC-18(3)": {
    "control_id": "AC-18(3)",
    "name": "Wireless Access | Disable Wireless Networking",
    "selected": true,
    "justification": "Regardless of whether the organization intends to use wireless access for the system of interest, this control must be selected to ensure the organization defines the limitations on wireless access. Many information technology products are developed to have wireless capabilities. If those wireless capabilities are enabled, either inadvertently or intentionally, there is a risk of unauthorized access to, and exfiltration of, classified information. Selecting these controls does not imply intent to allow wireless access, but instead serves to ensure the organization takes conscious actions to either allow and to establish appropriate restrictions on its use or disallow its use. EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use, or potential for use, of wireless technologies presents unique challenges for protecting classified information; the AC-18 base control and its selected enhancements are needed to address these challenges.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f) and (g)."
  },
  "AC-18(4)": {
    "control_id": "AC-18(4)",
    "name": "Wireless Access | Restrict Configurations by Users",
    "selected": true,
    "justification": "Regardless of whether the organization intends to use wireless access for the system of interest, this control must be selected to ensure the organization defines the limitations on wireless access. Many information technology products are developed to have wireless capabilities. If those wireless capabilities are enabled, either inadvertently or intentionally, there is a risk of unauthorized access to, and exfiltration of, classified information. Selecting these controls does not imply intent to allow wireless access, but instead serves to ensure the organization takes conscious actions to either allow and to establish appropriate restrictions on its use or disallow its use. EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use, or potential for use, of wireless technologies presents unique challenges for protecting classified information; the AC-18 base control and its selected enhancements are needed to address these challenges.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f) and (g)."
  },
  "AC-19": {
    "control_id": "AC-19",
    "name": "Access Control for Mobile Devices",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use, or potential for use, of mobile devices presents unique challenges for protecting classified information.",
    "parameter_value": null,
    "guidance": "Regardless of whether the organization intends to use mobile devices as part of the system of interest, these controls must be selected. Advances in mobile technology have led to more powerful, smaller devices. These devices are used by a large percentage of the population and, as a result, unique countermeasures must be developed. Mobile devices may pose a risk of unauthorized access to, and exfiltration of, classified information. Selecting this control does not imply intent to allow mobile devices, but instead serves to ensure the organization takes conscious actions to either allow and to establish appropriate restrictions on their use or disallow their use.",
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a); CNSSP No. 17."
  },
  "AC-19(4)": {
    "control_id": "AC-19(4)",
    "name": "Access Control for Mobile Devices | Restrictions for Classified",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use, or potential for use, of mobile devices presents unique challenges for protecting classified information.",
    "parameter_value": null,
    "guidance": "If the organization intends to allow mobile devices in the same facility as the system of interest, even if not part of the system, this control must be selected.",
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a); CNSSD No. 510; CNSSP No. 17."
  },
  "AC-20": {
    "control_id": "AC-20",
    "name": "Use of External Systems",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use of external systems presents unique challenges for protecting classified information; AC-20 and its enhancements are needed to address these challenges.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "AC-20(1)": {
    "control_id": "AC-20(1)",
    "name": "Use of External Systems | Limits on Authorized Use",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use of external systems present unique challenges for protecting classified information; AC-20 enhancements are needed to address these challenges.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "AC-20(2)": {
    "control_id": "AC-20(2)",
    "name": "Use of External Systems | Portable Storage Devices – Restricted Use",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use of external systems present unique challenges for protecting classified information; AC-20 enhancements are needed to address these challenges.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "AC-20(3)": {
    "control_id": "AC-20(3)",
    "name": "Use of External Systems | Non-Organizationally Owned System –",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use of external systems present unique challenges for protecting classified information; AC-20 enhancements are needed to address these challenges.",
    "parameter_value": null,
    "guidance": "Some organizations may choose to establish trust relationships with other organizations to enable use of non-organizationally owned systems, system components, or devices that process, store, or transmit classified organizational information.  In cases of media devices, the organization should restrict use. The organization should also restrict the use of non-organizationally owned systems, system components, or devices to process, store, or transmit classified information.",
    "references": "EO 13526, Sec 4.1, para. (f) and (g)."
  },
  "AC-20(4)": {
    "control_id": "AC-20(4)",
    "name": "Use of External Systems | Network Accessible Storage Devices –",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use of external systems present unique challenges for protecting classified information; AC-20 enhancements are needed to address these challenges.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "AC-21": {
    "control_id": "AC-21",
    "name": "Information Sharing",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate clearance and need-to-know. Sharing information without conducting due diligence to ensure information products are appropriately marked, the recipients are authorized to access such information, and appropriate protections are in place can result in policy violations.",
    "parameter_value": null,
    "guidance": "Organizations need to define information sensitivity and classification level before sharing information from systems handling classified information. Protections commensurate with information sensitivity and classification level are essential for avoiding potential data spillage.",
    "references": "EO 13526, Sec 4.1."
  },
  "AC-23": {
    "control_id": "AC-23",
    "name": "Data Mining Protection",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure. AC-23 requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining, which can be used by an insider to collect organizational information for the purpose of exfiltration.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13587, Sec. 2.1(b) and Sec 5.2; CNSSD No. 504."
  },
  "AT-2": {
    "control_id": "AT-2",
    "name": "Literacy Awareness Training",
    "selected": true,
    "justification": "EO 13526 requires organizations to provide training on the proper safeguarding of classified information.",
    "parameter_value": "a.1.: As part of initial training for new users and annually for as long as the user has access to the system thereafter; c.: Update literacy training and awareness content at least annually and following [Assignment: organization-defined events];",
    "guidance": "The organization provides training on the proper safeguarding of classified information and on the criminal, civil, and administrative sanctions that may be imposed on an individual who fails to protect classified information from unauthorized disclosure. This training is provided upon granting a person a clearance and at least annually for as long as the user has access to the system.",
    "references": "EO 13526, Sec 4.1, para. (b)."
