{"text_format":"3","workbook":"xls","n_sheets":9,"sheets":["READ ME","Full Assessment Plan","Assmnt Pln-Phys Transport","Interview - Transport","Examine - Transport","Assmt Plan-Remote Access","Interview - Remote Access","Examine - Remote Access","Test - Remote Access"],"not_rendered":{"external_links":1,"defined_names":8},"read":"whole","date_system":"1900","formulas":"cached_only"}

{"sheet":"READ ME","index":0,"n_rows":14,"n_cols":1,"rows_kept":14,"flags":["formulas_cached_only"]}
["Using the OMB M-06-16 Checklist Privacy Controls Assessment Template"]
["Worksheet Tabs included:"]
["     -- Full Assessment Plan: Incorporates all NIST SP 800-53 controls and associated draft NIST SP 800-53a (spd 4/2006) assessment procedures for Moderate and High-impact systems required by the Security Controls and Assessment Procedures section of the Checklist attachment to M-06-16."]
["     --Assessment Plan-Physical Transport:  Includes sections of the Full Assessment Plan associated with the offsite physical transport of PII (Checklist Steps 1, 2, and 3 only)."]
["          ---Interview-Transport:  Interview procedures extract from the Physical Transport Assessment Plan."]
["          ---Examine-Transport:  Examination procedures extract from the Physical Transport Assessment Plan."]
["     --Assessment Plan-Remote Access:  Includes sections of the Full Assessment Plan associated with remote access to PII (Checklist Steps 1, 2, and 4 only)."]
["          ---Interview-Remote Access:  Interview procedures extract from the Remote Access Assessment Plan."]
["          ---Examine-Remote Access:  Examination procedures extract from the Remote Access Assessment Plan."]
["1.  Establish a Baseline Assessment Plan for your Organization.  The Full Assessment Plan can be used as the baseline for your Assessment Plans; or you may use either the Physical Transport plan or the Remote Access plan if only that plan applies to your organization's needs -- depending on the path indicated by the Checklist decision points -- and modify the baseline template to fit your agency's needs to ensure consistency throughout your agency when implemented.  NOTE that for Step 4 of the checklist, you may need to add control families and associated assessment procedures to address specific technology pertaining to the system."]
["2.  Develop Common Controls Assessment Plans.  From your full baseline assessment plan, develop an Assessment Plan that addresses the Common Controls within your organization by extracting the rows for the controls that apply organization-wide.  These are assessed once for the entire environment to which the common control applies.  NOTE that large agencies may have Department-level common control policies and procedures, and each component may have supplemental policies and procedures that apply to their systems and practices; therefore, you may require a Department-level common controls assessment plan as well as component-specific common controls assessment plans.  "]
["3.  Develop System/Activity-Specific Assessment Plans.   After extracting the common control procedures from the baseline Assessment Plan, develop assessment plans for physical transportation of information and/or for remote access to each system allowing access to PII from the remaining procedures.  These plans may vary in that they are specific to each system and to the organization allowing remote access to or physical transportation of data.  They can also be tailored to eliminate duplication of assessment procedures conducted for the Common Controls."]
["4.  Consolidate Assessment Procedures with Similar Characteristics.  From the Assessment Plan, you can now extract the procedures and sort them by assessment method or search for key words to help group procedures.   For example, this template has already provided you with tabs for Interview, Examine, and Test procedures.  The Interview tab, easily imported into an MSWord document or left in MSExcel, could now be used as a structured interview questionnaire.  NOTE that some procedures contain multiple assessment methods to execute the procedure (such as \"Interview... and examine...\").  When adding procedures be sure to watch for this."]
["5.  Execute the Assessment Procedures and Document Results.  The Template provides space for recording of summary information from execution of the assessment procedure, such as steps taken to perform the procedure, identify personnel interviewed, identify documents examined by title and date, briefly summarize the result and reference mitigation action necessary, and identify the assessor's name and date the procedure was assessed.  NOTE that the full explanation of steps taken and results of the assessment will likely not fit in the capacity for the cell in the MSExcel spreadsheet. In these instances, simply include a reference to a supporting document (such as \"See Interview #1, system X, dated 7/20/2006 for details. Corrective action is needed to improve procedures in this area--see system-level POA&M.\") "]

{"sheet":"Full Assessment Plan","index":1,"n_rows":181,"n_cols":10,"rows_kept":181,"merged":[[0,0,0,9],[1,0,1,9],[3,0,3,9],[4,0,4,9],[5,0,13,0],[5,1,8,1],[5,2,8,2],[9,1,13,1],[9,2,13,2],[14,0,14,9],[15,0,19,0],[15,1,19,1],[15,2,19,2],[20,0,20,9],[21,0,21,9],[22,0,23,0],[22,1,23,1],[22,2,23,2],[24,0,24,9],[25,0,66,0],[25,1,31,1],[25,2,31,2],[32,1,38,1],[32,2,38,2],[39,1,45,1],[39,2,45,2],[46,1,52,1],[46,2,52,2],[53,1,59,1],[53,2,59,2],[60,1,66,1],[60,2,66,2],[67,0,67,9],[68,0,68,9],[69,0,77,0],[69,1,73,1],[69,2,73,2],[74,1,77,1],[74,2,77,2],[78,0,78,9],[79,0,90,0],[79,1,85,1],[79,2,85,2],[86,1,89,1],[86,2,89,2],[90,2,90,9],[91,0,91,9],[92,0,92,9],[93,0,117,0],[93,1,108,1],[93,2,108,2],[109,1,117,1],[109,2,117,2],[118,0,118,9],[119,0,159,0],[119,1,127,1],[119,2,127,2],[128,1,132,1],[128,2,132,2],[133,1,138,1],[133,2,138,2],[139,1,147,1],[139,2,147,2],[148,1,152,1],[148,2,152,2],[153,1,159,1],[153,2,159,2],[160,0,160,9],[161,0,163,0],[161,2,161,9],[162,2,162,9],[163,2,163,9],[164,0,164,9],[165,0,178,0],[165,2,165,9],[166,2,166,9],[167,2,167,9],[168,2,168,9],[169,2,169,9],[170,1,174,1],[170,2,174,2],[175,2,175,9],[176,2,176,9],[177,2,177,9],[178,2,178,9],[180,0,180,9]],"flags":["formulas_cached_only"]}
["OMB M-06-16 Security Assessment Plan "]
["For System: xxxxxxxxxxxxxxxxxxxxxxxx"]
["Procedure from OMB M-06-16 Checklist","NIST SP 800-53 Control Identifier","NIST SP 800-53 Control","NIST SP 800-53A Assessment Identifier","Moderate-impact system applicable","High-impact system applicable","NIST SP 800-53A Assessment Procedural Statements (Examine, Interview, Test)","Fully Satisfied (FS), Partially Satisfied (PS), Not Satisfied (NS)","Additional Test Steps/Summary Comment for Test Results and Mitigation Requirements/POAM (include references to other supporting documentation)","Assessment Completed by:                           Date Completed:"]
["STEP 1: Confirm identification of personally identifiable information protection needs. "]
["Action Item 1.1"]
["Verify information categorization to ensure identification of personally identifiable information requiring protection when accessed remotely or physically removed.","PL-5 ","The organization conducts a privacy impact assessment on the information system. ","PL-5.1","X","X","Examine organizational records or documents to determine if the organization conducts a privacy impact assessment on the information system."]
[{"$nulls":3},"PL-5.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the privacy impact assessment control is implemented."]
[{"$nulls":3},"PL-5.3",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently conducts privacy impact assessments on the information system on an ongoing basis."]
[{"$nulls":3},"PL-5.4",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the privacy impact assessment control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"RA-2 ","The organization categorizes the information system and the information processed, stored, or transmitted by the system in accordance with FIPS 199 and documents the results (including supporting rationale) in the system security plan. Designated senior-level officials within the organization review and approve the security categorizations.","RA-2.1","X","X","Examine the system security plan to determine if the security categorization of the information system: (i) exists; (ii) is consistent with FIPS 199; (iii) includes supporting rationale consistent with NIST Special Publication 800-60; and (iv) is reviewed and approved by designated senior-level officials within the organization."]
[{"$nulls":3},"RA-2.2","X","X","Interview selected organizational personnel with risk assessment responsibilities to determine if the security categorization process is conducted as an organization-wide exercise with the involvement of senior-level officials including, but not limited to, authorizing officials, information system owners, chief information officer, senior agency information security officer, and information owners."]
[{"$nulls":3},"RA-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security categorization control is implemented."]
[{"$nulls":3},"RA-2.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently conducts security categorizations of the information system on an ongoing basis."]
[{"$nulls":3},"RA-2.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security categorization control are documented and the resulting information used to actively improve the control on a continuous basis."]
["Action Item 1.2"]
["Verify existing risk assessment.","RA-4 ","The organization updates the risk assessment [Assignment: organization-defined frequency] or whenever there are significant changes to the information system, the facilities where the system resides, or other conditions that may impact the security or accreditation status of the system.","RA-4.1",null,null,"Examine organizational records or documents to determine if the risk assessment is updated in accordance with organization-defined frequency or whenever there are significant changes to the information system, the facilities where the system resides, or other conditions that may impact the security or accreditation status of the system."]
[{"$nulls":3},"RA-4.2","X","X","Examine the risk assessment to determine if the report reflects the latest significant changes to the information system, the facilities where the system resides, or other conditions that may have impacted the security or accreditation status of the system."]
[{"$nulls":3},"RA-4.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the risk assessment update control is implemented."]
[{"$nulls":3},"RA-4.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the risk assessment for the information system on an ongoing basis."]
[{"$nulls":3},"RA-4.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the risk assessment update control are documented and the resulting information used to actively improve the control on a continuous basis."]
["STEP 2: Verify adequacy of organizational policy. "]
["Action Item 2.2"]
["Verify that the existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.","n/a","Existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.","OMB M-06-16","X","X","1. For Personally Identifiable Information physically removed:\na. Does the policy explicitly identify the rules for determining whether physical removal is allowed?\nb. For personally identifiable information that can be removed, does the policy require the information be encrypted and that appropriate procedures, training, and accountability measures are in place to ensure that remote use of this encrypted information does not result in bypassing the protections provided by the encryption?"]
[{"$nulls":3},"OMB M-06-16","X","X","2. For Personally Identifiable Information accessed remotely:\na. Does the policy explicitly identify the rules for determining whether remote access is allowed?\nb. When remote access is allowed, does the policy require that this access be accomplished via a virtual private network (VPN) connection established using agency-issued authentication certificate(s) or hardware token?\nc. When remote access is allowed, does the policy identify the rules for determining whether download and remote storage of the information is allowed? (For example, the policy could permit remote access to a database, but prohibit downloading and local storage of that database.)"]
["Action Items 2.1, 2.2, and 2.3"]
["Action Item 2.1: Identify existing organizational policy that addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.                                                                                                                                   Action Item 2.2: Verify that the existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.                                                                                                                                                                  Action Item 2.3: Revise/develop organizational policy as needed, including steps 3 and 4.","AC-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, access control policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the access control policy and associated access controls.","AC-1.1","X","X","Examine organizational records or documents to determine if access control policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"AC-1.2","X","X","Examine the access control policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"AC-1.3","X","X","Examine the access control procedures to determine if the procedures are sufficient to address all areas identified in the access control policy and all associated access controls."]
[{"$nulls":3},"AC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the access control policy and procedures control is implemented."]
[{"$nulls":3},"AC-1.5",null,"X","Examine the access control policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"AC-1.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
[{"$nulls":3},"AC-1.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access control policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AT-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, security awareness and training policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls.","AT-1.1","X","X","Examine organizational records or documents to determine if security awareness and training policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"AT-1.2","X","X","Examine the security awareness and training policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"AT-1.3","X","X","Examine the security awareness and training procedures to determine if the procedures are sufficient to address all areas identified in the security awareness and training policy and all associated security awareness and training controls."]
[{"$nulls":3},"AT-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security awareness and training policy and procedures control is implemented."]
[{"$nulls":3},"AT-1.5",null,"X","Examine the security awareness and training policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"AT-1.6",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
[{"$nulls":3},"AT-1.7",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness and training policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AU-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, audit and accountability policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.","AU-1.1","X","X","Examine organizational records or documents to determine if the audit and accountability policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"AU-1.2","X","X","Examine the audit and accountability policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"AU-1.3","X","X","Examine the audit and accountability procedures to determine if the procedures are sufficient to address all areas identified in the audit and accountability policy and all associated audit and accountability controls."]
[{"$nulls":3},"AU-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the audit and accountability policy and procedures control is implemented."]
[{"$nulls":3},"AU-1.5",null,"X","Examine the audit and accountability policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"AU-1.6",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently applies the audit and accountability policy and procedures on an ongoing basis."]
[{"$nulls":3},"AU-1.7",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit and accountability policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"IA-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, identification and authentication policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.","IA-1.1","X","X","Examine organizational records or documents to determine if identification and authentication policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"IA-1.2","X","X","Examine the identification and authentication policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"IA-1.3","X","X","Examine the identification and authentication procedures to determine if the procedures are sufficient to address all areas identified in the identification and authentication policy and all associated identification and authentication controls."]
[{"$nulls":3},"IA-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the identification and authentication policy and procedures control is implemented."]
[{"$nulls":3},"IA-1.5",null,"X","Examine the identification and authentication policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"IA-1.6",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently applies the identification and authentication policy and procedures on an ongoing basis."]
