audit-labs/control-coverage

  1# NIST SP 800-53 Rev. 5 — Moderate baseline (base controls).
  2#
  3# The base controls selected in the SP 800-53B moderate impact baseline, across
  4# all 18 baseline-applicable families. Control enhancements (e.g. AC-2(1)) are not
  5# enumerated — coverage is measured at the base-control level. The program
  6# management (PM) family is org-wide and not baseline-allocated; the privacy (PT)
  7# family is selected via the separate privacy baseline. A control's full code is
  8# "NIST:<id>".
  9#
 10# COPYRIGHT: NIST SP 800-53 is a U.S. Government work in the public domain. The
 11# control-to-signal mappings, however, are the maintainers' interpretation and
 12# are not reviewed or endorsed by NIST. See ../../MAPPING.md.
 13framework: NIST
 14name: NIST SP 800-53 Rev. 5 (Moderate baseline)
 15version: "Rev. 5"
 16baseline: Moderate
 17coverage: complete
 18source: NIST SP 800-53B Moderate baseline (base controls)
 19controls:
 20  # AC — Access Control
 21  - {id: AC-1, family: "Access Control", title: "Policy and Procedures"}
 22  - {id: AC-2, family: "Access Control", title: "Account Management"}
 23  - {id: AC-3, family: "Access Control", title: "Access Enforcement"}
 24  - {id: AC-4, family: "Access Control", title: "Information Flow Enforcement"}
 25  - {id: AC-5, family: "Access Control", title: "Separation of Duties"}
 26  - {id: AC-6, family: "Access Control", title: "Least Privilege"}
 27  - {id: AC-7, family: "Access Control", title: "Unsuccessful Logon Attempts"}
 28  - {id: AC-8, family: "Access Control", title: "System Use Notification"}
 29  - {id: AC-11, family: "Access Control", title: "Device Lock"}
 30  - {id: AC-12, family: "Access Control", title: "Session Termination"}
 31  - {id: AC-14, family: "Access Control", title: "Permitted Actions Without Identification or Authentication"}
 32  - {id: AC-17, family: "Access Control", title: "Remote Access"}
 33  - {id: AC-18, family: "Access Control", title: "Wireless Access"}
 34  - {id: AC-19, family: "Access Control", title: "Access Control for Mobile Devices"}
 35  - {id: AC-20, family: "Access Control", title: "Use of External Systems"}
 36  - {id: AC-21, family: "Access Control", title: "Information Sharing"}
 37  - {id: AC-22, family: "Access Control", title: "Publicly Accessible Content"}
 38  # AT — Awareness and Training
 39  - {id: AT-1, family: "Awareness and Training", title: "Policy and Procedures"}
 40  - {id: AT-2, family: "Awareness and Training", title: "Literacy Training and Awareness"}
 41  - {id: AT-3, family: "Awareness and Training", title: "Role-Based Training"}
 42  - {id: AT-4, family: "Awareness and Training", title: "Training Records"}
 43  # AU — Audit and Accountability
 44  - {id: AU-1, family: "Audit and Accountability", title: "Policy and Procedures"}
 45  - {id: AU-2, family: "Audit and Accountability", title: "Event Logging"}
 46  - {id: AU-3, family: "Audit and Accountability", title: "Content of Audit Records"}
 47  - {id: AU-4, family: "Audit and Accountability", title: "Audit Log Storage Capacity"}
 48  - {id: AU-5, family: "Audit and Accountability", title: "Response to Audit Logging Process Failures"}
 49  - {id: AU-6, family: "Audit and Accountability", title: "Audit Record Review, Analysis, and Reporting"}
 50  - {id: AU-7, family: "Audit and Accountability", title: "Audit Record Reduction and Report Generation"}
 51  - {id: AU-8, family: "Audit and Accountability", title: "Time Stamps"}
 52  - {id: AU-9, family: "Audit and Accountability", title: "Protection of Audit Information"}
 53  - {id: AU-11, family: "Audit and Accountability", title: "Audit Record Retention"}
 54  - {id: AU-12, family: "Audit and Accountability", title: "Audit Record Generation"}
 55  # CA — Assessment, Authorization, and Monitoring
 56  - {id: CA-1, family: "Assessment, Authorization, and Monitoring", title: "Policy and Procedures"}
 57  - {id: CA-2, family: "Assessment, Authorization, and Monitoring", title: "Control Assessments"}
 58  - {id: CA-3, family: "Assessment, Authorization, and Monitoring", title: "Information Exchange"}
 59  - {id: CA-5, family: "Assessment, Authorization, and Monitoring", title: "Plan of Action and Milestones"}
 60  - {id: CA-6, family: "Assessment, Authorization, and Monitoring", title: "Authorization"}
 61  - {id: CA-7, family: "Assessment, Authorization, and Monitoring", title: "Continuous Monitoring"}