  },
  "AT-2(2)": {
    "control_id": "AT-2(2)",
    "name": "Literacy Awareness Training | Insider Threat",
    "selected": true,
    "justification": "CNSSD No. 504 requires, as part of an organization’s insider threat program, insider threat awareness training to all cleared employees.",
    "parameter_value": null,
    "guidance": null,
    "references": "CNSSD No. 504."
  },
  "AU-6": {
    "control_id": "AU-6",
    "name": "Audit Record Review, Analysis, and Reporting",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure. CNSSD No. 504 requires agencies to monitor and audit user activity on classified networks.  Reviewing and analyzing audit records support the detection of insider threat activities.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13587, Sec 2.1(b) and Sec 5.2; CNSSD No. 504."
  },
  "AU-6(4)": {
    "control_id": "AU-6(4)",
    "name": "Audit Record Review, Analysis, and Reporting | Central Review and",
    "selected": true,
    "justification": "The White House Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, requires the organization to gather information for centralized analysis, reporting and response.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "White House Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, Tab 2, Sec E.1.; CNSSD No. 504."
  },
  "AU-6(5)": {
    "control_id": "AU-6(5)",
    "name": "Audit Record Review, Analysis, and Reporting | Integrated Analysis",
    "selected": true,
    "justification": "The White House Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, requires the organization to build and maintain an insider threat analytic and response capability to manually and/or electronically gather, integrate, review, assess, and respond to information derived from counterintelligence, security, information assurance, human resources, law enforcement, the monitoring of user activity, and other sources as necessary and appropriate.",
    "parameter_value": "Integrate analysis of audit records with the analysis of vulnerability scanning information, performance data, system monitoring information, counterintelligence, security, cybersecurity, human resources, law enforcement, the monitoring of user activity, and other sources as necessary and appropriate to further enhance the ability to identify inappropriate or unusual activity.",
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "White House Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, Tab 2, Sec E.1; CNSSD No. 504."
  },
  "AU-6(8)": {
    "control_id": "AU-6(8)",
    "name": "Audit Record Review, Analysis, and Reporting | Full Text Analysis",
    "selected": true,
    "justification": "CNSSD No. 504 requires organizations’ insider threat programs to include full text analyses of all privileged user commands.",
    "parameter_value": null,
    "guidance": null,
    "references": "White House Memorandum, National Insider Threat Policy, Tab 1, Sec B.2(1) and Minimum Standards for Executive Branch Insider Threat Programs, Tab 2, Sec H; CNSSD No 504."
  },
  "AU-6(9)": {
    "control_id": "AU-6(9)",
    "name": "Audit Record Review, Analysis, and Reporting | Correlation with",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure. CNSSD No. 504 requires agencies to monitor and audit user activity on classified networks. Correlating audit records support the detection of insider threat activities.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "White House Memorandum, National Insider Threat Policy, Tab 1, Sec B.2(2, 4) and Minimum Standards for Executive Branch Insider Threat Programs, Tab 2, Sec E.1; CNSSD No. 504."
  },
  "AU-12": {
    "control_id": "AU-12",
    "name": "Audit Record Generation",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure. The White House Memorandum, National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs, requires agencies to monitor and audit user activity on classified networks. Generating audit records supports the detection of insider threat activities.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13587, Sec 2.1(b) and Sec 5.2; White House Memorandum, National Insider Threat Policy, Tab 1, Sec B.2(1) and Minimum Standards for Executive Branch Insider Threat Programs, Tab 2, Sec H.1.; CNSSD No. 504."
  },
  "AU-14": {
    "control_id": "AU-14",
    "name": "Session Audit",
    "selected": true,
    "justification": "The White House Memorandum, National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs, requires the capability to capture audit information to detect and mitigate insider threat and requires agencies to monitor and audit user activity on classified networks. This control directly supports the capture of user activities during sessions. Having the capability to generate audit records containing this content is considered a best practice for safeguarding classified information against insider threat.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "White House Memorandum, National Insider Threat Policy, Tab 1, Sec B.2(1) and Minimum Standards for Executive Branch Insider Threat Programs, Tab 2, Sec H.1; CNSSD No. 504."
  },
  "AU-16": {
    "control_id": "AU-16",
    "name": "Cross-Organizational Audit Logging",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure. Coordinating audit information across organizations supports the detection of insider threat activities.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13587, Sec 2.1(b) and Sec 5.2; White House Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, Tab 2, Sec H.1; CNSSD No. 504."
  },
  "AU-16(1)": {
    "control_id": "AU-16(1)",
    "name": "Cross-Organizational Audit Logging | Identity Preservation",
    "selected": true,
    "justification": "Preserving the identities of individuals in cross-organization audit trails facilitates the detection of insider threats on all classified networks.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13587, Sec 2.1(b) and Sec 5.2; White House Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, Tab 2, Sec H.1; CNSSD No. 504."
  },
  "AU-16(2)": {
    "control_id": "AU-16(2)",
    "name": "Cross-Organizational Audit Logging | Sharing of Audit",
    "selected": true,
    "justification": "Providing cross-organizational audit information is required to facilitate the detection and mitigation of insider threats on all classified networks.",
    "parameter_value": "Provide cross-organizational audit information to the organization’s insider threat program at a minimum based on [Assignment: organization-defined cross- organizational sharing agreements].",
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13587, Sec 2.1(b) and Sec 5.2; White House Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, Tab 2, Sec H.1; CNSSD No. 504."