[{"$nulls":3},"IA-1.7",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the identification and authentication policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"MP-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, media protection policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the media protection policy and associated media protection controls.","MP-1.1","X","X","Examine organizational records or documents to determine if the media protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"MP-1.2","X","X","Examine the media protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"MP-1.3","X","X","Examine the media protection procedures to determine if the procedures are sufficient to address all areas identified in the media protection policy and all associated media protection controls."]
[{"$nulls":3},"MP-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the media protection policy and procedures control is implemented."]
[{"$nulls":3},"MP-1.5",null,"X","Examine the media protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"MP-1.6",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the media protection policy and procedures on an ongoing basis."]
[{"$nulls":3},"MP-1.7",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, system and communications protection policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls","SC-1.1","X","X","Examine organizational records or documents to determine if system and communications protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"SC-1.2","X","X","Examine the system and communications protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"SC-1.3","X","X","Examine the system and communications protection procedures to determine if the procedures are sufficient to address all areas identified in the system and communications protection policy and all associated system and communications protection controls."]
[{"$nulls":3},"SC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the system and communications protection policy and procedures control is implemented."]
[{"$nulls":3},"SC-1.5",null,"X","Examine the system and communications protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"SC-1.6",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the system and communications protection policy and procedures on an ongoing basis."]
[{"$nulls":3},"SC-1.7",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the system and communications protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["STEP 3: Implement protections for personally identifiable information being transported and/or stored offsite. If personally identifiable information is to be transported and/or stored offiste, follow Step 3; for remote access to personally identifiable information, follow Step 4. "]
["Action Item 3.1"]
["In those instances where personally identifiable information is transported to a remote site, implement NIST Special Publication 800-53 security controls ensuring that information is transported only in encrypted form.","MP-5 ","The organization controls information system media (paper and digital) and restricts the pickup, receipt, transfer, and delivery of such media to authorized personnel.","MP-5.1","X","X","Examine organizational records or documents to determine if the organization restricts the pickup, receipt, transfer, and delivery of information system media (paper and digital) to authorized personnel."]
[{"$nulls":3},"MP-5.2","X","X","Examine the list of personnel that have been authorized for the pickup, receipt, transfer, and delivery of information system media to determine if access is appropriately restricted."]
[{"$nulls":3},"MP-5.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the media transport control is implemented."]
[{"$nulls":3},"MP-5.4",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently transports in a secure manner information system media on an ongoing basis."]
[{"$nulls":3},"MP-5.5",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media transport control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-13 ","When cryptography is employed within the information system, the system performs all cryptographic operations (including key generation) using FIPS 140-2 validated cryptographic modules operating in approved modes of operation.","SC-13.1","X","X","Examine organizational records or documents (including developer design documentation) to determine if the employed cryptography complies with applicable federal laws, directives, policies, regulations, standards, and guidance, including FIPS 140-2 which requires the system to perform all cryptographic operations (including key generation) using FIPS 140-2 validated cryptographic modules operating in approved modes of operation."]
[{"$nulls":3},"SC-13.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the use of validated cryptography control is implemented."]
[{"$nulls":3},"SC-13.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently uses validated cryptography within the information system on an ongoing basis."]
[{"$nulls":3},"SC-13.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the use of validated cryptography control are documented and the resulting information used to actively improve the control on a continuous basis."]
["Action Item 3.2"]
["In those instances where personally identifiable information is being stored at a remote site, implement NIST Special Publication 800-53 security controls ensuring that information is stored only in encrypted form.","PL-4 ","The organization establishes and makes readily available to all information system users a set of rules that describes their responsibilities and expected behavior with regard to information system usage. The organization receives signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to the information system.","PL-4.1","X","X","Examine organizational records or documents to determine if the organization provides and makes readily available to all information system users a set of rules that describes users responsibilities and expected behavior with regard to information and information system usage."]
[{"$nulls":3},"PL-4.2","X","X","Examine organizational records or documents to determine if the organization receives a signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to the information system and its resident information."]
[{"$nulls":3},"PL-4.3","X","X","Examine the rules of behavior to determine if the content is consistent with NIST Special Publication 800-18."]
[{"$nulls":3},"PL-4.4","X","X","Interview selected organizational personnel to determine if they understand the rules of behavior for the information system."]
[{"$nulls":3},"PL-4.5","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the rules of behavior control is implemented."]
[{"$nulls":3},"PL-4.6",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the rules of behavior on an ongoing basis."]
[{"$nulls":3},"PL-4.7",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the rules of behavior control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-4 ","The information system prevents unauthorized and unintended information transfer via shared system resources.","SC-4.1","X","X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system prevents unauthorized and unintended information transfer via shared system resources and how the system prevents the transfer."]
[{"$nulls":3},"SC-4.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the information remnants control is implemented."]
[{"$nulls":3},"SC-4.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system employs appropriate mechanisms to consistently prevent unauthorized and unintended transfer of information via shared system resources on an ongoing basis."]
[{"$nulls":3},"SC-4.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information remnants control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-13 ","See above under Action Item 3.1"]
["STEP 4: Implement protections for remote access to personally identifiable information. "]
["Action Item 4.1"]
["Implement NIST Special Publication 800-53 security controls requiring authenticated, virtual private network (VPN) connection.","AC-17 ","The organization documents, monitors, and controls all methods of remote access (e.g., dial-up, Internet) to the information system including remote access for privileged functions. Appropriate organization officials authorize each remote access method for the information system and authorize only the necessary users for each access method.\nControl enhancement: \n(1) The organization employs automated mechanisms to facilitate the monitoring and control of remote access methods. \n\n(2) The organization uses encryption to protect the confidentiality of remote access sessions. \n\n(3) The organization controls all remote accesses through a managed access control point. ","AC-17.1","X","X","Examine organizational records or documents to determine if remote access is: (i) monitored on a periodic basis in accordance with organization policy; (ii) restricted through dial-up connections or protects against unauthorized connections or subversion of unauthorized connections; (iii) authorized and restricted to users with an operational need for access; and (iv) restricted to only allow privileged access based on compelling operational needs."]
[{"$nulls":3},"AC-17.2","X","X","Examine organizational records or documents to determine if remote access activity is being recorded in logs and reviewed periodically in accordance with the organizational policy and procedures."]
[{"$nulls":3},"AC-17.3","X","X","Examine organizational records or documents to determine if remote access is documented and authorized by the appropriate organization officials."]
[{"$nulls":3},"AC-17.4","X","X","Examine the configuration of the information system to determine if controls are employed to restrict remote access to the system."]
[{"$nulls":3},"AC-17.5","X","X","Examine a system-generated list of user accounts with remote access and determine if the established procedures are followed to authorize remote access for the accounts."]
[{"$nulls":3},"AC-17.6","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the remote access control is implemented."]
[{"$nulls":3},"AC-17.7","X","X","Test the remote access controls by attempting to gain remote access to the information system using a valid system account that does not have remote access permissions."]
[{"$nulls":3},"AC-17.8",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently employs remote access controls for the information system on an ongoing basis."]
[{"$nulls":3},"AC-17.9",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the remote access control are documented and the resulting information used to actively improve the control on a continuous basis."]
[{"$nulls":3},"AC-17.10","X","X","Examine organizational records or documents to determine what automated mechanisms and functions are employed to support and facilitate the monitoring and control of remote access methods."]
[{"$nulls":3},"AC-17.11","X","X","Examine organizational records or documents to determine if the automated mechanisms supporting the monitoring and control of remote access are effectively employed in accordance with organizational policy and procedures."]
[{"$nulls":3},"AC-17.12",null,"X","Test the automated mechanism(s) within the information system to determine if each of the functions associated with the monitoring and control of remote access produce accurate and informative information, in accordance with remote access monitoring policy and procedures."]
[{"$nulls":3},"AC-17.13","X","X","Interview selected organizational personnel with access control responsibilities and examine the configuration of the information system to determine if the organization uses encryption to protect the confidentiality of remote access sessions."]
[{"$nulls":3},"AC-17.14",null,"X","Examine a remote access connection to the information system to determine if the connection requires the use of encryption and encryption is actually employed."]
[{"$nulls":3},"AC-17.15","X","X","Interview selected organizational personnel with access control responsibilities and examine the configuration of the information system to determine if the organization controls remote access through a managed access control point."]
[{"$nulls":3},"AC-17.16",null,"X","Test remote access controls by attempting to connect remotely to the information system without connecting through the managed access control point to determine if remote access can be achieved without following organizational policy and procedures."]
[null,"IA-5 ","The organization manages information system authenticators (e.g., tokens, PKI certificates, biometrics, passwords, key cards) by: (i) defining initial authenticator content; (ii) establishing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators; and (iii) changing default authenticators upon information system installation.","IA-5.1","X","X","Examine organizational records or documents and the information system configuration settings to determine if the system protects passwords from unauthorized disclosure and modification when stored and transmitted, prohibits passwords from being displayed when entered, enforces password minimum and maximum lifetime restrictions, and prohibits password reuse for a specified number of generations."]
[{"$nulls":3},"IA-5.2","X","X","Examine organizational records or documents to determine if the organization establishes administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators."]
[{"$nulls":3},"IA-5.3","X","X","Examine organizational records or documents to determine if the organization changes default authenticators upon information system installation."]
[{"$nulls":3},"IA-5.4","X","X","Interview selected organizational personnel with identification and authentication responsibilities to determine if users take reasonable measures to safeguard authenticators including maintaining possession of their individual authenticators, not loaning or sharing authenticators with others, and reporting lost or compromised authenticators immediately."]
[{"$nulls":3},"IA-5.5","X","X","Examine organizational records or documents to determine if the information system establishes user control of the corresponding private key and maps the authenticated identity to the user account (for PKI-based authentication)."]
[{"$nulls":3},"IA-5.6","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the authenticator management control is implemented."]
[{"$nulls":3},"IA-5.7",null,"X","Test the information system to determine if the system protects passwords from unauthorized disclosure and modification when stored and transmitted, prohibits passwords from being displayed when entered, enforces password minimum and maximum lifetime restrictions, and prohibits password reuse for a specified number of generations."]
[{"$nulls":3},"IA-5.8",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently manages authenticators for the information system on an ongoing basis."]
[{"$nulls":3},"IA-5.9",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the authenticator management control are documented and the resulting information used to actively improve the control on a continuous basis."]
["Action Item 4.2"]
["Implement NIST Special Publication 800-53 security controls enforcing allowed downloading of personally identifiable information.","AC-3 ","The information system enforces assigned authorizations for controlling access to the system in accordance with applicable policy.\n\nControl enhancement: \n(1) The information system ensures that access to security functions (deployed in hardware, software, and firmware) and information is restricted to authorized personnel (e.g., security administrators). ","AC-3.1","X","X","Examine organizational records or documents to determine if user access to the information system is authorized."]
[{"$nulls":3},"AC-3.2","X","X","Examine access control mechanisms to determine if the information system is configured to implement the organizational access control policy."]
[{"$nulls":3},"AC-3.3","X","X","Examine the user access rights on the information system to determine if user privileges on the system are consistent with the documented user authorizations."]
[{"$nulls":3},"AC-3.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the access enforcement control is implemented."]
[{"$nulls":3},"AC-3.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces assigned authorizations for controlling access to the system on an ongoing basis."]
[{"$nulls":3},"AC-3.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access enforcement control are documented and the resulting information used to actively improve the control on a continuous basis."]
[{"$nulls":3},"AC-3.7",null,"X","Examine organizational records or documents to determine if the organization explicitly defines security functions for the information system."]
[{"$nulls":3},"AC-3.8",null,"X","Examine organizational records or documents to determine if the organization properly authorizes personnel granted access to security functions and information in accordance with organizational policy."]
[{"$nulls":3},"AC-3.9",null,"X","Test selected accounts that have access to information system security functions to determine if the user privileges for those accounts function as documented in accordance with authorization requirements."]
[null,"AC-4 ","The information system enforces assigned authorizations for controlling the flow of information within the system and between interconnected systems in accordance with applicable policy.","AC-4.1","X","X","Examine information system interconnection agreements to determine if the agreements address: (i) the types of permissible and impermissible flow of information between systems; and (ii) the required level of authorization to allow information flow as defined in the information flow enforcement policy and procedures."]
[{"$nulls":3},"AC-4.2","X","X","Examine information system configuration settings to determine if controls are in place to restrict the flow of information within the system and between interconnected systems in accordance with the applicable policy, procedures, and assigned authorizations."]
[{"$nulls":3},"AC-4.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the information flow enforcement control is implemented."]
[{"$nulls":3},"AC-4.4",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces assigned authorizations for controlling the flow of information within the system and between interconnected systems on an ongoing basis."]
[{"$nulls":3},"AC-4.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information flow enforcement control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AC-6 ","The information system enforces the most restrictive set of rights/privileges or accesses needed by users (or processes acting on behalf of users) for the performance of specified tasks.","AC-6.1","X","X","Examine organizational records or documents to determine if the organization assigns the most restrictive set of rights/privileges or accesses needed by users for the performance of specified tasks."]
[{"$nulls":3},"AC-6.2","X","X","Examine organizational records or documents to determine what access rights/privileges the organization assigns to user tasks."]
[{"$nulls":3},"AC-6.3","X","X","Examine selected user accounts on the information system to determine if the access rights/privileges correspond to the authorized permissions on access documentation for specified tasks."]
[{"$nulls":3},"AC-6.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the least privilege control is implemented."]