 62  - {id: CA-9, family: "Assessment, Authorization, and Monitoring", title: "Internal System Connections"}
 63  # CM — Configuration Management
 64  - {id: CM-1, family: "Configuration Management", title: "Policy and Procedures"}
 65  - {id: CM-2, family: "Configuration Management", title: "Baseline Configuration"}
 66  - {id: CM-3, family: "Configuration Management", title: "Configuration Change Control"}
 67  - {id: CM-4, family: "Configuration Management", title: "Impact Analyses"}
 68  - {id: CM-5, family: "Configuration Management", title: "Access Restrictions for Change"}
 69  - {id: CM-6, family: "Configuration Management", title: "Configuration Settings"}
 70  - {id: CM-7, family: "Configuration Management", title: "Least Functionality"}
 71  - {id: CM-8, family: "Configuration Management", title: "System Component Inventory"}
 72  - {id: CM-9, family: "Configuration Management", title: "Configuration Management Plan"}
 73  - {id: CM-10, family: "Configuration Management", title: "Software Usage Restrictions"}
 74  - {id: CM-11, family: "Configuration Management", title: "User-Installed Software"}
 75  - {id: CM-12, family: "Configuration Management", title: "Information Location"}
 76  # CP — Contingency Planning
 77  - {id: CP-1, family: "Contingency Planning", title: "Policy and Procedures"}
 78  - {id: CP-2, family: "Contingency Planning", title: "Contingency Plan"}
 79  - {id: CP-3, family: "Contingency Planning", title: "Contingency Training"}
 80  - {id: CP-4, family: "Contingency Planning", title: "Contingency Plan Testing"}
 81  - {id: CP-6, family: "Contingency Planning", title: "Alternate Storage Site"}
 82  - {id: CP-7, family: "Contingency Planning", title: "Alternate Processing Site"}
 83  - {id: CP-8, family: "Contingency Planning", title: "Telecommunications Services"}
 84  - {id: CP-9, family: "Contingency Planning", title: "System Backup"}
 85  - {id: CP-10, family: "Contingency Planning", title: "System Recovery and Reconstitution"}
 86  # IA — Identification and Authentication
 87  - {id: IA-1, family: "Identification and Authentication", title: "Policy and Procedures"}
 88  - {id: IA-2, family: "Identification and Authentication", title: "Identification and Authentication (Organizational Users)"}
 89  - {id: IA-3, family: "Identification and Authentication", title: "Device Identification and Authentication"}
 90  - {id: IA-4, family: "Identification and Authentication", title: "Identifier Management"}
 91  - {id: IA-5, family: "Identification and Authentication", title: "Authenticator Management"}
 92  - {id: IA-6, family: "Identification and Authentication", title: "Authentication Feedback"}
 93  - {id: IA-7, family: "Identification and Authentication", title: "Cryptographic Module Authentication"}
 94  - {id: IA-8, family: "Identification and Authentication", title: "Identification and Authentication (Non-Organizational Users)"}
 95  - {id: IA-11, family: "Identification and Authentication", title: "Re-authentication"}
 96  - {id: IA-12, family: "Identification and Authentication", title: "Identity Proofing"}
 97  # IR — Incident Response
 98  - {id: IR-1, family: "Incident Response", title: "Policy and Procedures"}
 99  - {id: IR-2, family: "Incident Response", title: "Incident Response Training"}
100  - {id: IR-3, family: "Incident Response", title: "Incident Response Testing"}
101  - {id: IR-4, family: "Incident Response", title: "Incident Handling"}
102  - {id: IR-5, family: "Incident Response", title: "Incident Monitoring"}
103  - {id: IR-6, family: "Incident Response", title: "Incident Reporting"}
104  - {id: IR-7, family: "Incident Response", title: "Incident Response Assistance"}
105  - {id: IR-8, family: "Incident Response", title: "Incident Response Plan"}
106  # MA — Maintenance
107  - {id: MA-1, family: "Maintenance", title: "Policy and Procedures"}
108  - {id: MA-2, family: "Maintenance", title: "Controlled Maintenance"}
109  - {id: MA-3, family: "Maintenance", title: "Maintenance Tools"}
110  - {id: MA-4, family: "Maintenance", title: "Nonlocal Maintenance"}
111  - {id: MA-5, family: "Maintenance", title: "Maintenance Personnel"}
112  - {id: MA-6, family: "Maintenance", title: "Timely Maintenance"}
113  # MP — Media Protection
114  - {id: MP-1, family: "Media Protection", title: "Policy and Procedures"}
115  - {id: MP-2, family: "Media Protection", title: "Media Access"}
116  - {id: MP-3, family: "Media Protection", title: "Media Marking"}
117  - {id: MP-4, family: "Media Protection", title: "Media Storage"}