  },
  "CA-3": {
    "control_id": "CA-3",
    "name": "Information Exchange",
    "selected": true,
    "justification": "EO 13526 requires organizations to ensure classified information disseminated outside the executive branch is protected in a manner equivalent to that provided within the executive branch. An Interconnection Security Agreement (ISA) is the appropriate means to convey the expectations for the associated security requirements.",
    "parameter_value": "a. Approve and manage the exchange of information between the system and other systems using interconnection security agreements; c. Review and update the agreements at least annually or as changes to the systems or connections change.",
    "guidance": "For interconnections of systems processing classified information that serve to disseminate classified information outside the executive branch, the organization ensures the protection of the information in a manner equivalent to that provided within the executive branch using an ISA. The organization prohibits the interconnection between classified and unclassified NSS unless using approved technologies (e.g., CDS) (see CDS Overlay for further guidance).",
    "references": "EO 13526, Sec 4.1, para. (e)."
  },
  "CM-3(6)": {
    "control_id": "CM-3(6)",
    "name": "Configuration Change Control | Cryptography Management",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Cryptographic mechanisms are required (per the justification in this overlay for SC-8(1)) to protect the confidentiality of transmitted classified information. Configuration management of the cryptographic mechanisms employed helps to ensure that the required protections remain in effect. Organizations must ensure that cryptographic mechanisms used to provide safeguarding of classified information from unauthorized access or modification are under configuration management.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "CM-5(5)": {
    "control_id": "CM-5(5)",
    "name": "Access Restrictions for Change | Privilege Limitation for Production",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Limiting privileges to change system components reduces the opportunities for insiders to grant access to classified information by unauthorized personnel.",
    "parameter_value": "(b) Review and reevaluate privileges at least quarterly.",
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g)."
  },
  "IA-2": {
    "control_id": "IA-2",
    "name": "Identification and Authentication (Organizational Users)",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, and other unauthorized disclosure. Uniquely identifying and authenticating users limits access to authorized users and is a foundational component of detecting potentially malicious insiders.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13587, Sec 2.1 (b) and Sec 5.2 (a)."
  },
  "IA-2(1)": {
    "control_id": "IA-2(1)",
    "name": "Identification and Authentication (Organizational Users) | Multi-",
    "selected": true,
    "justification": "Per NSM-8, agencies shall implement multifactor authentication and encryption for NSS data-at-rest and data-in-transit. CNSSD No. 504 Annex C requires that agencies implement standardized access control methodologies, specifically multifactor authentication for users with privileged roles.",
    "parameter_value": null,
    "guidance": null,
    "references": "NSM-8 Sec 1(b)(iii); CNSSD No. 504."
  },
  "IA-2(2)": {
    "control_id": "IA-2(2)",
    "name": "Identification and Authentication (Organizational Users) | Multi-",
    "selected": true,
    "justification": "Per NSM-8, agencies shall implement multifactor authentication and encryption for NSS data-at-rest and data-in-transit. CNSSD No. 504 Annex A requires that agencies implement standardized access control methodologies, specifically multifactor authentication.",
    "parameter_value": null,
    "guidance": null,
    "references": "NSM-8 Sec 1(b)(iii); CNSSD No. 504."
  },
  "IA-5(6)": {
    "control_id": "IA-5(6)",
    "name": "Authentication Management | Protection of Authenticators",
    "selected": true,
    "justification": "CNSSP No. 25 requires NSA review and approval of PKI cryptographic components, to include tokens used for accessing Secret-level networks.",
    "parameter_value": null,
    "guidance": "In general, authenticators must be protected commensurate with the highest security classification of information on the system. Organizations should refer to the authoritative guidance to ensure compliance and understand how to appropriately protect authenticators. For hardware smart card-based tokens that users could use on Secret Internet Protocol Router Network (SIPRNet) workstations and still be carried by the user into unclassified spaces, NSA developed criteria that smart cards are required to meet to allow access to Secret data but be considered unclassified when not in use.",
    "references": "CNSSP No. 25."
  },
  "IR-6": {
    "control_id": "IR-6",
    "name": "Incident Reporting",
    "selected": true,
    "justification": "NSM-8 directs the reporting of known or suspected compromise or unauthorized access to NSS (including classified systems) to the National Manager.",
    "parameter_value": "a. Require personnel to report suspected incidents to the organizational incident response capability within 2 hours; and b. Report incident information to the National Manager through the appropriate Federal Cyber Center or other designated central department point of contact (e.g., DoD CERT, IC CERT).",
    "guidance": null,
    "references": "NSM-8, Sec 2(b)."
  },
  "IR-9": {
    "control_id": "IR-9",
    "name": "Information Spillage Response",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. When classified information is spilled, organizations must execute procedures to minimize access to that information by unauthorized persons.",
    "parameter_value": "a. Assigning, at a minimum, information owner, the Information Assurance Manager (IAM)/Information System Security Manager (ISSM), the Activity Security Manager, and the responsible Incident Response Center (IRC) with responsibility for responding to information spills c. Alerting the information owner, the IAM/ISSM, the Activity Security Manager, and the responsible IRC of the information spill using a method of communication not associated with the spill",
    "guidance": "CNSSP No. 18 and CNSSI No. 1001 provide guidance on additional actions that should be take when responding to classified information spills and should be followed when taking corrective action.",
    "references": "EO 13526, Sec 4.1, para. (g).; CNSSP No. 18; CNSSI No. 1001."
  },
  "IR-9(2)": {
    "control_id": "IR-9(2)",
    "name": "Information Spillage Response | Training",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. When classified information is spilled, organizations must execute procedures to minimize access to that information by unauthorized persons.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); CNSSI No. 1001."
  },
  "IR-9(4)": {
    "control_id": "IR-9(4)",
    "name": "Information Spillage Response | Exposure to Unauthorized Personnel",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. When classified information is spilled, organizations must execute procedures to minimize access to that information by unauthorized persons.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13526, Sec 4.1, para. (g); CNSSI No. 1001."