[{"$nulls":3},"AC-6.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces the most restrictive set of rights/privileges or accesses needed by users on an ongoing basis."]
[{"$nulls":3},"AC-6.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the least privilege control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AC-13 ","The organization supervises and reviews the activities of users with respect to the enforcement and usage of information system access controls.\nControl enhancement: \n(1) The organization employs automated mechanisms to facilitate the review of user activities.","AC-13.1","X","X","Interview selected organizational personnel with access control responsibilities to determine if the organization supervises and reviews the activities of users of the information system."]
[{"$nulls":3},"AC-13.2","X","X","Examine organizational records or documents to determine if unusual activity is investigated, reported to appropriate officials, and resolved."]
[{"$nulls":3},"AC-13.3","X","X","Examine organizational records of supervisory notices or disciplinary actions to users to determine if the organization is supervising user activities regarding the use and application of information system access controls."]
[{"$nulls":3},"AC-13.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the supervision and review of access control is implemented."]
[{"$nulls":3},"AC-13.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently supervises and reviews user activities with respect to the enforcement and use of access controls for the information system on an ongoing basis."]
[{"$nulls":3},"AC-13.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the supervision and review of access control are documented and the resulting information used to actively improve the control on a continuous basis."]
[{"$nulls":3},"AC-13.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization employs automated mechanisms within the information system to support and facilitate the review of user and how those mechanisms are implemented."]
[{"$nulls":3},"AC-13.8",null,"X","Examine the configuration of the automated mechanism(s) within the information system to determine if the mechanisms support the review of user activities."]
[{"$nulls":3},"AC-13.9",null,"X","Examine the output from the automated mechanism(s) within the information system to determine if each of the automated functions associated with the review of user activities produces accurate and informative information to support and facilitate the review of user activities with respect to access control enforcement and usage."]
[null,"AU-2 ","The information system generates audit records for the following events: [Assignment: organization-defined auditable events].","AU-2.1","X","X","Examine organizational records or documents and the information system configuration settings to determine if the system generates audit records for the organization-defined auditable events."]
[{"$nulls":3},"AU-2.2","X","X","Test the information system by attempting to perform actions that are configured to generate an audit record."]
[{"$nulls":3},"AU-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the auditable events control is implemented."]
[{"$nulls":3},"AU-2.4",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the information system consistently generates audit records for auditable events on an ongoing basis."]
[{"$nulls":3},"AU-2.5",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the auditable events control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AU-6 ","The organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity, investigates suspicious activity or suspected violations, reports findings to appropriate officials, and takes necessary actions. \nControl enhancement: \n(1) The organization employs automated mechanisms to integrate audit monitoring, analysis, and reporting into an overall process for investigation and response to suspicious activities.                                                                                                                                                                         (2) The organization employs automated mechanisms to immediately alert security personnel of inappropriate or unusual activities with security implications.","AU-6.1","X","X","Examine organizational records or documents to determine if the organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity, investigates suspicious activity or suspected violations, reports findings to appropriate officials, and takes necessary actions."]
[{"$nulls":3},"AU-6.2","X","X","Test the audit monitoring, analysis and reporting process to determine if the organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity, investigates suspicious activity or suspected violations, reports findings to appropriate officials, and takes necessary actions by artificially generating auditable events to cause an audit failure or suspicious activity condition and monitoring how the organization reacts."]
[{"$nulls":3},"AU-6.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the audit monitoring, analysis, and reporting control is implemented."]
[{"$nulls":3},"AU-6.4",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently conducts audit monitoring, analysis, and reporting on an ongoing basis."]
[{"$nulls":3},"AU-6.5",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit monitoring, analysis, and reporting control are documented and the resulting information used to actively improve the control on a continuous basis."]
[{"$nulls":3},"AU-6.6",null,"X","Examine organizational records or documents and the information system configuration to determine if the organization employs automated mechanisms to integrate audit monitoring, analysis, and reporting into  overall process for investigation and response to suspicious activities."]
[{"$nulls":3},"AU-6.7",null,"X","Test the information system configuration to determine if the organization employs automated mechanisms to integrate audit monitoring, analysis, and reporting into an overall process for investigation and response to suspicious activities by artificially generating auditable events and monitoring the results."]
["Action Item 4.3 -- If remote storage of personally identifiable information is to be permitted follow Action Item 4.3, otherwise follow Action Item 4.4. "]
["Implement NIST Special Publication 800-53 security controls enforcing encrypted remote storage of personally identifiable information.","PL-4 ","See above under Action Item 3.2"]
[null,"SC-4 ","See above under Action Item 3.2"]
[null,"SC-13 ","See above under Action Item 3.1"]
["Action Item 4.4"]
["Implement NIST Special Publication 800-53 security controls enforcing no remote storage of personally identifiable information.","AC-3 ","See above under Action Item 4.2"]
[null,"AC-4 ","See above under Action Item 4.2"]
[null,"AC-6 ","See above under Action Item 4.2"]
[null,"AC-13 ","See above under Action Item 4.2"]
[null,"AC-17 ","See above under Action Item 4.1"]
[null,"AT-2 ","The organization ensures all users (including managers and senior executives) are exposed to basic information system security awareness materials before authorizing access to the system and [Assignment: organization-defined frequency, at least annually] thereafter.","AT-2.1","X","X","Examine organizational records or documents to determine if: (i) security awareness instruction is provided to all users; (ii) records include the type of instruction received and the date completed; and (iii) initial and refresher instruction is provided in accordance with organization-defined frequency, at least annually."]
[{"$nulls":3},"AT-2.2","X","X","Examine security awareness instructional materials to determine if the materials address the specific requirements of the organization and the information systems to which personnel have authorized access."]
[{"$nulls":3},"AT-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security awareness control is implemented."]
[{"$nulls":3},"AT-2.4",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently conducts security awareness instruction on an ongoing basis."]
[{"$nulls":3},"AT-2.5",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AU-2 ","See above under Action Item 4.2"]
[null,"AU-6 ","See above under Action Item 4.2"]
[null,"PL-4 ","See above under Action Item 3.2"]
[null,"SC-4 ","See above under Action Item 3.2"]
[]
["NOTE:  Add controls and assessment procedures associated with specific technology associated with the system."]

{"sheet":"Assmnt Pln-Phys Transport","index":2,"n_rows":90,"n_cols":10,"rows_kept":90,"merged":[[0,0,0,9],[1,0,1,9],[3,0,3,9],[4,0,4,9],[5,0,13,0],[5,1,8,1],[5,2,8,2],[9,1,13,1],[9,2,13,2],[14,0,14,9],[15,0,19,0],[15,1,19,1],[15,2,19,2],[20,0,20,9],[21,0,21,9],[23,0,23,9],[24,0,65,0],[24,1,30,1],[24,2,30,2],[31,1,37,1],[31,2,37,2],[38,1,44,1],[38,2,44,2],[45,1,51,1],[45,2,51,2],[52,1,58,1],[52,2,58,2],[59,1,65,1],[59,2,65,2],[66,0,66,9],[67,0,67,9],[68,0,76,0],[68,1,72,1],[68,2,72,2],[73,1,76,1],[73,2,76,2],[77,0,77,9],[78,0,89,0],[78,1,84,1],[78,2,84,2],[85,1,88,1],[85,2,88,2],[89,2,89,9]],"flags":["formulas_cached_only"]}
["OMB M-06-16 Security Assessment Plan "]
["For System: xxxxxxxxxxxxxxxxxxxxxxxx"]
["Procedure from OMB M-06-16 Checklist","NIST SP 800-53 Control Identifier","NIST SP 800-53 Control","NIST SP 800-53A Assessment Identifier","Moderate-impact system applicable","High-impact system applicable","NIST SP 800-53A Assessment Procedural Statements (Examine, Interview, Test)","Fully Satisfied (FS), Partially Satisfied (PS), Not Satisfied (NS)","Additional Test Steps/Summary Comment for Test Results and Mitigation Requirements/POAM (include references to other supporting documentation)","Assessment Completed by:                           Date Completed:"]
["STEP 1: Confirm identification of personally identifiable information protection needs. "]
["Action Item 1.1"]
["Verify information categorization to ensure identification of personally identifiable information requiring protection when accessed remotely or physically removed.","PL-5 ","The organization conducts a privacy impact assessment on the information system. ","PL-5.1","X","X","Examine organizational records or documents to determine if the organization conducts a privacy impact assessment on the information system."]
[{"$nulls":3},"PL-5.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the privacy impact assessment control is implemented."]
[{"$nulls":3},"PL-5.3",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently conducts privacy impact assessments on the information system on an ongoing basis."]
[{"$nulls":3},"PL-5.4",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the privacy impact assessment control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"RA-2 ","The organization categorizes the information system and the information processed, stored, or transmitted by the system in accordance with FIPS 199 and documents the results (including supporting rationale) in the system security plan. Designated senior-level officials within the organization review and approve the security categorizations.","RA-2.1","X","X","Examine the system security plan to determine if the security categorization of the information system: (i) exists; (ii) is consistent with FIPS 199; (iii) includes supporting rationale consistent with NIST Special Publication 800-60; and (iv) is reviewed and approved by designated senior-level officials within the organization."]
[{"$nulls":3},"RA-2.2","X","X","Interview selected organizational personnel with risk assessment responsibilities to determine if the security categorization process is conducted as an organization-wide exercise with the involvement of senior-level officials including, but not limited to, authorizing officials, information system owners, chief information officer, senior agency information security officer, and information owners."]
[{"$nulls":3},"RA-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security categorization control is implemented."]
[{"$nulls":3},"RA-2.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently conducts security categorizations of the information system on an ongoing basis."]
[{"$nulls":3},"RA-2.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security categorization control are documented and the resulting information used to actively improve the control on a continuous basis."]
["Action Item 1.2"]
["Verify existing risk assessment.","RA-4 ","The organization updates the risk assessment [Assignment: organization-defined frequency] or whenever there are significant changes to the information system, the facilities where the system resides, or other conditions that may impact the security or accreditation status of the system.","RA-4.1",null,null,"Examine organizational records or documents to determine if the risk assessment is updated in accordance with organization-defined frequency or whenever there are significant changes to the information system, the facilities where the system resides, or other conditions that may impact the security or accreditation status of the system."]
[{"$nulls":3},"RA-4.2","X","X","Examine the risk assessment to determine if the report reflects the latest significant changes to the information system, the facilities where the system resides, or other conditions that may have impacted the security or accreditation status of the system."]
[{"$nulls":3},"RA-4.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the risk assessment update control is implemented."]
[{"$nulls":3},"RA-4.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the risk assessment for the information system on an ongoing basis."]
[{"$nulls":3},"RA-4.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the risk assessment update control are documented and the resulting information used to actively improve the control on a continuous basis."]
["STEP 2: Verify adequacy of organizational policy. "]
["Action Item 2.2"]
["Verify that the existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.","n/a","Existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.","OMB M-06-16","X","X","1. For Personally Identifiable Information physically removed:\na. Does the policy explicitly identify the rules for determining whether physical removal is allowed?\nb. For personally identifiable information that can be removed, does the policy require the information be encrypted and that appropriate procedures, training, and accountability measures are in place to ensure that remote use of this encrypted information does not result in bypassing the protections provided by the encryption?"]
["Action Items 2.1, 2.2, and 2.3"]
["Action Item 2.1: Identify existing organizational policy that addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.                                                                                                                                   Action Item 2.2: Verify that the existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.                                                                                                                                                                  Action Item 2.3: Revise/develop organizational policy as needed, including steps 3 and 4.","AC-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, access control policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the access control policy and associated access controls.","AC-1.1","X","X","Examine organizational records or documents to determine if access control policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"AC-1.2","X","X","Examine the access control policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"AC-1.3","X","X","Examine the access control procedures to determine if the procedures are sufficient to address all areas identified in the access control policy and all associated access controls."]
[{"$nulls":3},"AC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the access control policy and procedures control is implemented."]
[{"$nulls":3},"AC-1.5",null,"X","Examine the access control policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"AC-1.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
[{"$nulls":3},"AC-1.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access control policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AT-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, security awareness and training policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls.","AT-1.1","X","X","Examine organizational records or documents to determine if security awareness and training policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"AT-1.2","X","X","Examine the security awareness and training policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"AT-1.3","X","X","Examine the security awareness and training procedures to determine if the procedures are sufficient to address all areas identified in the security awareness and training policy and all associated security awareness and training controls."]
[{"$nulls":3},"AT-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security awareness and training policy and procedures control is implemented."]
[{"$nulls":3},"AT-1.5",null,"X","Examine the security awareness and training policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"AT-1.6",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
[{"$nulls":3},"AT-1.7",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness and training policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AU-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, audit and accountability policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.","AU-1.1","X","X","Examine organizational records or documents to determine if the audit and accountability policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"AU-1.2","X","X","Examine the audit and accountability policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"AU-1.3","X","X","Examine the audit and accountability procedures to determine if the procedures are sufficient to address all areas identified in the audit and accountability policy and all associated audit and accountability controls."]
[{"$nulls":3},"AU-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the audit and accountability policy and procedures control is implemented."]
[{"$nulls":3},"AU-1.5",null,"X","Examine the audit and accountability policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"AU-1.6",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently applies the audit and accountability policy and procedures on an ongoing basis."]