118  - {id: MP-5, family: "Media Protection", title: "Media Transport"}
119  - {id: MP-6, family: "Media Protection", title: "Media Sanitization"}
120  - {id: MP-7, family: "Media Protection", title: "Media Use"}
121  # PE — Physical and Environmental Protection
122  - {id: PE-1, family: "Physical and Environmental Protection", title: "Policy and Procedures"}
123  - {id: PE-2, family: "Physical and Environmental Protection", title: "Physical Access Authorizations"}
124  - {id: PE-3, family: "Physical and Environmental Protection", title: "Physical Access Control"}
125  - {id: PE-4, family: "Physical and Environmental Protection", title: "Access Control for Transmission"}
126  - {id: PE-5, family: "Physical and Environmental Protection", title: "Access Control for Output Devices"}
127  - {id: PE-6, family: "Physical and Environmental Protection", title: "Monitoring Physical Access"}
128  - {id: PE-8, family: "Physical and Environmental Protection", title: "Visitor Access Records"}
129  - {id: PE-9, family: "Physical and Environmental Protection", title: "Power Equipment and Cabling"}
130  - {id: PE-10, family: "Physical and Environmental Protection", title: "Emergency Shutoff"}
131  - {id: PE-11, family: "Physical and Environmental Protection", title: "Emergency Power"}
132  - {id: PE-12, family: "Physical and Environmental Protection", title: "Emergency Lighting"}
133  - {id: PE-13, family: "Physical and Environmental Protection", title: "Fire Protection"}
134  - {id: PE-14, family: "Physical and Environmental Protection", title: "Environmental Controls"}
135  - {id: PE-15, family: "Physical and Environmental Protection", title: "Water Damage Protection"}
136  - {id: PE-16, family: "Physical and Environmental Protection", title: "Delivery and Removal"}
137  - {id: PE-17, family: "Physical and Environmental Protection", title: "Alternate Work Site"}
138  # PL — Planning
139  - {id: PL-1, family: "Planning", title: "Policy and Procedures"}
140  - {id: PL-2, family: "Planning", title: "System Security and Privacy Plans"}
141  - {id: PL-4, family: "Planning", title: "Rules of Behavior"}
142  - {id: PL-8, family: "Planning", title: "Security and Privacy Architectures"}
143  - {id: PL-10, family: "Planning", title: "Baseline Selection"}
144  - {id: PL-11, family: "Planning", title: "Baseline Tailoring"}
145  # PS — Personnel Security
146  - {id: PS-1, family: "Personnel Security", title: "Policy and Procedures"}
147  - {id: PS-2, family: "Personnel Security", title: "Position Risk Designation"}
148  - {id: PS-3, family: "Personnel Security", title: "Personnel Screening"}
149  - {id: PS-4, family: "Personnel Security", title: "Personnel Termination"}
150  - {id: PS-5, family: "Personnel Security", title: "Personnel Transfer"}
151  - {id: PS-6, family: "Personnel Security", title: "Access Agreements"}
152  - {id: PS-7, family: "Personnel Security", title: "External Personnel Security"}
153  - {id: PS-8, family: "Personnel Security", title: "Personnel Sanctions"}
154  - {id: PS-9, family: "Personnel Security", title: "Position Descriptions"}
155  # RA — Risk Assessment
156  - {id: RA-1, family: "Risk Assessment", title: "Policy and Procedures"}
157  - {id: RA-2, family: "Risk Assessment", title: "Security Categorization"}
158  - {id: RA-3, family: "Risk Assessment", title: "Risk Assessment"}
159  - {id: RA-5, family: "Risk Assessment", title: "Vulnerability Monitoring and Scanning"}
160  - {id: RA-7, family: "Risk Assessment", title: "Risk Response"}
161  # SA — System and Services Acquisition
162  - {id: SA-1, family: "System and Services Acquisition", title: "Policy and Procedures"}
163  - {id: SA-2, family: "System and Services Acquisition", title: "Allocation of Resources"}
164  - {id: SA-3, family: "System and Services Acquisition", title: "System Development Life Cycle"}
165  - {id: SA-4, family: "System and Services Acquisition", title: "Acquisition Process"}
166  - {id: SA-5, family: "System and Services Acquisition", title: "System Documentation"}
167  - {id: SA-8, family: "System and Services Acquisition", title: "Security and Privacy Engineering Principles"}
168  - {id: SA-9, family: "System and Services Acquisition", title: "External System Services"}
169  - {id: SA-10, family: "System and Services Acquisition", title: "Developer Configuration Management"}
170  - {id: SA-11, family: "System and Services Acquisition", title: "Developer Testing and Evaluation"}