  },
  "MA-3(3)": {
    "control_id": "MA-3(3)",
    "name": "Maintenance Tools | Prevent Unauthorized Removal",
    "selected": true,
    "justification": "EO 13526 prohibits the removal of classified information from official premises without proper authorization. Maintenance tools may contain classified information and their unauthorized removal from the premises may result in the loss of classified information; therefore, the removal of maintenance tools must be appropriately conducted.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (d)."
  },
  "MA-5(1)": {
    "control_id": "MA-5(1)",
    "name": "Maintenance Personnel | Individuals Without Appropriate Access",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. The use of maintenance personnel that lack required clearances or are not U.S. citizens presents challenges for protecting classified information; MA-5(1) is needed to address these challenges.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13526, Sec 4.1, para. (g)."
  },
  "MP-1": {
    "control_id": "MP-1",
    "name": "Policy and Procedures",
    "selected": true,
    "justification": "EO 13526 states that classified information may not be removed from official premises without proper authorization. Organizations that process classified information must include appropriate content in their media protection policy and procedures.",
    "parameter_value": null,
    "guidance": "The organization includes in media protection policy and/or procedures: (i) how authorizations for removing classified information from official premises are determined and documented; (ii) the appropriate means for controlling, protecting and monitoring removal of classified information from official premises; (iii) the appropriate means for transporting classified non-digital media, and classified and unclassified digital media, outside of the organization's controlled areas; and (iv) procedures for identifying areas as controlled vs. uncontrolled.",
    "references": "EO 13526, Sec. 4.1, para. (d); CNSSD No. 504."
  },
  "MP-2": {
    "control_id": "MP-2",
    "name": "Media Access",
    "selected": true,
    "justification": "Media devices are resources that can be used to exfiltrate classified information and access to the devices should be limited to authorized personnel. EO 13526 states that classified information may not be removed from official premises without proper authorization. EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (d); EO 13587, Sec 5.2 and 6.1."
  },
  "MP-3": {
    "control_id": "MP-3",
    "name": "Media Marking",
    "selected": true,
    "justification": "EO 13526 requires organizations to mark classified information to reflect its classification. Marking refers to human readable labels, such as labels on thumb drives. (For labeling guidance, see AC-16.)",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 1.6, para. (a) and Sec 2.1, para. (a) and (b); CNSSP No. 26."
  },
  "MP-4": {
    "control_id": "MP-4",
    "name": "Media Storage",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Physically controlling and securely storing media is necessary to protect the classified information contained within the media.",
    "parameter_value": "a. Physically control and securely store digital and non-digital media containing classified information within an area and/or container approved for processing and storing media based on the classification of the information contained within the media;",
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); CNSSP No. 26."
  },
  "MP-5": {
    "control_id": "MP-5",
    "name": "Media Transport",
    "selected": true,
    "justification": "EO 13526 states that classified information may not be removed from official premises without proper authorization and that it must be stored under conditions that provide adequate protection and prevent access by unauthorized persons. Protection of classified information during transport, which includes maintaining accountability, documenting transport activities, and employing cryptographic measures, is essential to satisfy these requirements. Parameter Value(s): a. Protect and control digital and non-digital media containing classified information during transport outside controlled areas using double-wrapping in opaque enclosures and transport only by personnel with a security clearance for the classification of the media being transported;",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (d) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "MP-5(3)": {
    "control_id": "MP-5(3)",
    "name": "Media Transport | Custodians",
    "selected": true,
    "justification": "EO 13526 states that classified information may not be removed from official premises without proper authorization and that it must be stored under conditions that provide adequate protection and prevent access by unauthorized persons. Protection of classified information during transport, which includes maintaining accountability, documenting transport activities, and employing cryptographic measures, is essential to satisfy these requirements.",
    "parameter_value": null,
    "guidance": "The organization employs an identified custodian during transport of classified system media outside of controlled areas.",
    "references": "EO 13526, Sec 4.1, para. (d), (e), (f), and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "MP-6": {
    "control_id": "MP-6",
    "name": "Media Sanitization",
    "selected": true,
    "justification": "EO 13526 states that all classified information must be destroyed under conditions that provide adequate protection and prevent access by unauthorized personnel. Sanitization and the verification of destruction of all types of media, physical and digital, helps to meet this requirement.",
    "parameter_value": "a. Sanitize all classified media prior to disposal, release out of organizational control, or release for reuse using approved sanitization techniques and procedures in accordance with applicable federal and organizational standards and policies;",
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "MP-6(1)": {
    "control_id": "MP-6(1)",
    "name": "Media Sanitization | Review, Approve, Track, Document, and Verify",
    "selected": true,
    "justification": "EO 13526 states that all classified information must be destroyed under conditions that provide adequate protection and prevent access by unauthorized personnel. Sanitization and the verification of destruction of all types of media, physical and digital, helps to meet this requirement.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "MP-6(2)": {
    "control_id": "MP-6(2)",
    "name": "Media Sanitization | Equipment Testing",
    "selected": true,
    "justification": "EO 13526 states that all classified information must be destroyed under conditions that provide adequate protection and prevent access by unauthorized personnel. Sanitization and the verification of destruction of all types of media, physical and digital, helps to meet this requirement.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "MP-6(3)": {
    "control_id": "MP-6(3)",
    "name": "Media Sanitization | Nondestructive Techniques",
    "selected": true,
    "justification": "EO 13526 states that all classified information must be destroyed under conditions that provide adequate protection and prevent access by unauthorized personnel. Sanitization and the verification of destruction of all types of media, physical and digital, helps to meet this requirement.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "MP-7": {
    "control_id": "MP-7",
    "name": "Media Use",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Removable media provides a means for personnel to move classified data from official premises without proper authorization, and then in turn provide the classified information to unauthorized personnel. Restricting the use of removable media on systems that store, process or transmit classified information decreases the opportunities for unauthorized disclosure of classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (d); EO 13587, Sec 2.1(b) and Sec 5.2."