[{"$nulls":3},"AU-1.7",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit and accountability policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"IA-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, identification and authentication policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.","IA-1.1","X","X","Examine organizational records or documents to determine if identification and authentication policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"IA-1.2","X","X","Examine the identification and authentication policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"IA-1.3","X","X","Examine the identification and authentication procedures to determine if the procedures are sufficient to address all areas identified in the identification and authentication policy and all associated identification and authentication controls."]
[{"$nulls":3},"IA-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the identification and authentication policy and procedures control is implemented."]
[{"$nulls":3},"IA-1.5",null,"X","Examine the identification and authentication policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"IA-1.6",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently applies the identification and authentication policy and procedures on an ongoing basis."]
[{"$nulls":3},"IA-1.7",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the identification and authentication policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"MP-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, media protection policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the media protection policy and associated media protection controls.","MP-1.1","X","X","Examine organizational records or documents to determine if the media protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"MP-1.2","X","X","Examine the media protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"MP-1.3","X","X","Examine the media protection procedures to determine if the procedures are sufficient to address all areas identified in the media protection policy and all associated media protection controls."]
[{"$nulls":3},"MP-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the media protection policy and procedures control is implemented."]
[{"$nulls":3},"MP-1.5",null,"X","Examine the media protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"MP-1.6",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the media protection policy and procedures on an ongoing basis."]
[{"$nulls":3},"MP-1.7",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, system and communications protection policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls","SC-1.1","X","X","Examine organizational records or documents to determine if system and communications protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"SC-1.2","X","X","Examine the system and communications protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"SC-1.3","X","X","Examine the system and communications protection procedures to determine if the procedures are sufficient to address all areas identified in the system and communications protection policy and all associated system and communications protection controls."]
[{"$nulls":3},"SC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the system and communications protection policy and procedures control is implemented."]
[{"$nulls":3},"SC-1.5",null,"X","Examine the system and communications protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"SC-1.6",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the system and communications protection policy and procedures on an ongoing basis."]
[{"$nulls":3},"SC-1.7",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the system and communications protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["STEP 3: Implement protections for personally identifiable information being transported and/or stored offsite. If personally identifiable information is to be transported and/or stored offiste, follow Step 3; for remote access to personally identifiable information, follow Step 4. "]
["Action Item 3.1"]
["In those instances where personally identifiable information is transported to a remote site, implement NIST Special Publication 800-53 security controls ensuring that information is transported only in encrypted form.","MP-5 ","The organization controls information system media (paper and digital) and restricts the pickup, receipt, transfer, and delivery of such media to authorized personnel.","MP-5.1","X","X","Examine organizational records or documents to determine if the organization restricts the pickup, receipt, transfer, and delivery of information system media (paper and digital) to authorized personnel."]
[{"$nulls":3},"MP-5.2","X","X","Examine the list of personnel that have been authorized for the pickup, receipt, transfer, and delivery of information system media to determine if access is appropriately restricted."]
[{"$nulls":3},"MP-5.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the media transport control is implemented."]
[{"$nulls":3},"MP-5.4",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently transports in a secure manner information system media on an ongoing basis."]
[{"$nulls":3},"MP-5.5",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media transport control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-13 ","When cryptography is employed within the information system, the system performs all cryptographic operations (including key generation) using FIPS 140-2 validated cryptographic modules operating in approved modes of operation.","SC-13.1","X","X","Examine organizational records or documents (including developer design documentation) to determine if the employed cryptography complies with applicable federal laws, directives, policies, regulations, standards, and guidance, including FIPS 140-2 which requires the system to perform all cryptographic operations (including key generation) using FIPS 140-2 validated cryptographic modules operating in approved modes of operation."]
[{"$nulls":3},"SC-13.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the use of validated cryptography control is implemented."]
[{"$nulls":3},"SC-13.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently uses validated cryptography within the information system on an ongoing basis."]
[{"$nulls":3},"SC-13.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the use of validated cryptography control are documented and the resulting information used to actively improve the control on a continuous basis."]
["Action Item 3.2"]
["In those instances where personally identifiable information is being stored at a remote site, implement NIST Special Publication 800-53 security controls ensuring that information is stored only in encrypted form.","PL-4 ","The organization establishes and makes readily available to all information system users a set of rules that describes their responsibilities and expected behavior with regard to information system usage. The organization receives signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to the information system.","PL-4.1","X","X","Examine organizational records or documents to determine if the organization provides and makes readily available to all information system users a set of rules that describes users responsibilities and expected behavior with regard to information and information system usage."]
[{"$nulls":3},"PL-4.2","X","X","Examine organizational records or documents to determine if the organization receives a signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to the information system and its resident information."]
[{"$nulls":3},"PL-4.3","X","X","Examine the rules of behavior to determine if the content is consistent with NIST Special Publication 800-18."]
[{"$nulls":3},"PL-4.4","X","X","Interview selected organizational personnel to determine if they understand the rules of behavior for the information system."]
[{"$nulls":3},"PL-4.5","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the rules of behavior control is implemented."]
[{"$nulls":3},"PL-4.6",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the rules of behavior on an ongoing basis."]
[{"$nulls":3},"PL-4.7",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the rules of behavior control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-4 ","The information system prevents unauthorized and unintended information transfer via shared system resources.","SC-4.1","X","X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system prevents unauthorized and unintended information transfer via shared system resources and how the system prevents the transfer."]
[{"$nulls":3},"SC-4.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the information remnants control is implemented."]
[{"$nulls":3},"SC-4.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system employs appropriate mechanisms to consistently prevent unauthorized and unintended transfer of information via shared system resources on an ongoing basis."]
[{"$nulls":3},"SC-4.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information remnants control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-13 ","See above under Action Item 3.1"]

{"sheet":"Interview - Transport","index":3,"n_rows":32,"n_cols":7,"rows_kept":32,"merged":[[0,0,0,6],[1,0,1,6]],"flags":["formulas_cached_only"]}
["OMB M-06-16 Security Assessment Plan -- Transport Interview Procedures"]
["For System: xxxxxxxxxxxxxxxxxxxxxxxx"]
["NIST SP 800-53A Assessment Identifier","Moderate-impact system applicable","High-impact system applicable","NIST SP 800-53A Assessment Interview Procedural Statements","Fully Satisfied (FS), Partially Satisfied (PS), Not Satisfied (NS)","Additional Test Steps/Summary Comment for Test Results and Mitigation Requirements/POAM (include references to other supporting documentation)","Assessment Completed by:                           Date Completed:"]
["PL-4.4","X","X","Interview selected organizational personnel to determine if they understand the rules of behavior for the information system."]
["RA-2.2","X","X","Interview selected organizational personnel with risk assessment responsibilities to determine if the security categorization process is conducted as an organization-wide exercise with the involvement of senior-level officials including, but not limited to, authorizing officials, information system owners, chief information officer, senior agency information security officer, and information owners."]
["SC-4.1","X","X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system prevents unauthorized and unintended information transfer via shared system resources and how the system prevents the transfer."]
["AC-1.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
["AC-1.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access control policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AT-1.6",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
["AT-1.7",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness and training policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AU-1.6",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently applies the audit and accountability policy and procedures on an ongoing basis."]
["AU-1.7",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit and accountability policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["IA-1.6",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently applies the identification and authentication policy and procedures on an ongoing basis."]
["IA-1.7",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the identification and authentication policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["MP-1.6",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the media protection policy and procedures on an ongoing basis."]
["MP-1.7",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["MP-5.4",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently transports in a secure manner information system media on an ongoing basis."]
["MP-5.5",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media transport control are documented and the resulting information used to actively improve the control on a continuous basis."]
["PL-4.6",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the rules of behavior on an ongoing basis."]
["PL-4.7",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the rules of behavior control are documented and the resulting information used to actively improve the control on a continuous basis."]
["PL-5.3",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently conducts privacy impact assessments on the information system on an ongoing basis."]
["PL-5.4",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the privacy impact assessment control are documented and the resulting information used to actively improve the control on a continuous basis."]
["RA-2.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently conducts security categorizations of the information system on an ongoing basis."]
["RA-2.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security categorization control are documented and the resulting information used to actively improve the control on a continuous basis."]
["RA-4.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the risk assessment for the information system on an ongoing basis."]
["RA-4.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the risk assessment update control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-1.6",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the system and communications protection policy and procedures on an ongoing basis."]
["SC-1.7",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the system and communications protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-13.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently uses validated cryptography within the information system on an ongoing basis."]
["SC-13.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the use of validated cryptography control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-4.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system employs appropriate mechanisms to consistently prevent unauthorized and unintended transfer of information via shared system resources on an ongoing basis."]
["SC-4.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information remnants control are documented and the resulting information used to actively improve the control on a continuous basis."]

{"sheet":"Examine - Transport","index":4,"n_rows":78,"n_cols":7,"rows_kept":78,"merged":[[0,0,0,6],[1,0,1,6]],"flags":["formulas_cached_only"]}
["OMB M-06-16 Security Assessment Plan -- Transport Examine Procedures"]
["For System: xxxxxxxxxxxxxxxxxxxxxxxx"]
["NIST SP 800-53A Assessment Identifier","Moderate-impact system applicable","High-impact system applicable","NIST SP 800-53A Assessment Examine Procedural Statements","Fully Satisfied (FS), Partially Satisfied (PS), Not Satisfied (NS)","Additional Test Steps/Summary Comment for Test Results and Mitigation Requirements/POAM (include references to other supporting documentation)","Assessment Completed by:                           Date Completed:"]
["AC-1.1","X","X","Examine organizational records or documents to determine if access control policy and procedures: (i) exist; (ii) are documented; (iii) are\ndisseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and\n(v) are updated, when organizational review indicates updates are required."]
["AC-1.2","X","X","Examine the access control policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["AC-1.3","X","X","Examine the access control procedures to determine if the procedures are sufficient to address all areas identified in the access control policy and all associated access controls."]
["AC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the access control policy and procedures control is implemented."]
["AC-1.5",null,"X","Examine the access control policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["AC-1.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
["AC-1.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access control policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AT-1.1","X","X","Examine organizational records or documents to determine if security awareness and training policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["AT-1.2","X","X","Examine the security awareness and training policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["AT-1.3","X","X","Examine the security awareness and training procedures to determine if the procedures are sufficient to address all areas identified in the security awareness and training policy and all associated security awareness and training controls."]
["AT-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security awareness and training policy and procedures control is implemented."]
["AT-1.5",null,"X","Examine the security awareness and training policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["AT-1.6",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
["AT-1.7",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness and training policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AU-1.1","X","X","Examine organizational records or documents to determine if the audit and accountability policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["AU-1.2","X","X","Examine the audit and accountability policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["AU-1.3","X","X","Examine the audit and accountability procedures to determine if the procedures are sufficient to address all areas identified in the audit and accountability policy and all associated audit and accountability controls."]
["AU-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the audit and accountability policy and procedures control is implemented."]
["AU-1.5",null,"X","Examine the audit and accountability policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["AU-1.6",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently applies the audit and accountability policy and procedures on an ongoing basis."]
["AU-1.7",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit and accountability policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["IA-1.1","X","X","Examine organizational records or documents to determine if identification and authentication policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["IA-1.2","X","X","Examine the identification and authentication policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["IA-1.3","X","X","Examine the identification and authentication procedures to determine if the procedures are sufficient to address all areas identified in the identification and authentication policy and all associated identification and authentication controls."]
["IA-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the identification and authentication policy and procedures control is implemented."]
["IA-1.5",null,"X","Examine the identification and authentication policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["IA-1.6",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently applies the identification and authentication policy and procedures on an ongoing basis."]
["IA-1.7",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the identification and authentication policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["MP-1.1","X","X","Examine organizational records or documents to determine if the media protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["MP-1.2","X","X","Examine the media protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["MP-1.3","X","X","Examine the media protection procedures to determine if the procedures are sufficient to address all areas identified in the media protection policy and all associated media protection controls."]
["MP-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the media protection policy and procedures control is implemented."]
["MP-1.5",null,"X","Examine the media protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["MP-1.6",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the media protection policy and procedures on an ongoing basis."]
["MP-1.7",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["MP-5.1","X","X","Examine organizational records or documents to determine if the organization restricts the pickup, receipt, transfer, and delivery of information system media (paper and digital) to authorized personnel."]
["MP-5.2","X","X","Examine the list of personnel that have been authorized for the pickup, receipt, transfer, and delivery of information system media to determine if access is appropriately restricted."]
["MP-5.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the media transport control is implemented."]
["MP-5.4",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently transports in a secure manner information system media on an ongoing basis."]
["MP-5.5",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media transport control are documented and the resulting information used to actively improve the control on a continuous basis."]
["OMB M-06-16","X","X","1. For Personally Identifiable Information physically removed:\na. Does the policy explicitly identify the rules for determining whether physical removal is allowed?\nb. For personally identifiable information that can be removed, does the policy require the information be encrypted and that appropriate procedures, training, and accountability measures are in place to ensure that remote use of this encrypted information does not result in bypassing the protections provided by the encryption?"]
["PL-4.1","X","X","Examine organizational records or documents to determine if the organization provides and makes readily available to all information system users a set of rules that describes users responsibilities and expected behavior with regard to information and information system usage."]
["PL-4.2","X","X","Examine organizational records or documents to determine if the organization receives a signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to the information system and its resident information."]
["PL-4.3","X","X","Examine the rules of behavior to determine if the content is consistent with NIST Special Publication 800-18."]