171  - {id: SA-15, family: "System and Services Acquisition", title: "Development Process, Standards, and Tools"}
172  - {id: SA-22, family: "System and Services Acquisition", title: "Unsupported System Components"}
173  # SC — System and Communications Protection
174  - {id: SC-1, family: "System and Communications Protection", title: "Policy and Procedures"}
175  - {id: SC-2, family: "System and Communications Protection", title: "Separation of System and User Functionality"}
176  - {id: SC-4, family: "System and Communications Protection", title: "Information in Shared System Resources"}
177  - {id: SC-5, family: "System and Communications Protection", title: "Denial-of-Service Protection"}
178  - {id: SC-7, family: "System and Communications Protection", title: "Boundary Protection"}
179  - {id: SC-8, family: "System and Communications Protection", title: "Transmission Confidentiality and Integrity"}
180  - {id: SC-10, family: "System and Communications Protection", title: "Network Disconnect"}
181  - {id: SC-12, family: "System and Communications Protection", title: "Cryptographic Key Establishment and Management"}
182  - {id: SC-13, family: "System and Communications Protection", title: "Cryptographic Protection"}
183  - {id: SC-15, family: "System and Communications Protection", title: "Collaborative Computing Devices and Applications"}
184  - {id: SC-17, family: "System and Communications Protection", title: "Public Key Infrastructure Certificates"}
185  - {id: SC-18, family: "System and Communications Protection", title: "Mobile Code"}
186  - {id: SC-20, family: "System and Communications Protection", title: "Secure Name/Address Resolution Service (Authoritative Source)"}
187  - {id: SC-21, family: "System and Communications Protection", title: "Secure Name/Address Resolution Service (Recursive or Caching Resolver)"}
188  - {id: SC-22, family: "System and Communications Protection", title: "Architecture and Provisioning for Name/Address Resolution Service"}
189  - {id: SC-23, family: "System and Communications Protection", title: "Session Authenticity"}
190  - {id: SC-28, family: "System and Communications Protection", title: "Protection of Information at Rest"}
191  - {id: SC-39, family: "System and Communications Protection", title: "Process Isolation"}
192  # SI — System and Information Integrity
193  - {id: SI-1, family: "System and Information Integrity", title: "Policy and Procedures"}
194  - {id: SI-2, family: "System and Information Integrity", title: "Flaw Remediation"}
195  - {id: SI-3, family: "System and Information Integrity", title: "Malicious Code Protection"}
196  - {id: SI-4, family: "System and Information Integrity", title: "System Monitoring"}
197  - {id: SI-5, family: "System and Information Integrity", title: "Security Alerts, Advisories, and Directives"}
198  - {id: SI-7, family: "System and Information Integrity", title: "Software, Firmware, and Information Integrity"}
199  - {id: SI-8, family: "System and Information Integrity", title: "Spam Protection"}
200  - {id: SI-10, family: "System and Information Integrity", title: "Information Input Validation"}
201  - {id: SI-11, family: "System and Information Integrity", title: "Error Handling"}
202  - {id: SI-12, family: "System and Information Integrity", title: "Information Management and Retention"}
203  - {id: SI-16, family: "System and Information Integrity", title: "Memory Protection"}
204  # SR — Supply Chain Risk Management
205  - {id: SR-1, family: "Supply Chain Risk Management", title: "Policy and Procedures"}
206  - {id: SR-2, family: "Supply Chain Risk Management", title: "Supply Chain Risk Management Plan"}
207  - {id: SR-3, family: "Supply Chain Risk Management", title: "Supply Chain Controls and Processes"}
208  - {id: SR-5, family: "Supply Chain Risk Management", title: "Acquisition Strategies, Tools, and Methods"}
209  - {id: SR-6, family: "Supply Chain Risk Management", title: "Supplier Assessments and Reviews"}
210  - {id: SR-8, family: "Supply Chain Risk Management", title: "Notification Agreements"}
211  - {id: SR-9, family: "Supply Chain Risk Management", title: "Tamper Resistance and Detection"}
212  - {id: SR-10, family: "Supply Chain Risk Management", title: "Inspection of Systems or Components"}
213  - {id: SR-11, family: "Supply Chain Risk Management", title: "Component Authenticity"}
214  - {id: SR-12, family: "Supply Chain Risk Management", title: "Component Disposal"}