  },
  "MP-8": {
    "control_id": "MP-8",
    "name": "Media Downgrading",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Classified information must be removed from media so that the classified information cannot be retrieved or reconstructed.",
    "parameter_value": null,
    "guidance": "An alternative to downgrading is to replicate the unclassified or lower classified information to media that is designated for the classification level.",
    "references": "EO 13526, Sec. 4.1, para. (g); EO 13587, Sec 5.2, para (a)."
  },
  "MP-8(1)": {
    "control_id": "MP-8(1)",
    "name": "Media Downgrading | Documentation of Process",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Classified information must be removed from media so that the classified information cannot be retrieved or reconstructed.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "MP-8(2)": {
    "control_id": "MP-8(2)",
    "name": "Media Downgrading | Equipment Testing",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Classified information must be removed from media so that the classified information cannot be retrieved or reconstructed.",
    "parameter_value": null,
    "guidance": "Testing of sanitization equipment and procedures should be conducted by qualified and authorized entities. Parameter Value(s): Test downgrading equipment and procedures at least annually to ensure that downgrading actions being achieved.",
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "MP-8(4)": {
    "control_id": "MP-8(4)",
    "name": "Media Downgrading | Classified Information",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Classified information must be removed from media so that the classified information cannot be retrieved or reconstructed.",
    "parameter_value": null,
    "guidance": "Downgrading of classified information requires use of approved sanitization tools, techniques, and procedures to ensure only confirmed unclassified information is moved from a classified system to unclassified media.",
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "PE-2(3)": {
    "control_id": "PE-2(3)",
    "name": "Physical Access Authorizations | Restrict Unescorted Access",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Restricting unescorted access is necessary to protect the classified information contained within the facility.",
    "parameter_value": null,
    "guidance": "Organizations manage their facilities and provide adequate protections to ensure personnel do not have unescorted access to areas operating at classification levels higher than the clearance they have been granted. The organization may provide additional guidance to address their mission needs for areas within facilities or systems with components operating at different classification levels. Parameter Value(s): Restrict unescorted access to the facility where the system resides to personnel with security clearances for all information contained within the system.",
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "PE-3(2)": {
    "control_id": "PE-3(2)",
    "name": "Physical Access Control | Facility and Systems",
    "selected": true,
    "justification": "EO 13526 states that information may not be removed from official premises without proper authorization. Conducting security checks at random or a pre-defined frequency helps mitigate the risk of unauthorized removal of classified materials.",
    "parameter_value": null,
    "guidance": "The organization monitors for unauthorized exfiltration of classified information.",
    "references": "EO 13526, Sec. 4.1, para. (d)."
  },
  "PE-3(3)": {
    "control_id": "PE-3(3)",
    "name": "Physical Access Control | Continuous Guards",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Employing guards or alarms at each access point helps mitigate the risk of authorized removal of classified material.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "PE-4": {
    "control_id": "PE-4",
    "name": "Access Control for Transmission",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Physically controlling the access to distribution and transmission lines helps mitigate the risk of unauthorized access to classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "PE-19": {
    "control_id": "PE-19",
    "name": "Information Leakage",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while stored, processed, or when transmitted. Information leakage through electromagnetic signals must be protected against to ensure the confidentiality of the classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "PE-19(1)": {
    "control_id": "PE-19(1)",
    "name": "Information Leakage | National Emissions Policies and Procedures",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while stored, processed, or when transmitted. Information leakage through electromagnetic signals must be protected against to ensure the confidentiality of the classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "PE-22": {
    "control_id": "PE-22",
    "name": "Component Marking",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Marking hardware components to indicate the classification level of information permitted to be processed, stored, or transmitted by the hardware component(s) is an organizational procedure that serves to remind users that classified information of the specified level exists within the system. Users should, as a result, be more aware and ready to guard against access to hardware components by uncleared personnel passing through the facility. Parameter Value(s): Mark all system hardware components in facilities containing systems that process, store, or transmit classified information indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "PM-12": {
    "control_id": "PM-12",
    "name": "Insider Threat Program",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13587, Sec. 2.1(b) and Sec 5.2; CNSSD No. 504."
  },
  "PS-3(1)": {
    "control_id": "PS-3(1)",
    "name": "Personnel Screening | Classified Information",
    "selected": true,
    "justification": "EO 13526 states that all personnel that have access to classified information must be cleared through a determination of eligibility, NDA, and have the appropriate need to know for the information.",
    "parameter_value": null,
    "guidance": "The agency head or agency head's designee must make a favorable determination that the person is eligible for access for information at classification levels up to and including the level specified in the clearance.",
    "references": "EO 13526, Sec. 4.1, para. (a) and (b); EO 13587, Sec 5.2, para. (a)."
  },
  "PS-4": {
    "control_id": "PS-4",
    "name": "Personnel Termination",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate clearance and need to know. After an individual ceases to be employed by the organization, they no longer have a need to access classified information and may not remove any classified information from an agency pursuant to the EO. Employees need to be reminded of these and other organizational requirements as part of the termination process to protect the confidentiality of classified information.",
    "parameter_value": "Upon termination of individual employment: a. Disable system access within a time period as soon as possible but not to exceed 5 working days if termination is voluntary; if termination is involuntary, within same day as termination. c. Conduct exit interviews that include a discussion of: (i) prohibitions against the removal of classified information from the organization's control and (ii) the direction that information be declassified in order to remove it from the organization's control.12",
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13526, Sec. 4.1, para. (c)."
  },
  "PS-4(1)": {
    "control_id": "PS-4(1)",
    "name": "Personnel Termination | Post-Employment Requirements",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate clearance and need to know. After an individual ceases to be employed by the organization, they no longer have a need to access classified information and may not remove any classified information from an agency pursuant to the EO. Employees need to be reminded of these and other organizational requirements as part of the termination process to protect the confidentiality of classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (c)."