["PL-4.5","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the rules of behavior control is implemented."]
["PL-4.6",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the rules of behavior on an ongoing basis."]
["PL-4.7",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the rules of behavior control are documented and the resulting information used to actively improve the control on a continuous basis."]
["PL-5.1","X","X","Examine organizational records or documents to determine if the organization conducts a privacy impact assessment on the information system."]
["PL-5.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the privacy impact assessment control is implemented."]
["PL-5.3",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently conducts privacy impact assessments on the information system on an ongoing basis."]
["PL-5.4",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the privacy impact assessment control are documented and the resulting information used to actively improve the control on a continuous basis."]
["RA-2.1","X","X","Examine the system security plan to determine if the security categorization of the information system: (i) exists; (ii) is consistent with FIPS 199; (iii) includes supporting rationale consistent with NIST Special Publication 800-60; and (iv) is reviewed and approved by designated senior-level officials within the organization."]
["RA-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security categorization control is implemented."]
["RA-2.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently conducts security categorizations of the information system on an ongoing basis."]
["RA-2.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security categorization control are documented and the resulting information used to actively improve the control on a continuous basis."]
["RA-4.1",null,null,"Examine organizational records or documents to determine if the risk assessment is updated in accordance with organization-defined frequency or whenever there are significant changes to the information system, the facilities where the system resides, or other conditions that may impact the security or accreditation status of the system."]
["RA-4.2","X","X","Examine the risk assessment to determine if the report reflects the latest significant changes to the information system, the facilities where the system resides, or other conditions that may have impacted the security or accreditation status of the system."]
["RA-4.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the risk assessment update control is implemented."]
["RA-4.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the risk assessment for the information system on an ongoing basis."]
["RA-4.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the risk assessment update control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-1.1","X","X","Examine organizational records or documents to determine if system and communications protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["SC-1.2","X","X","Examine the system and communications protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["SC-1.3","X","X","Examine the system and communications protection procedures to determine if the procedures are sufficient to address all areas identified in the system and communications protection policy and all associated system and communications protection controls."]
["SC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the system and communications protection policy and procedures control is implemented."]
["SC-1.5",null,"X","Examine the system and communications protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["SC-1.6",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the system and communications protection policy and procedures on an ongoing basis."]
["SC-1.7",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the system and communications protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-13.1","X","X","Examine organizational records or documents (including developer design documentation) to determine if the employed cryptography complies with applicable federal laws, directives, policies, regulations, standards, and guidance, including FIPS 140-2 which requires the system to perform all cryptographic operations (including key generation) using FIPS 140-2 validated cryptographic modules operating in approved modes of operation."]
["SC-13.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the use of validated cryptography control is implemented."]
["SC-13.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently uses validated cryptography within the information system on an ongoing basis."]
["SC-13.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the use of validated cryptography control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-4.1","X","X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system prevents unauthorized and unintended information transfer via shared system resources and how the system prevents the transfer."]
["SC-4.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the information remnants control is implemented."]
["SC-4.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system employs appropriate mechanisms to consistently prevent unauthorized and unintended transfer of information via shared system resources on an ongoing basis."]
["SC-4.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information remnants control are documented and the resulting information used to actively improve the control on a continuous basis."]

{"sheet":"Assmt Plan-Remote Access","index":5,"n_rows":168,"n_cols":10,"rows_kept":168,"merged":[[0,0,0,9],[1,0,1,9],[3,0,3,9],[4,0,4,9],[5,0,13,0],[5,1,8,1],[5,2,8,2],[9,1,13,1],[9,2,13,2],[14,0,14,9],[15,0,19,0],[15,1,19,1],[15,2,19,2],[20,0,20,9],[21,0,21,9],[23,0,23,9],[24,0,65,0],[24,1,30,1],[24,2,30,2],[31,1,37,1],[31,2,37,2],[38,1,44,1],[38,2,44,2],[45,1,51,1],[45,2,51,2],[52,1,58,1],[52,2,58,2],[59,1,65,1],[59,2,65,2],[66,0,66,9],[67,0,67,9],[68,0,92,0],[68,1,83,1],[68,2,83,2],[84,1,92,1],[84,2,92,2],[93,0,93,9],[94,0,134,0],[94,1,102,1],[94,2,102,2],[103,1,107,1],[103,2,107,2],[108,1,113,1],[108,2,113,2],[114,1,122,1],[114,2,122,2],[123,1,127,1],[123,2,127,2],[128,1,134,1],[128,2,134,2],[135,0,135,9],[136,0,150,0],[136,1,142,1],[136,2,142,2],[143,1,146,1],[143,2,146,2],[147,1,150,1],[147,2,150,2],[151,0,151,9],[152,0,165,0],[152,2,152,9],[153,2,153,9],[154,2,154,9],[155,2,155,9],[156,2,156,9],[157,1,161,1],[157,2,161,2],[162,2,162,9],[163,2,163,9],[164,2,164,9],[165,2,165,9],[167,0,167,9]],"flags":["formulas_cached_only"]}
["OMB M-06-16 Security Assessment Plan "]
["For System: xxxxxxxxxxxxxxxxxxxxxxxx"]
["Procedure from OMB M-06-16 Checklist","NIST SP 800-53 Control Identifier","NIST SP 800-53 Control","NIST SP 800-53A Assessment Identifier","Moderate-impact system applicable","High-impact system applicable","NIST SP 800-53A Assessment Procedural Statements (Examine, Interview, Test)","Fully Satisfied (FS), Partially Satisfied (PS), Not Satisfied (NS)","Additional Test Steps/Summary Comment for Test Results and Mitigation Requirements/POAM (include references to other supporting documentation)","Assessment Completed by:                           Date Completed:"]
["STEP 1: Confirm identification of personally identifiable information protection needs. "]
["Action Item 1.1"]
["Verify information categorization to ensure identification of personally identifiable information requiring protection when accessed remotely or physically removed.","PL-5 ","The organization conducts a privacy impact assessment on the information system. ","PL-5.1","X","X","Examine organizational records or documents to determine if the organization conducts a privacy impact assessment on the information system."]
[{"$nulls":3},"PL-5.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the privacy impact assessment control is implemented."]
[{"$nulls":3},"PL-5.3",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently conducts privacy impact assessments on the information system on an ongoing basis."]
[{"$nulls":3},"PL-5.4",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the privacy impact assessment control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"RA-2 ","The organization categorizes the information system and the information processed, stored, or transmitted by the system in accordance with FIPS 199 and documents the results (including supporting rationale) in the system security plan. Designated senior-level officials within the organization review and approve the security categorizations.","RA-2.1","X","X","Examine the system security plan to determine if the security categorization of the information system: (i) exists; (ii) is consistent with FIPS 199; (iii) includes supporting rationale consistent with NIST Special Publication 800-60; and (iv) is reviewed and approved by designated senior-level officials within the organization."]
[{"$nulls":3},"RA-2.2","X","X","Interview selected organizational personnel with risk assessment responsibilities to determine if the security categorization process is conducted as an organization-wide exercise with the involvement of senior-level officials including, but not limited to, authorizing officials, information system owners, chief information officer, senior agency information security officer, and information owners."]
[{"$nulls":3},"RA-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security categorization control is implemented."]
[{"$nulls":3},"RA-2.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently conducts security categorizations of the information system on an ongoing basis."]
[{"$nulls":3},"RA-2.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security categorization control are documented and the resulting information used to actively improve the control on a continuous basis."]
["Action Item 1.2"]
["Verify existing risk assessment.","RA-4 ","The organization updates the risk assessment [Assignment: organization-defined frequency] or whenever there are significant changes to the information system, the facilities where the system resides, or other conditions that may impact the security or accreditation status of the system.","RA-4.1",null,null,"Examine organizational records or documents to determine if the risk assessment is updated in accordance with organization-defined frequency or whenever there are significant changes to the information system, the facilities where the system resides, or other conditions that may impact the security or accreditation status of the system."]
[{"$nulls":3},"RA-4.2","X","X","Examine the risk assessment to determine if the report reflects the latest significant changes to the information system, the facilities where the system resides, or other conditions that may have impacted the security or accreditation status of the system."]
[{"$nulls":3},"RA-4.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the risk assessment update control is implemented."]
[{"$nulls":3},"RA-4.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the risk assessment for the information system on an ongoing basis."]
[{"$nulls":3},"RA-4.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the risk assessment update control are documented and the resulting information used to actively improve the control on a continuous basis."]
["STEP 2: Verify adequacy of organizational policy. "]
["Action Item 2.2"]
["Verify that the existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.","n/a","Existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.","OMB M-06-16","X","X","2. For Personally Identifiable Information accessed remotely:\na. Does the policy explicitly identify the rules for determining whether remote access is allowed?\nb. When remote access is allowed, does the policy require that this access be accomplished via a virtual private network (VPN) connection established using agency-issued authentication certificate(s) or hardware token?\nc. When remote access is allowed, does the policy identify the rules for determining whether download and remote storage of the information is allowed? (For example, the policy could permit remote access to a database, but prohibit downloading and local storage of that database.)"]
["Action Items 2.1, 2.2, and 2.3"]
["Action Item 2.1: Identify existing organizational policy that addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.                                                                                                                                   Action Item 2.2: Verify that the existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed.                                                                                                                                                                  Action Item 2.3: Revise/develop organizational policy as needed, including steps 3 and 4.","AC-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, access control policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the access control policy and associated access controls.","AC-1.1","X","X","Examine organizational records or documents to determine if access control policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"AC-1.2","X","X","Examine the access control policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"AC-1.3","X","X","Examine the access control procedures to determine if the procedures are sufficient to address all areas identified in the access control policy and all associated access controls."]
[{"$nulls":3},"AC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the access control policy and procedures control is implemented."]
[{"$nulls":3},"AC-1.5",null,"X","Examine the access control policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"AC-1.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
[{"$nulls":3},"AC-1.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access control policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AT-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, security awareness and training policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls.","AT-1.1","X","X","Examine organizational records or documents to determine if security awareness and training policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"AT-1.2","X","X","Examine the security awareness and training policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"AT-1.3","X","X","Examine the security awareness and training procedures to determine if the procedures are sufficient to address all areas identified in the security awareness and training policy and all associated security awareness and training controls."]
[{"$nulls":3},"AT-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security awareness and training policy and procedures control is implemented."]
[{"$nulls":3},"AT-1.5",null,"X","Examine the security awareness and training policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"AT-1.6",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
[{"$nulls":3},"AT-1.7",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness and training policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AU-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, audit and accountability policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.","AU-1.1","X","X","Examine organizational records or documents to determine if the audit and accountability policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"AU-1.2","X","X","Examine the audit and accountability policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"AU-1.3","X","X","Examine the audit and accountability procedures to determine if the procedures are sufficient to address all areas identified in the audit and accountability policy and all associated audit and accountability controls."]
[{"$nulls":3},"AU-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the audit and accountability policy and procedures control is implemented."]
[{"$nulls":3},"AU-1.5",null,"X","Examine the audit and accountability policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"AU-1.6",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently applies the audit and accountability policy and procedures on an ongoing basis."]
[{"$nulls":3},"AU-1.7",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit and accountability policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"IA-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, identification and authentication policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.","IA-1.1","X","X","Examine organizational records or documents to determine if identification and authentication policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"IA-1.2","X","X","Examine the identification and authentication policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"IA-1.3","X","X","Examine the identification and authentication procedures to determine if the procedures are sufficient to address all areas identified in the identification and authentication policy and all associated identification and authentication controls."]
[{"$nulls":3},"IA-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the identification and authentication policy and procedures control is implemented."]
[{"$nulls":3},"IA-1.5",null,"X","Examine the identification and authentication policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"IA-1.6",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently applies the identification and authentication policy and procedures on an ongoing basis."]
[{"$nulls":3},"IA-1.7",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the identification and authentication policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"MP-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, media protection policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the media protection policy and associated media protection controls.","MP-1.1","X","X","Examine organizational records or documents to determine if the media protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"MP-1.2","X","X","Examine the media protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"MP-1.3","X","X","Examine the media protection procedures to determine if the procedures are sufficient to address all areas identified in the media protection policy and all associated media protection controls."]
[{"$nulls":3},"MP-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the media protection policy and procedures control is implemented."]
[{"$nulls":3},"MP-1.5",null,"X","Examine the media protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"MP-1.6",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the media protection policy and procedures on an ongoing basis."]
[{"$nulls":3},"MP-1.7",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-1 ","The organization develops, disseminates, and periodically reviews/updates: (i) a formal, documented, system and communications protection policy that addresses purpose, scope, roles, responsibilities, and compliance; and (ii) formal, documented procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls","SC-1.1","X","X","Examine organizational records or documents to determine if system and communications protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
[{"$nulls":3},"SC-1.2","X","X","Examine the system and communications protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
[{"$nulls":3},"SC-1.3","X","X","Examine the system and communications protection procedures to determine if the procedures are sufficient to address all areas identified in the system and communications protection policy and all associated system and communications protection controls."]
[{"$nulls":3},"SC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the system and communications protection policy and procedures control is implemented."]
[{"$nulls":3},"SC-1.5",null,"X","Examine the system and communications protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
[{"$nulls":3},"SC-1.6",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the system and communications protection policy and procedures on an ongoing basis."]