  },
  "PS-6(2)": {
    "control_id": "PS-6(2)",
    "name": "Access Agreements | Classified Information Requiring Special",
    "selected": true,
    "justification": "EO 13526 states that all personnel that have access to classified information must be cleared through a determination of eligibility, NDA, and have the appropriate need-to-know for the information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (a)."
  },
  "PS-6(3)": {
    "control_id": "PS-6(3)",
    "name": "Access Agreements | Post-Employment Requirements",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate clearance and need-to-know. After an individual ceases to be employed by the organization, they may no longer have a need to access classified information and may not remove any classified information from an agency pursuant to the EO. Employees need to be reminded of these and other organizational requirements as part of the termination process to protect the confidentiality of classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a) and (c). 12 The intent of this specification is to ensure this information security topic is covered in the exit interview, not to exclude other topics from also being covered."
  },
  "PS-9": {
    "control_id": "PS-9",
    "name": "Position Descriptions",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate clearance and need-to-know.",
    "parameter_value": null,
    "guidance": "Organizations should ensure that individual organizational roles and position descriptions clearly document and provide understanding regarding security or privacy responsibilities associated with the roles, as well as the role-based security and privacy training requirements for the roles. This should include roles and training for roles that require appropriate clearances and need-to-know.",
    "references": "EO 13526, Sec 4.1 para (a); EO 13764, Sec 1 para (a)."
  },
  "RA-3(2)": {
    "control_id": "RA-3(2)",
    "name": "Risk Assessment | Use of All-Source Intelligence",
    "selected": true,
    "justification": "Organizations need to identify protections commensurate with an information’s classification when developing agreements to share all-source intelligence information or resulting decisions with other organizations to assist in the analysis of risk.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (f) and (g)."
  },
  "RA-5": {
    "control_id": "RA-5",
    "name": "Vulnerability Monitoring and Scanning",
    "selected": true,
    "justification": "Classified information may be more appealing to adversaries, who would want to take advantage of any vulnerabilities of a system that has classified information on it. Organizations with classified information on their systems should ensure vulnerability monitoring and scanning is implemented for its system components, ensuring that the potential sources of vulnerabilities—such as infrastructure components (e.g., switches, routers, firewalls, sensors), networked printers, scanners, and copiers— are not overlooked. This will allow organizations to ensure that any new vulnerabilities to systems that process, store, or transmit classified information are identified, mitigated, and reported as quickly as possible.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (f) and (g)."
  },
  "RA-6": {
    "control_id": "RA-6",
    "name": "Technical Surveillance Countermeasures Survey",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate clearance and need-to-know. Many information technology products are vulnerable to inadvertent, or intentional, surveillance actions and need to be countered to prevent information leakage to unauthorized personnel. This control serves to ensure the organization takes conscious actions to minimize the technical surveillance risk and protect the confidentiality of classified information.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13526, Sec 4.1, para. (a), (f), and (g)."
  },
  "RA-10": {
    "control_id": "RA-10",
    "name": "Threat Hunting",
    "selected": true,
    "justification": "NSM-8 invokes EO 14028, which, in Section 7(b) requires deployment of an Endpoint Detection and Response (EDR) initiative to support proactive detection of cybersecurity incidents within Federal Government infrastructure, active cyber hunting, containment and remediation, and incident response.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "NSM-8, Sec 1(e)."
  },
  "SA-3(2)": {
    "control_id": "SA-3(2)",
    "name": "System Development Life Cycle | Use of Live or Operational Data",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while stored, processed, or when transmitted. When used in test environments, live data must be protected to preserve authorized restrictions on information access. The use of live data in a test environment does not change its classification.",
    "parameter_value": null,
    "guidance": "Classified information can only be used in test and simulation environments that are at least at the same classification level as the data.",
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "SA-4(6)": {
    "control_id": "SA-4(6)",
    "name": "Acquisition Process | Use of Information Assurance Products",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while stored, processed, or when transmitted. The use of an NSA-approved cryptographic solution (e.g., Commercial Solutions for Classified program) protects the transmission of classified information when the network transmitting the information is at a lower classification level.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (f) and (g); CNSSP No. 11."
  },
  "SC-2": {
    "control_id": "SC-2",
    "name": "Separation of System and User Functionality",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate need-to-know. Application partitioning provides a means to reduce the opportunities individuals may have to gain access to information for which they do not have a need-to-know.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a)."
  },
  "SC-3": {
    "control_id": "SC-3",
    "name": "Security Function Isolation",
    "selected": true,
    "justification": "EO 13526 requires that classified information be accessible only to those with the appropriate need-to-know. Security function isolation provides a means to reduce the opportunities cleared individuals may have to gain access to information for which they do not have a need-to-know.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a)."
  },
  "SC-7(26)": {
    "control_id": "SC-7(26)",
    "name": "Boundary Protection | Classified National Security System",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to provide adequate protection of classified information while stored, processed, or when transmitted and to prevent access by unauthorized persons to classified information. Organizations may not have control over external networks; therefore, the interconnection of a system to an external network presents unique challenges for protecting classified information. An appropriate boundary protection device is needed to address these challenges. For interconnections of NSS operating at different classification levels, refer to the CDS Overlay.",
    "parameter_value": "Prohibit the direct connection of a classified national security system to an external network without the use of an appropriate boundary protection device.",
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2, para. (a)."
  },
  "SC-8": {
    "control_id": "SC-8",
    "name": "Transmission Confidentiality and Integrity",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while in transmission to ensure the integrity of the information and provide adequate protection from unauthorized access. Per NSM-8, organizations are required to implement encryption for data-at-rest and data-in-transit.",
    "parameter_value": "Protect the confidentiality and integrity of transmitted information.",
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a), (f) and (g); EO 13587, Sec 5.2, para. (a); NSM-8, Sec 1(b)(iii)."
  },
  "SC-8(1)": {
    "control_id": "SC-8(1)",
    "name": "Transmission Confidentiality and Integrity | Cryptographic",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while it is in transmission to ensure the integrity of the information and provide adequate protection from unauthorized access. Classified information in transmission must be protected via cryptography as required by CNSSP No. 15. Per NSM-8, organizations are required to implement encryption for data-at-rest and data-in-transit.",
    "parameter_value": "Implement cryptographic mechanisms to prevent unauthorized disclosure of classified information and detect changes to information during transmission.",
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a), (f) and (g); EO 13587, Sec 5.2, para. (a); NSM-8 Sec 1(b)(iii); CNSSP No. 15; NSM-8, Sec 1(b)(iii)."
  },
  "SC-8(3)": {
    "control_id": "SC-8(3)",
    "name": "Transmission Confidentiality and Integrity | Cryptographic",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while it is in transmission to ensure the integrity of the information and provide adequate protection from unauthorized access. Classified information in transmission must be protected via cryptography as required by CNSSP No. 15. Per NSM-8, organizations are required to implement encryption for data-at-rest and data-in-transit.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a), (f) and (g); EO 13587, Sec 5.2, para. (a); CNSSP No. 15; NSM-8, Sec 1(b)(iii)."
  },
  "SC-8(4)": {
    "control_id": "SC-8(4)",
    "name": "Transmission Confidentiality and Integrity | Conceal or Randomize",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while it is in transmission to ensure the integrity of the information and provide adequate protection from unauthorized access. Classified information in transmission must be protected via cryptography as required by CNSSP No. 15.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (a), (f) and (g); EO 13587, Sec 5.2, para. (a); CNSSP No. 15."
  },
  "SC-12": {
    "control_id": "SC-12",
    "name": "Cryptographic Key Establishment and Management",
    "selected": true,
    "justification": "CNSSP No. 15 requires the use of NSA-approved cryptography to protect NSS and the information that resides in the system.  Per NSM-8, organizations are required to implement encryption for data-at-rest and data-in-transit.",
    "parameter_value": "Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: for classified NSS, employ NSA-approved cryptographic guidance addressing processes/requirements for key generation, distribution, storage, access, and destruction.",
    "guidance": "NSM-8 requires all organizations use NSA-approved, public-standards-based cryptographic protocols to ensure widespread cryptographic interoperability among NSS. If mission-unique requirements preclude the use of public standards-based cryptographic protocols, NSA-approved mission unique protocols may be used. This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "NSM-8 Sec 1 (b) (iv); CNSSP No. 15."
  },
  "SC-12(2)": {
    "control_id": "SC-12(2)",
    "name": "Cryptographic Key Establishment and Management | Symmetric",
    "selected": true,
    "justification": "CNSSP No. 15 requires the use of NSA-approved cryptography to protect NSS and the information that resides in the system. Per NSM-8, organizations are required to implement encryption for data-at-rest and data-in-transit.",
    "parameter_value": "Produce, control, and distribute symmetric cryptographic keys using NSA-approved key management technology and processes.",
    "guidance": null,
    "references": "NSM-8 Sec 1 (b) (iv); CNSSP No. 15."
  },
  "SC-12(3)": {
    "control_id": "SC-12(3)",
    "name": "Cryptographic Key Establishment and Management | Asymmetric",
    "selected": true,
    "justification": "CNSSP 15 requires the use of NSA-approved cryptography to protect NSS and the information that resides in the system. Per NSM-8, organizations are required to implement encryption for data-at-rest and data-in-transit.",
    "parameter_value": "Produce, control, and distribute asymmetric cryptographic keys using NSA-approved key management technology and processes.",
    "guidance": "CNSSP No. 25 requires that NSS operating at the Secret level obtain PKI support from the NSS-PKI.",
    "references": "NSM-8 Sec 1 (b) (iv); CNSSP No. 15; CNSSP No. 25."
  },
  "SC-13": {
    "control_id": "SC-13",
    "name": "Cryptographic Protection",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while stored, processed, or when transmitted. This applies to the use of an NSA-approved solution to protect classified information transmitted when the network transmitting the information is at a lower classification level.",
    "parameter_value": "b. Implement the following types of cryptography required for each specified cryptographic use: NSA-approved cryptography for protecting classified information from access by personnel who lack the necessary security clearance.",
    "guidance": null,
    "references": "EO 13526, Sec. 4.1, para. (f) and (g); CNSSP No. 15."
  },
  "SC-15(3)": {
    "control_id": "SC-15(3)",
    "name": "Collaborative Computing Devices and Applications | Disabling and",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while in use and when transmitted to provide adequate protection and prevent access by unauthorized persons.  Use of collaborative computing devices in unauthorized locations represents an unacceptable risk of disclosure of classified information to unauthorized persons.",
    "parameter_value": null,
    "guidance": "Collaborative devices have an aspect of trust associated with their use (e.g., it is hard to verify how many people are listening through one connection). In secure work areas, it is necessary to verify that all personnel have valid authorizations to access classified information and to disable or remove collaborative devices that are at a lower classification level than the secure work area. Disabling lower classification collaborative devices is necessary to prevent unauthorized access to classified information (e.g., through eavesdropping).",
    "references": "EO 13526, Sec 4.1, para. (a) and (f)."