[{"$nulls":3},"SC-1.7",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the system and communications protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["STEP 4: Implement protections for remote access to personally identifiable information.  If personally identifiable information is to be transported and/or stored offiste, follow Step 3; for remote access to personally identifiable information, follow Step 4. "]
["Action Item 4.1"]
["Implement NIST Special Publication 800-53 security controls requiring authenticated, virtual private network (VPN) connection.","AC-17 ","The organization documents, monitors, and controls all methods of remote access (e.g., dial-up, Internet) to the information system including remote access for privileged functions. Appropriate organization officials authorize each remote access method for the information system and authorize only the necessary users for each access method.\nControl enhancement: \n(1) The organization employs automated mechanisms to facilitate the monitoring and control of remote access methods. \n\n(2) The organization uses encryption to protect the confidentiality of remote access sessions. \n\n(3) The organization controls all remote accesses through a managed access control point. ","AC-17.1","X","X","Examine organizational records or documents to determine if remote access is: (i) monitored on a periodic basis in accordance with organization policy; (ii) restricted through dial-up connections or protects against unauthorized connections or subversion of unauthorized connections; (iii) authorized and restricted to users with an operational need for access; and (iv) restricted to only allow privileged access based on compelling operational needs."]
[{"$nulls":3},"AC-17.2","X","X","Examine organizational records or documents to determine if remote access activity is being recorded in logs and reviewed periodically in accordance with the organizational policy and procedures."]
[{"$nulls":3},"AC-17.3","X","X","Examine organizational records or documents to determine if remote access is documented and authorized by the appropriate organization officials."]
[{"$nulls":3},"AC-17.4","X","X","Examine the configuration of the information system to determine if controls are employed to restrict remote access to the system."]
[{"$nulls":3},"AC-17.5","X","X","Examine a system-generated list of user accounts with remote access and determine if the established procedures are followed to authorize remote access for the accounts."]
[{"$nulls":3},"AC-17.6","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the remote access control is implemented."]
[{"$nulls":3},"AC-17.7","X","X","Test the remote access controls by attempting to gain remote access to the information system using a valid system account that does not have remote access permissions."]
[{"$nulls":3},"AC-17.8",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently employs remote access controls for the information system on an ongoing basis."]
[{"$nulls":3},"AC-17.9",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the remote access control are documented and the resulting information used to actively improve the control on a continuous basis."]
[{"$nulls":3},"AC-17.10","X","X","Examine organizational records or documents to determine what automated mechanisms and functions are employed to support and facilitate the monitoring and control of remote access methods."]
[{"$nulls":3},"AC-17.11","X","X","Examine organizational records or documents to determine if the automated mechanisms supporting the monitoring and control of remote access are effectively employed in accordance with organizational policy and procedures."]
[{"$nulls":3},"AC-17.12",null,"X","Test the automated mechanism(s) within the information system to determine if each of the functions associated with the monitoring and control of remote access produce accurate and informative information, in accordance with remote access monitoring policy and procedures."]
[{"$nulls":3},"AC-17.13","X","X","Interview selected organizational personnel with access control responsibilities and examine the configuration of the information system to determine if the organization uses encryption to protect the confidentiality of remote access sessions."]
[{"$nulls":3},"AC-17.14",null,"X","Examine a remote access connection to the information system to determine if the connection requires the use of encryption and encryption is actually employed."]
[{"$nulls":3},"AC-17.15","X","X","Interview selected organizational personnel with access control responsibilities and examine the configuration of the information system to determine if the organization controls remote access through a managed access control point."]
[{"$nulls":3},"AC-17.16",null,"X","Test remote access controls by attempting to connect remotely to the information system without connecting through the managed access control point to determine if remote access can be achieved without following organizational policy and procedures."]
[null,"IA-5 ","The organization manages information system authenticators (e.g., tokens, PKI certificates, biometrics, passwords, key cards) by: (i) defining initial authenticator content; (ii) establishing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators; and (iii) changing default authenticators upon information system installation.","IA-5.1","X","X","Examine organizational records or documents and the information system configuration settings to determine if the system protects passwords from unauthorized disclosure and modification when stored and transmitted, prohibits passwords from being displayed when entered, enforces password minimum and maximum lifetime restrictions, and prohibits password reuse for a specified number of generations."]
[{"$nulls":3},"IA-5.2","X","X","Examine organizational records or documents to determine if the organization establishes administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators."]
[{"$nulls":3},"IA-5.3","X","X","Examine organizational records or documents to determine if the organization changes default authenticators upon information system installation."]
[{"$nulls":3},"IA-5.4","X","X","Interview selected organizational personnel with identification and authentication responsibilities to determine if users take reasonable measures to safeguard authenticators including maintaining possession of their individual authenticators, not loaning or sharing authenticators with others, and reporting lost or compromised authenticators immediately."]
[{"$nulls":3},"IA-5.5","X","X","Examine organizational records or documents to determine if the information system establishes user control of the corresponding private key and maps the authenticated identity to the user account (for PKI-based authentication)."]
[{"$nulls":3},"IA-5.6","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the authenticator management control is implemented."]
[{"$nulls":3},"IA-5.7",null,"X","Test the information system to determine if the system protects passwords from unauthorized disclosure and modification when stored and transmitted, prohibits passwords from being displayed when entered, enforces password minimum and maximum lifetime restrictions, and prohibits password reuse for a specified number of generations."]
[{"$nulls":3},"IA-5.8",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently manages authenticators for the information system on an ongoing basis."]
[{"$nulls":3},"IA-5.9",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the authenticator management control are documented and the resulting information used to actively improve the control on a continuous basis."]
["Action Item 4.2"]
["Implement NIST Special Publication 800-53 security controls enforcing allowed downloading of personally identifiable information.","AC-3 ","The information system enforces assigned authorizations for controlling access to the system in accordance with applicable policy.\n\nControl enhancement: \n(1) The information system ensures that access to security functions (deployed in hardware, software, and firmware) and information is restricted to authorized personnel (e.g., security administrators). ","AC-3.1","X","X","Examine organizational records or documents to determine if user access to the information system is authorized."]
[{"$nulls":3},"AC-3.2","X","X","Examine access control mechanisms to determine if the information system is configured to implement the organizational access control policy."]
[{"$nulls":3},"AC-3.3","X","X","Examine the user access rights on the information system to determine if user privileges on the system are consistent with the documented user authorizations."]
[{"$nulls":3},"AC-3.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the access enforcement control is implemented."]
[{"$nulls":3},"AC-3.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces assigned authorizations for controlling access to the system on an ongoing basis."]
[{"$nulls":3},"AC-3.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access enforcement control are documented and the resulting information used to actively improve the control on a continuous basis."]
[{"$nulls":3},"AC-3.7",null,"X","Examine organizational records or documents to determine if the organization explicitly defines security functions for the information system."]
[{"$nulls":3},"AC-3.8",null,"X","Examine organizational records or documents to determine if the organization properly authorizes personnel granted access to security functions and information in accordance with organizational policy."]
[{"$nulls":3},"AC-3.9",null,"X","Test selected accounts that have access to information system security functions to determine if the user privileges for those accounts function as documented in accordance with authorization requirements."]
[null,"AC-4 ","The information system enforces assigned authorizations for controlling the flow of information within the system and between interconnected systems in accordance with applicable policy.","AC-4.1","X","X","Examine information system interconnection agreements to determine if the agreements address: (i) the types of permissible and impermissible flow of information between systems; and (ii) the required level of authorization to allow information flow as defined in the information flow enforcement policy and procedures."]
[{"$nulls":3},"AC-4.2","X","X","Examine information system configuration settings to determine if controls are in place to restrict the flow of information within the system and between interconnected systems in accordance with the applicable policy, procedures, and assigned authorizations."]
[{"$nulls":3},"AC-4.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the information flow enforcement control is implemented."]
[{"$nulls":3},"AC-4.4",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces assigned authorizations for controlling the flow of information within the system and between interconnected systems on an ongoing basis."]
[{"$nulls":3},"AC-4.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information flow enforcement control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AC-6 ","The information system enforces the most restrictive set of rights/privileges or accesses needed by users (or processes acting on behalf of users) for the performance of specified tasks.","AC-6.1","X","X","Examine organizational records or documents to determine if the organization assigns the most restrictive set of rights/privileges or accesses needed by users for the performance of specified tasks."]
[{"$nulls":3},"AC-6.2","X","X","Examine organizational records or documents to determine what access rights/privileges the organization assigns to user tasks."]
[{"$nulls":3},"AC-6.3","X","X","Examine selected user accounts on the information system to determine if the access rights/privileges correspond to the authorized permissions on access documentation for specified tasks."]
[{"$nulls":3},"AC-6.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the least privilege control is implemented."]
[{"$nulls":3},"AC-6.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces the most restrictive set of rights/privileges or accesses needed by users on an ongoing basis."]
[{"$nulls":3},"AC-6.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the least privilege control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AC-13 ","The organization supervises and reviews the activities of users with respect to the enforcement and usage of information system access controls.\nControl enhancement: \n(1) The organization employs automated mechanisms to facilitate the review of user activities.","AC-13.1","X","X","Interview selected organizational personnel with access control responsibilities to determine if the organization supervises and reviews the activities of users of the information system."]
[{"$nulls":3},"AC-13.2","X","X","Examine organizational records or documents to determine if unusual activity is investigated, reported to appropriate officials, and resolved."]
[{"$nulls":3},"AC-13.3","X","X","Examine organizational records of supervisory notices or disciplinary actions to users to determine if the organization is supervising user activities regarding the use and application of information system access controls."]
[{"$nulls":3},"AC-13.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the supervision and review of access control is implemented."]
[{"$nulls":3},"AC-13.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently supervises and reviews user activities with respect to the enforcement and use of access controls for the information system on an ongoing basis."]
[{"$nulls":3},"AC-13.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the supervision and review of access control are documented and the resulting information used to actively improve the control on a continuous basis."]
[{"$nulls":3},"AC-13.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization employs automated mechanisms within the information system to support and facilitate the review of user and how those mechanisms are implemented."]
[{"$nulls":3},"AC-13.8",null,"X","Examine the configuration of the automated mechanism(s) within the information system to determine if the mechanisms support the review of user activities."]
[{"$nulls":3},"AC-13.9",null,"X","Examine the output from the automated mechanism(s) within the information system to determine if each of the automated functions associated with the review of user activities produces accurate and informative information to support and facilitate the review of user activities with respect to access control enforcement and usage."]
[null,"AU-2 ","The information system generates audit records for the following events: [Assignment: organization-defined auditable events].","AU-2.1","X","X","Examine organizational records or documents and the information system configuration settings to determine if the system generates audit records for the organization-defined auditable events."]
[{"$nulls":3},"AU-2.2","X","X","Test the information system by attempting to perform actions that are configured to generate an audit record."]
[{"$nulls":3},"AU-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the auditable events control is implemented."]
[{"$nulls":3},"AU-2.4",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the information system consistently generates audit records for auditable events on an ongoing basis."]
[{"$nulls":3},"AU-2.5",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the auditable events control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AU-6 ","The organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity, investigates suspicious activity or suspected violations, reports findings to appropriate officials, and takes necessary actions. \nControl enhancement: \n(1) The organization employs automated mechanisms to integrate audit monitoring, analysis, and reporting into an overall process for investigation and response to suspicious activities.                                                                                                                                                                         (2) The organization employs automated mechanisms to immediately alert security personnel of inappropriate or unusual activities with security implications.","AU-6.1","X","X","Examine organizational records or documents to determine if the organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity, investigates suspicious activity or suspected violations, reports findings to appropriate officials, and takes necessary actions."]
[{"$nulls":3},"AU-6.2","X","X","Test the audit monitoring, analysis and reporting process to determine if the organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity, investigates suspicious activity or suspected violations, reports findings to appropriate officials, and takes necessary actions by artificially generating auditable events to cause an audit failure or suspicious activity condition and monitoring how the organization reacts."]
[{"$nulls":3},"AU-6.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the audit monitoring, analysis, and reporting control is implemented."]
[{"$nulls":3},"AU-6.4",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently conducts audit monitoring, analysis, and reporting on an ongoing basis."]
[{"$nulls":3},"AU-6.5",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit monitoring, analysis, and reporting control are documented and the resulting information used to actively improve the control on a continuous basis."]
[{"$nulls":3},"AU-6.6",null,"X","Examine organizational records or documents and the information system configuration to determine if the organization employs automated mechanisms to integrate audit monitoring, analysis, and reporting into  overall process for investigation and response to suspicious activities."]
[{"$nulls":3},"AU-6.7",null,"X","Test the information system configuration to determine if the organization employs automated mechanisms to integrate audit monitoring, analysis, and reporting into an overall process for investigation and response to suspicious activities by artificially generating auditable events and monitoring the results."]
["Action Item 4.3 -- If remote storage of personally identifiable information is to be permitted follow Action Item 4.3, otherwise follow Action Item 4.4. "]
["Implement NIST Special Publication 800-53 security controls enforcing encrypted remote storage of personally identifiable information.","PL-4 ","The organization establishes and makes readily available to all information system users a set of rules that describes their responsibilities and expected behavior with regard to information system usage. The organization receives signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to the information system.","PL-4.1","X","X","Examine organizational records or documents to determine if the organization provides and makes readily available to all information system users a set of rules that describes users responsibilities and expected behavior with regard to information and information system usage."]
[{"$nulls":3},"PL-4.2","X","X","Examine organizational records or documents to determine if the organization receives a signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to the information system and its resident information."]