  },
  "SC-28": {
    "control_id": "SC-28",
    "name": "Protection of Information at Rest",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while stored to prevent access by unauthorized persons and to ensure the integrity of the information. Cryptography provides protections for the confidentiality and integrity of information in storage. Per NSM-8, organizations are required to implement encryption for data-at-rest and data-in-transit.",
    "parameter_value": "Protect the confidentiality and integrity of the following information at rest: classified information at rest.",
    "guidance": "The organization, in accordance with law, Executive Orders, and policy, determines the protection needs for the confidentiality of the information, including who has access to the information and the appropriate means for its protection.",
    "references": "EO 13526, Sec 4.1, para. (f); EO 13587, Sec 5.2, para. (a); NSM-8 Sec 1 (b) (iii)."
  },
  "SC-28(1)": {
    "control_id": "SC-28(1)",
    "name": "Protection of Information at Rest | Cryptographic Protection",
    "selected": true,
    "justification": "EO 13526 directs the safeguarding of classified information while stored to prevent access by unauthorized persons and to ensure the integrity of the information. Cryptography provides protections for the confidentiality and integrity of information in storage. Per NSM-8, organizations are required to implement encryption for data-at-rest and data-in-transit.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a); NSM-8 Sec 1(b)(iii)."
  },
  "SC-41": {
    "control_id": "SC-41",
    "name": "Port and I/O Device Access",
    "selected": true,
    "justification": "CNSSD No. 504 requires the implementation of trusted network connection restrictions to prevent malicious users from exploiting known vulnerabilities of hard-linking to areas outside of their authorized access, Injecting code, and covering their activities. This control supports holistic endpoint security requirements.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (f) and (g); CNSSD No. 504."
  },
  "SC-42": {
    "control_id": "SC-42",
    "name": "Sensor Capability and Data",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, and other unauthorized disclosure. Prohibiting the remote activation of devices with sensor capabilities in all areas where classified information is stored, processed, transmitted, or discussed is considered a best practice for safeguarding classified information.",
    "parameter_value": null,
    "guidance": "The organization may define exceptions to allow remote activation of sensor capabilities such as secure VTC, provided that the sensor capabilities are designed, configured, and operated securely. Organizations may designate some areas acceptable for temporary storage, processing, transmission, or discussion of classified information; however, during the periods when classified information is not being stored, processed, transmitted or discussed, the organization may allow remote activation of devices with sensor capabilities in those areas. This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a)."
  },
  "SI-4(14)": {
    "control_id": "SI-4(14)",
    "name": "System Monitoring | Wireless Intrusion Detection",
    "selected": true,
    "justification": "EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, and other unauthorized disclosure. Monitoring wireless networks for unauthorized use is necessary to protect classified information as it identifies unsanctioned connections and potential information leaks.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec 5.2, para. (a); CNSSP No. 17."
  },
  "SI-4(19)": {
    "control_id": "SI-4(19)",
    "name": "System Monitoring | Risk for Individuals",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Monitoring people that may pose greater risk or are in a probationary period is pertinent to verifying that these people continue to be qualified to access classified information.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13526, Sec 4.1, para. (a) and (b)."
  },
  "SI-4(21)": {
    "control_id": "SI-4(21)",
    "name": "System Monitoring | Probationary Periods",
    "selected": true,
    "justification": "EO 13526 requires organizations to establish procedures and controls to prevent access by unauthorized persons to classified information. Monitoring people that may pose greater risk or are in a probationary period is pertinent to verifying that these people continue to be qualified to access classified information.",
    "parameter_value": null,
    "guidance": "This control has been identified as having privacy implementation considerations (see Table 1).",
    "references": "EO 13526, Sec 4.1, para. (a) and (b)."
  },
  "SR-3": {
    "control_id": "SR-3",
    "name": "Supply Chain Controls and Processes",
    "selected": true,
    "justification": "EO 13873 requires the USG to protect against supply chain risks from foreign adversaries, reducing the probability of adversaries successfully identifying and targeting the supply chain, and limiting harm that can be done by unauthorized persons to classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13873 Sec. 1.a.; EO 14032; CNSSD No. 505."
  },
  "SR-3(2)": {
    "control_id": "SR-3(2)",
    "name": "Supply Chain Controls and Processes | Limitation of Harm",
    "selected": true,
    "justification": "EO 13873 requires the USG to protect against supply chain risks from foreign adversaries, reducing the probability of adversaries successfully identifying and targeting the supply chain, and limiting harm that can be done by unauthorized persons to classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13873 Sec. 1.a.; CNSSD No. 505."
  },
  "SR-4": {
    "control_id": "SR-4",
    "name": "Provenance",
    "selected": true,
    "justification": "EO 13873 requires the USG to protect against supply chain risks from foreign adversaries, reducing the probability of adversaries successfully identifying and targeting the supply chain, and limiting harm that can be done by unauthorized persons to classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13873 Sec. 1.a.; EO 14032; CNSSD No. 505."
  },
  "SR-7": {
    "control_id": "SR-7",
    "name": "Supply Chain Operations Security",
    "selected": true,
    "justification": "EO 13873 requires continual assessment of threats to the United States from information and communications technology or services designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary. Operational Security (OPSEC) controls support organizational ability to conduct such assessment as part of protecting their supply chains and preventing unauthorized persons access to classified information.",
    "parameter_value": null,
    "guidance": null,
    "references": "EO 13873 Sec. 5; CNSSD No. 505."
  },
  "SR-12": {
    "control_id": "SR-12",
    "name": "Component Disposal",
    "selected": true,
    "justification": "EO 13526 states that all classified information must be destroyed under conditions that provide adequate protection and prevent access by unauthorized personnel. Sanitization and the verification of destruction of all types of media, physical and digital, helps to meet this requirement. Proper disposal is required to prevent unauthorized reuse.",
    "parameter_value": "Dispose of all digital and non-digital system media containing classified information using the following techniques and methods: approved methods in accordance with the classification of the information processed.",
    "guidance": null,
    "references": "EO 13526, Sec 4.1, para. (g); CNSSD No. 505."
  }
}