[{"$nulls":3},"PL-4.3","X","X","Examine the rules of behavior to determine if the content is consistent with NIST Special Publication 800-18."]
[{"$nulls":3},"PL-4.4","X","X","Interview selected organizational personnel to determine if they understand the rules of behavior for the information system."]
[{"$nulls":3},"PL-4.5","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the rules of behavior control is implemented."]
[{"$nulls":3},"PL-4.6",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the rules of behavior on an ongoing basis."]
[{"$nulls":3},"PL-4.7",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the rules of behavior control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-4 ","The information system prevents unauthorized and unintended information transfer via shared system resources.","SC-4.1","X","X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system prevents unauthorized and unintended information transfer via shared system resources and how the system prevents the transfer."]
[{"$nulls":3},"SC-4.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the information remnants control is implemented."]
[{"$nulls":3},"SC-4.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system employs appropriate mechanisms to consistently prevent unauthorized and unintended transfer of information via shared system resources on an ongoing basis."]
[{"$nulls":3},"SC-4.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information remnants control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"SC-13 ","When cryptography is employed within the information system, the system performs all cryptographic operations (including key generation) using FIPS 140-2 validated cryptographic modules operating in approved modes of operation.","SC-13.1","X","X","Examine organizational records or documents (including developer design documentation) to determine if the employed cryptography complies with applicable federal laws, directives, policies, regulations, standards, and guidance, including FIPS 140-2 which requires the system to perform all cryptographic operations (including key generation) using FIPS 140-2 validated cryptographic modules operating in approved modes of operation."]
[{"$nulls":3},"SC-13.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the use of validated cryptography control is implemented."]
[{"$nulls":3},"SC-13.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently uses validated cryptography within the information system on an ongoing basis."]
[{"$nulls":3},"SC-13.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the use of validated cryptography control are documented and the resulting information used to actively improve the control on a continuous basis."]
["Action Item 4.4"]
["Implement NIST Special Publication 800-53 security controls enforcing no remote storage of personally identifiable information.","AC-3 ","See above under Action Item 4.2"]
[null,"AC-4 ","See above under Action Item 4.2"]
[null,"AC-6 ","See above under Action Item 4.2"]
[null,"AC-13 ","See above under Action Item 4.2"]
[null,"AC-17 ","See above under Action Item 4.1"]
[null,"AT-2 ","The organization ensures all users (including managers and senior executives) are exposed to basic information system security awareness materials before authorizing access to the system and [Assignment: organization-defined frequency, at least annually] thereafter.","AT-2.1","X","X","Examine organizational records or documents to determine if: (i) security awareness instruction is provided to all users; (ii) records include the type of instruction received and the date completed; and (iii) initial and refresher instruction is provided in accordance with organization-defined frequency, at least annually."]
[{"$nulls":3},"AT-2.2","X","X","Examine security awareness instructional materials to determine if the materials address the specific requirements of the organization and the information systems to which personnel have authorized access."]
[{"$nulls":3},"AT-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security awareness control is implemented."]
[{"$nulls":3},"AT-2.4",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently conducts security awareness instruction on an ongoing basis."]
[{"$nulls":3},"AT-2.5",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness control are documented and the resulting information used to actively improve the control on a continuous basis."]
[null,"AU-2 ","See above under Action Item 4.2"]
[null,"AU-6 ","See above under Action Item 4.2"]
[null,"PL-4 ","See above under Action Item 4.3"]
[null,"SC-4 ","See above under Action Item 4.3"]
[]
["NOTE:  Add controls and assessment procedures associated with specific technology associated with the system."]

{"sheet":"Interview - Remote Access","index":6,"n_rows":53,"n_cols":7,"rows_kept":53,"merged":[[0,0,0,6],[1,0,1,6]],"flags":["formulas_cached_only"]}
["OMB M-06-16 Security Assessment Plan "]
["For System: xxxxxxxxxxxxxxxxxxxxxxxx"]
["NIST SP 800-53A Assessment Identifier","Moderate-impact system applicable","High-impact system applicable","NIST SP 800-53A Assessment Interview Procedural Statements","Fully Satisfied (FS), Partially Satisfied (PS), Not Satisfied (NS)","Additional Test Steps/Summary Comment for Test Results and Mitigation Requirements/POAM (include references to other supporting documentation)","Assessment Completed by:                           Date Completed:"]
["AC-13.1","X","X","Interview selected organizational personnel with access control responsibilities to determine if the organization supervises and reviews the activities of users of the information system."]
["AC-17.13","X","X","Interview selected organizational personnel with access control responsibilities and examine the configuration of the information system to determine if the organization uses encryption to protect the confidentiality of remote access sessions."]
["AC-17.15","X","X","Interview selected organizational personnel with access control responsibilities and examine the configuration of the information system to determine if the organization controls remote access through a managed access control point."]
["IA-5.4","X","X","Interview selected organizational personnel with identification and authentication responsibilities to determine if users take reasonable measures to safeguard authenticators including maintaining possession of their individual authenticators, not loaning or sharing authenticators with others, and reporting lost or compromised authenticators immediately."]
["PL-4.4","X","X","Interview selected organizational personnel to determine if they understand the rules of behavior for the information system."]
["RA-2.2","X","X","Interview selected organizational personnel with risk assessment responsibilities to determine if the security categorization process is conducted as an organization-wide exercise with the involvement of senior-level officials including, but not limited to, authorizing officials, information system owners, chief information officer, senior agency information security officer, and information owners."]
["SC-4.1","X","X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system prevents unauthorized and unintended information transfer via shared system resources and how the system prevents the transfer."]
["AC-1.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
["AC-1.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access control policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-13.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently supervises and reviews user activities with respect to the enforcement and use of access controls for the information system on an ongoing basis."]
["AC-13.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the supervision and review of access control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-13.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization employs automated mechanisms within the information system to support and facilitate the review of user and how those mechanisms are implemented."]
["AC-17.8",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently employs remote access controls for the information system on an ongoing basis."]
["AC-17.9",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the remote access control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-3.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces assigned authorizations for controlling access to the system on an ongoing basis."]
["AC-3.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access enforcement control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-4.4",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces assigned authorizations for controlling the flow of information within the system and between interconnected systems on an ongoing basis."]
["AC-4.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information flow enforcement control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-6.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces the most restrictive set of rights/privileges or accesses needed by users on an ongoing basis."]
["AC-6.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the least privilege control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AT-1.6",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
["AT-1.7",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness and training policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AT-2.4",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently conducts security awareness instruction on an ongoing basis."]
["AT-2.5",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AU-1.6",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently applies the audit and accountability policy and procedures on an ongoing basis."]
["AU-1.7",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit and accountability policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AU-2.4",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the information system consistently generates audit records for auditable events on an ongoing basis."]
["AU-2.5",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the auditable events control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AU-6.4",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently conducts audit monitoring, analysis, and reporting on an ongoing basis."]
["AU-6.5",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit monitoring, analysis, and reporting control are documented and the resulting information used to actively improve the control on a continuous basis."]
["IA-1.6",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently applies the identification and authentication policy and procedures on an ongoing basis."]
["IA-1.7",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the identification and authentication policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["IA-5.8",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently manages authenticators for the information system on an ongoing basis."]
["IA-5.9",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the authenticator management control are documented and the resulting information used to actively improve the control on a continuous basis."]
["MP-1.6",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the media protection policy and procedures on an ongoing basis."]
["MP-1.7",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["PL-4.6",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the rules of behavior on an ongoing basis."]
["PL-4.7",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the rules of behavior control are documented and the resulting information used to actively improve the control on a continuous basis."]
["PL-5.3",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently conducts privacy impact assessments on the information system on an ongoing basis."]
["PL-5.4",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the privacy impact assessment control are documented and the resulting information used to actively improve the control on a continuous basis."]
["RA-2.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently conducts security categorizations of the information system on an ongoing basis."]
["RA-2.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security categorization control are documented and the resulting information used to actively improve the control on a continuous basis."]
["RA-4.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the risk assessment for the information system on an ongoing basis."]
["RA-4.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the risk assessment update control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-1.6",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the system and communications protection policy and procedures on an ongoing basis."]
["SC-1.7",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the system and communications protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-13.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently uses validated cryptography within the information system on an ongoing basis."]
["SC-13.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the use of validated cryptography control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-4.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system employs appropriate mechanisms to consistently prevent unauthorized and unintended transfer of information via shared system resources on an ongoing basis."]
["SC-4.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information remnants control are documented and the resulting information used to actively improve the control on a continuous basis."]

{"sheet":"Examine - Remote Access","index":7,"n_rows":134,"n_cols":7,"rows_kept":134,"merged":[[0,0,0,6],[1,0,1,6]],"flags":["formulas_cached_only"]}
["OMB M-06-16 Security Assessment Plan "]
["For System: xxxxxxxxxxxxxxxxxxxxxxxx"]
["NIST SP 800-53A Assessment Identifier","Moderate-impact system applicable","High-impact system applicable","NIST SP 800-53A Assessment Examine Procedural Statements","Fully Satisfied (FS), Partially Satisfied (PS), Not Satisfied (NS)","Additional Test Steps/Summary Comment for Test Results and Mitigation Requirements/POAM (include references to other supporting documentation)","Assessment Completed by:                           Date Completed:"]
["AC-1.1","X","X","Examine organizational records or documents to determine if access control policy and procedures: (i) exist; (ii) are documented; (iii) are\ndisseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and\n(v) are updated, when organizational review indicates updates are required."]
["AC-1.2","X","X","Examine the access control policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["AC-1.3","X","X","Examine the access control procedures to determine if the procedures are sufficient to address all areas identified in the access control policy and all associated access controls."]
["AC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the access control policy and procedures control is implemented."]
["AC-1.5",null,"X","Examine the access control policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["AC-1.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
["AC-1.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access control policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-13.2","X","X","Examine organizational records or documents to determine if unusual activity is investigated, reported to appropriate officials, and resolved."]
["AC-13.3","X","X","Examine organizational records of supervisory notices or disciplinary actions to users to determine if the organization is supervising user activities regarding the use and application of information system access controls."]
["AC-13.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the supervision and review of access control is implemented."]
["AC-13.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently supervises and reviews user activities with respect to the enforcement and use of access controls for the information system on an ongoing basis."]
["AC-13.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the supervision and review of access control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-13.7",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization employs automated mechanisms within the information system to support and facilitate the review of user and how those mechanisms are implemented."]
["AC-13.8",null,"X","Examine the configuration of the automated mechanism(s) within the information system to determine if the mechanisms support the review of user activities."]
["AC-13.9",null,"X","Examine the output from the automated mechanism(s) within the information system to determine if each of the automated functions associated with the review of user activities produces accurate and informative information to support and facilitate the review of user activities with respect to access control enforcement and usage."]
["AC-17.1","X","X","Examine organizational records or documents to determine if remote access is: (i) monitored on a periodic basis in accordance with organization policy; (ii) restricted through dial-up connections or protects against unauthorized connections or subversion of unauthorized connections; (iii) authorized and restricted to users with an operational need for access; and (iv) restricted to only allow privileged access based on compelling operational needs."]
["AC-17.10","X","X","Examine organizational records or documents to determine what automated mechanisms and functions are employed to support and facilitate the monitoring and control of remote access methods."]
["AC-17.11","X","X","Examine organizational records or documents to determine if the automated mechanisms supporting the monitoring and control of remote access are effectively employed in accordance with organizational policy and procedures."]
["AC-17.13","X","X","Interview selected organizational personnel with access control responsibilities and examine the configuration of the information system to determine if the organization uses encryption to protect the confidentiality of remote access sessions."]
["AC-17.14",null,"X","Examine a remote access connection to the information system to determine if the connection requires the use of encryption and encryption is actually employed."]
["AC-17.15","X","X","Interview selected organizational personnel with access control responsibilities and examine the configuration of the information system to determine if the organization controls remote access through a managed access control point."]
["AC-17.2","X","X","Examine organizational records or documents to determine if remote access activity is being recorded in logs and reviewed periodically in accordance with the organizational policy and procedures."]
["AC-17.3","X","X","Examine organizational records or documents to determine if remote access is documented and authorized by the appropriate organization officials."]
["AC-17.4","X","X","Examine the configuration of the information system to determine if controls are employed to restrict remote access to the system."]
["AC-17.5","X","X","Examine a system-generated list of user accounts with remote access and determine if the established procedures are followed to authorize remote access for the accounts."]
["AC-17.6","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the remote access control is implemented."]
["AC-17.8",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the organization consistently employs remote access controls for the information system on an ongoing basis."]
["AC-17.9",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the remote access control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-3.1","X","X","Examine organizational records or documents to determine if user access to the information system is authorized."]
["AC-3.2","X","X","Examine access control mechanisms to determine if the information system is configured to implement the organizational access control policy."]
["AC-3.3","X","X","Examine the user access rights on the information system to determine if user privileges on the system are consistent with the documented user authorizations."]
["AC-3.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the access enforcement control is implemented."]
["AC-3.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces assigned authorizations for controlling access to the system on an ongoing basis."]
["AC-3.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the access enforcement control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-3.7",null,"X","Examine organizational records or documents to determine if the organization explicitly defines security functions for the information system."]
["AC-3.8",null,"X","Examine organizational records or documents to determine if the organization properly authorizes personnel granted access to security functions and information in accordance with organizational policy."]
["AC-4.1","X","X","Examine information system interconnection agreements to determine if the agreements address: (i) the types of permissible and impermissible flow of information between systems; and (ii) the required level of authorization to allow information flow as defined in the information flow enforcement policy and procedures."]
["AC-4.2","X","X","Examine information system configuration settings to determine if controls are in place to restrict the flow of information within the system and between interconnected systems in accordance with the applicable policy, procedures, and assigned authorizations."]
["AC-4.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the information flow enforcement control is implemented."]
["AC-4.4",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces assigned authorizations for controlling the flow of information within the system and between interconnected systems on an ongoing basis."]
["AC-4.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information flow enforcement control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AC-6.1","X","X","Examine organizational records or documents to determine if the organization assigns the most restrictive set of rights/privileges or accesses needed by users for the performance of specified tasks."]
["AC-6.2","X","X","Examine organizational records or documents to determine what access rights/privileges the organization assigns to user tasks."]
["AC-6.3","X","X","Examine selected user accounts on the information system to determine if the access rights/privileges correspond to the authorized permissions on access documentation for specified tasks."]
["AC-6.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the least privilege control is implemented."]
["AC-6.5",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if the information system consistently enforces the most restrictive set of rights/privileges or accesses needed by users on an ongoing basis."]
["AC-6.6",null,"X","Interview selected organizational personnel with access control responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the least privilege control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AT-1.1","X","X","Examine organizational records or documents to determine if security awareness and training policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["AT-1.2","X","X","Examine the security awareness and training policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["AT-1.3","X","X","Examine the security awareness and training procedures to determine if the procedures are sufficient to address all areas identified in the security awareness and training policy and all associated security awareness and training controls."]
["AT-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security awareness and training policy and procedures control is implemented."]
["AT-1.5",null,"X","Examine the security awareness and training policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["AT-1.6",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently applies the access control policy and procedures on an ongoing basis."]
["AT-1.7",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness and training policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AT-2.1","X","X","Examine organizational records or documents to determine if the audit and accountability policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["AT-2.2","X","X","Examine the audit and accountability policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["AT-2.3","X","X","Examine the audit and accountability procedures to determine if the procedures are sufficient to address all areas identified in the audit and accountability policy and all associated audit and accountability controls."]
["AT-2.4",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if the organization consistently conducts security awareness instruction on an ongoing basis."]
["AT-2.5",null,"X","Interview selected organizational personnel with security awareness and training responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security awareness control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AU-1.1","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the audit and accountability policy and procedures control is implemented."]
["AU-1.2","X","X","Examine the audit and accountability policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["AU-1.3","X","X","Examine the audit and accountability procedures to determine if the procedures are sufficient to address all areas identified in the audit and accountability policy and all associated audit and accountability controls."]
["AU-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the access control policy and procedures control is implemented."]
["AU-1.5",null,"X","Examine the access control policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["AU-1.6",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently applies the audit and accountability policy and procedures on an ongoing basis."]
["AU-1.7",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit and accountability policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AU-2.1","X","X","Examine organizational records or documents and the information system configuration settings to determine if the system generates audit records for the organization-defined auditable events."]
["AU-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the auditable events control is implemented."]
["AU-2.4",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the information system consistently generates audit records for auditable events on an ongoing basis."]
["AU-2.5",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the auditable events control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AU-6.1","X","X","Examine organizational records or documents to determine if the organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity, investigates suspicious activity or suspected violations, reports findings to appropriate officials, and takes necessary actions."]
["AU-6.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the audit monitoring, analysis, and reporting control is implemented."]
["AU-6.4",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if the organization consistently conducts audit monitoring, analysis, and reporting on an ongoing basis."]
["AU-6.5",null,"X","Interview selected organizational personnel with audit and accountability responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the audit monitoring, analysis, and reporting control are documented and the resulting information used to actively improve the control on a continuous basis."]
["AU-6.6",null,"X","Examine organizational records or documents and the information system configuration to determine if the organization employs automated mechanisms to integrate audit monitoring, analysis, and reporting into  overall process for investigation and response to suspicious activities."]
["IA-1.1","X","X","Examine organizational records or documents to determine if identification and authentication policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["IA-1.2","X","X","Examine the identification and authentication policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["IA-1.3","X","X","Examine the identification and authentication procedures to determine if the procedures are sufficient to address all areas identified in the identification and authentication policy and all associated identification and authentication controls."]
["IA-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the identification and authentication policy and procedures control is implemented."]
["IA-1.5",null,"X","Examine the identification and authentication policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["IA-1.6",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently applies the identification and authentication policy and procedures on an ongoing basis."]
["IA-1.7",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the identification and authentication policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["IA-5.1","X","X","Examine organizational records or documents and the information system configuration settings to determine if the system protects passwords from unauthorized disclosure and modification when stored and transmitted, prohibits passwords from being displayed when entered, enforces password minimum and maximum lifetime restrictions, and prohibits password reuse for a specified number of generations."]
["IA-5.2","X","X","Examine organizational records or documents to determine if the organization establishes administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators."]
["IA-5.3","X","X","Examine organizational records or documents to determine if the organization changes default authenticators upon information system installation."]
["IA-5.5","X","X","Examine organizational records or documents to determine if the information system establishes user control of the corresponding private key and maps the authenticated identity to the user account (for PKI-based authentication)."]
["IA-5.6","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the authenticator management control is implemented."]
["IA-5.8",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if the organization consistently manages authenticators for the information system on an ongoing basis."]
["IA-5.9",null,"X","Interview selected organizational personnel with identification and authentication responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the authenticator management control are documented and the resulting information used to actively improve the control on a continuous basis."]
["MP-1.1","X","X","Examine organizational records or documents to determine if the media protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["MP-1.2","X","X","Examine the media protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["MP-1.3","X","X","Examine the media protection procedures to determine if the procedures are sufficient to address all areas identified in the media protection policy and all associated media protection controls."]
["MP-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the media protection policy and procedures control is implemented."]
["MP-1.5",null,"X","Examine the media protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["MP-1.6",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the media protection policy and procedures on an ongoing basis."]
["MP-1.7",null,"X","Interview selected organizational personnel with media protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the media protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["OMB M-06-16","X","X","2. For Personally Identifiable Information accessed remotely:\na. Does the policy explicitly identify the rules for determining whether remote access is allowed?\nb. When remote access is allowed, does the policy require that this access be accomplished via a virtual private network (VPN) connection established using agency-issued authentication certificate(s) or hardware token?\nc. When remote access is allowed, does the policy identify the rules for determining whether download and remote storage of the information is allowed? (For example, the policy could permit remote access to a database, but prohibit downloading and local storage of that database.)"]
["PL-4.1","X","X","Examine organizational records or documents to determine if the organization provides and makes readily available to all information system users a set of rules that describes users responsibilities and expected behavior with regard to information and information system usage."]
["PL-4.2","X","X","Examine organizational records or documents to determine if the organization receives a signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to the information system and its resident information."]
["PL-4.3","X","X","Examine the rules of behavior to determine if the content is consistent with NIST Special Publication 800-18."]
["PL-4.5","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the rules of behavior control is implemented."]
["PL-4.6",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the rules of behavior on an ongoing basis."]
["PL-4.7",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the rules of behavior control are documented and the resulting information used to actively improve the control on a continuous basis."]
["PL-5.1","X","X","Examine organizational records or documents to determine if the organization conducts a privacy impact assessment on the information system."]
["PL-5.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the privacy impact assessment control is implemented."]
["PL-5.3",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if the organization consistently conducts privacy impact assessments on the information system on an ongoing basis."]
["PL-5.4",null,"X","Interview selected organizational personnel with security planning and plan implementation responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the privacy impact assessment control are documented and the resulting information used to actively improve the control on a continuous basis."]
["RA-2.1","X","X","Examine the system security plan to determine if the security categorization of the information system: (i) exists; (ii) is consistent with FIPS 199; (iii) includes supporting rationale consistent with NIST Special Publication 800-60; and (iv) is reviewed and approved by designated senior-level officials within the organization."]
["RA-2.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the security categorization control is implemented."]
["RA-2.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently conducts security categorizations of the information system on an ongoing basis."]
["RA-2.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the security categorization control are documented and the resulting information used to actively improve the control on a continuous basis."]
["RA-4.1",null,null,"Examine organizational records or documents to determine if the risk assessment is updated in accordance with organization-defined frequency or whenever there are significant changes to the information system, the facilities where the system resides, or other conditions that may impact the security or accreditation status of the system."]
["RA-4.2","X","X","Examine the risk assessment to determine if the report reflects the latest significant changes to the information system, the facilities where the system resides, or other conditions that may have impacted the security or accreditation status of the system."]
["RA-4.3","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the risk assessment update control is implemented."]
["RA-4.4",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if the organization consistently reviews and updates the risk assessment for the information system on an ongoing basis."]
["RA-4.5",null,"X","Interview selected organizational personnel with risk assessment responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the risk assessment update control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-1.1","X","X","Examine organizational records or documents to determine if system and communications protection policy and procedures: (i) exist; (ii) are documented; (iii) are disseminated to appropriate elements within the organization; (iv) are periodically reviewed by responsible parties within the organization; and (v) are updated, when organizational review indicates updates are required."]
["SC-1.2","X","X","Examine the system and communications protection policy to determine if the policy adequately addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance."]
["SC-1.3","X","X","Examine the system and communications protection procedures to determine if the procedures are sufficient to address all areas identified in the system and communications protection policy and all associated system and communications protection controls."]
["SC-1.4","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the system and communications protection policy and procedures control is implemented."]
["SC-1.5",null,"X","Examine the system and communications protection policy to determine if the policy is consistent with the organization’s mission, functions, and associated laws, directives, policies regulations, standards, and guidance."]
["SC-1.6",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently applies the system and communications protection policy and procedures on an ongoing basis."]
["SC-1.7",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the system and communications protection policy and procedures control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-13.1","X","X","Examine organizational records or documents (including developer design documentation) to determine if the employed cryptography complies with applicable federal laws, directives, policies, regulations, standards, and guidance, including FIPS 140-2 which requires the system to perform all cryptographic operations (including key generation) using FIPS 140-2 validated cryptographic modules operating in approved modes of operation."]
["SC-13.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the use of validated cryptography control is implemented."]
["SC-13.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if the organization consistently uses validated cryptography within the information system on an ongoing basis."]
["SC-13.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the use of validated cryptography control are documented and the resulting information used to actively improve the control on a continuous basis."]
["SC-4.1","X","X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system prevents unauthorized and unintended information transfer via shared system resources and how the system prevents the transfer."]
["SC-4.2","X","X","Examine organizational records or documents to determine if the organization assigns responsibility to specific parties and defines specific actions to ensure that the information remnants control is implemented."]
["SC-4.3",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents (including developer design documentation) to determine if the information system employs appropriate mechanisms to consistently prevent unauthorized and unintended transfer of information via shared system resources on an ongoing basis."]
["SC-4.4",null,"X","Interview selected organizational personnel with system and communications protection responsibilities and examine organizational records or documents to determine if anomalies or problems encountered by the organization in the implementation of the information remnants control are documented and the resulting information used to actively improve the control on a continuous basis."]

{"sheet":"Test - Remote Access","index":8,"n_rows":11,"n_cols":7,"rows_kept":11,"merged":[[0,0,0,6],[1,0,1,6]],"flags":["formulas_cached_only"]}
["OMB M-06-16 Security Assessment Plan "]
["For System: xxxxxxxxxxxxxxxxxxxxxxxx"]
["NIST SP 800-53A Assessment Identifier","Moderate-impact system applicable","High-impact system applicable","NIST SP 800-53A Assessment Test Procedural Statements","Fully Satisfied (FS), Partially Satisfied (PS), Not Satisfied (NS)","Additional Test Steps/Summary Comment for Test Results and Mitigation Requirements/POAM (include references to other supporting documentation)","Assessment Completed by:                           Date Completed:"]
["AC-17.7","X","X","Test the remote access controls by attempting to gain remote access to the information system using a valid system account that does not have remote access permissions."]
["AU-2.2","X","X","Test the information system by attempting to perform actions that are configured to generate an audit record."]
["AU-6.2","X","X","Test the audit monitoring, analysis and reporting process to determine if the organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity, investigates suspicious activity or suspected violations, reports findings to appropriate officials, and takes necessary actions by artificially generating auditable events to cause an audit failure or suspicious activity condition and monitoring how the organization reacts."]
["AC-17.12",null,"X","Test the automated mechanism(s) within the information system to determine if each of the functions associated with the monitoring and control of remote access produce accurate and informative information, in accordance with remote access monitoring policy and procedures."]
["AC-17.16",null,"X","Test remote access controls by attempting to connect remotely to the information system without connecting through the managed access control point to determine if remote access can be achieved without following organizational policy and procedures."]
["AC-3.9",null,"X","Test selected accounts that have access to information system security functions to determine if the user privileges for those accounts function as documented in accordance with authorization requirements."]
["AU-6.7",null,"X","Test the information system configuration to determine if the organization employs automated mechanisms to integrate audit monitoring, analysis, and reporting into an overall process for investigation and response to suspicious activities by artificially generating auditable events and monitoring the results."]
["IA-5.7",null,"X","Test the information system to determine if the system protects passwords from unauthorized disclosure and modification when stored and transmitted, prohibits passwords from being displayed when entered, enforces password minimum and maximum lifetime restrictions, and prohibits password reuse for a specified number of generations."]