8500-2 DIACAP - Security Controls
     

Information security controls protect the confidentiality, integrity and/or availability of information (the so-called CIA Triad). Again, some would add further categories such as non-repudiation and accountability, depending on how narrowly or broadly the CIA Triad is defined.

Individual controls are often designed to act together to increase effective protection. Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency. For example, a framework can help an organization manage controls over access regardless of the type of computer operating system. This also enables an organization to assess overall risk. Risk-aware organizations may choose proactively to specify, design, implement, operate and maintain their security controls, usually by assessing the risks and implementing a comprehensive security management framework such as ISO27001:2013, the Information Security Forum's Standard of Good Practice for Information Security, or NIST SP 800-53.

Control Impact Code MAC Level / Confidentiality Subject Area Title Description
Medium MACIII Continuity Alternate Site Designation An alternate site is identified that permits the partial restoration of mission or business essential functions.
High MACI,MACII Continuity Alternate Site Designation An alternate site is identified that permits the restoration of all mission or business essential functions.
High MACI,MACII,MACIII Continuity Protection Of Backup And Restoration Assets Procedures are in place assure the appropriate physical and technical protection of the backup and restoration hardware, firmware, and software, such as router tables, compilers, and other security-related system software.
Low MACIII Continuity Data Backup Procedures Data backup is performed at least weekly.
Medium MACII Continuity Data Backup Procedures Data backup is performed daily, and recovery media are stored off-site at a location that affords protection of the data in accordance with its mission assurance category and confidentiality level.
Medium MACI Continuity Data Backup Procedures Data backup is accomplished by maintaining a redundant secondary system, not co-located, that can be activated without loss of data or disruption to the operation.
Low MACIII Continuity Disaster And Recovery Planning A disaster plan exists that provides for the partial resumption of mission or business essential functions within 5 days of activation. (Disaster recovery procedures include business recovery plans, system contingency plans, facility disaster recovery pla
Medium MACII Continuity Disaster And Recovery Planning A disaster plan exists that provides for the resumption of mission or business essential functions within 24 hours of activation. (Disaster recovery procedures include business recovery plans, system contingency plans, facility disaster recovery plans, an
Medium MACI Continuity Disaster And Recovery Planning A disaster plan exists that provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity. (Disaster recovery procedures include business
Medium MACII,MACIII Continuity Enclave Boundary Defense Enclave boundary defense at the alternate site provides security measures equivalent to the primary site.
High MACI Continuity Enclave Boundary Defense Enclave boundary defense at the alternate site must be configured identically to that of the primary site.
Low MACII,MACIII Continuity Scheduled Exercises And Drills The continuity of operations or disaster recovery plans are exercised annually.
Medium MACI Continuity Scheduled Exercises And Drills The continuity of operations or disaster recovery plans or significant portions are exercised semi-annually.
Low MACIII Continuity Identification Of Essential Functions Mission and business essential functions are identified for priority restoration planning.
Medium MACI,MACII Continuity Identification Of Essential Functions Mission and business-essential functions are identified for priority restoration planning along with all assets supporting mission or business-essential functions (e.g., computer-based services, data and applications, communications, physical infrastructu
Low MACIII Continuity Maintenance Support Maintenance support for key IT assets is available to respond within 24 hours of failure.
Medium MACI,MACII Continuity Maintenance Support Maintenance support for key IT assets is available to respond 24 X 7 immediately upon failure.
Low MACIII Continuity Power Supply Electrical power is restored to key IT assets by manually activated power generators upon loss of electrical power from the primary source.
Medium MACII Continuity Power Supply Electrical systems are configured to allow continuous or uninterrupted power to key IT assets. This may include an uninterrupted power supply coupled with emergency generators.
Medium MACI Continuity Power Supply Electrical systems are configured to allow continuous or uninterrupted power to key IT assets and all users accessing the key IT assets to perform mission or business-essential functions. This may include an uninterrupted power supply coupled with emergen
Low MACII,MACIII Continuity Spares And Parts Maintenance spares and spare parts for key IT assets can be obtained within 24 hours of failure.
Medium MACI Continuity Spares And Parts Maintenance spares and spare parts for key IT assets are available 24 X 7 immediately upon failure.
High MACI,MACII,MACIII Continuity Backup Copies Of Critical Sw Back-up copies of the operating system and other critical software are stored in a fire rated container or otherwise not collocated with the operational software.
High MACI,MACII,MACIII Continuity Trusted Recovery Recovery procedures and technical system features exist to ensure that recovery is done in a secure and verifiable manner. Circumstances that can inhibit a trusted recovery are documented and appropriate mitigating procedures have been put in place.
Medium MACI,MACII,MACIII Security Design And Configuration Procedural Review An annual IA review is conducted that comprehensively evaluates existing policies and processes to ensure procedural consistency and to ensure that they fully support the goal of uninterrupted operations.
High CLASSIFIED,SENSITIVE,PUBLIC Security Design And Configuration Acquisition Standards The acquisition of all IA- and IA-enabled GOTS IT products is limited to products that have been evaluated by the NSA or in accordance with NSA-approved processes. The acquisition of all IA- and IA-enabled COTS IT products is limited to products that have
Medium MACI,MACII,MACIII Security Design And Configuration Best Security Practices The DoD information system security design incorporates best security practices such as single sign-on, PKE, smart card, and biometrics.
Low Security Design And Configuration Control Board All DoD information systems are under the control of a chartered configuration control board that meets regularly according to DCPR-1.
Medium MACI,MACII,MACIII Security Design And Configuration Control Board All information systems are under the control of a chartered Configuration Control Board that meets regularly according to DCPR-1. The IAM is a  voting member of the CCB.
High MACIII Security Design And Configuration Configuration Specifications A DoD reference document, such as a security technical implementation guide or security recommendation guide constitutes the primary source for security configuration or implementation guidance for the deployment of newly acquired IA- and IA-enabled IT pr
High MACI,MACII Security Design And Configuration Configuration Specifications A DoD reference document such as a security technical implementation guide or security recommendation guide constitutes the primary source for security configuration or implementation guidance for the deployment of newly acquired IA- and IA-enabled IT pro
Medium MACI,MACII,MACIII Security Design And Configuration Compliance Testing A comprehensive set of procedures is implemented that tests all patches, upgrades, and new AIS applications prior to deployment.
Medium MACI,MACII,MACIII Security Design And Configuration Dedicated Ia Services Acquisition or outsourcing of dedicated IA services such as incident monitoring, analysis and response; operation of IA devices such as firewalls; or key management services are supported by a formal risk analysis and approved by the DoD Component CIO.
Medium MACI,MACII,MACIII Security Design And Configuration Functional Architecture For Ais Applications For AIS applications, a functional architecture that identifies the following has been developed and is maintained: - all external interfaces, the information being exchanged, and the protection mechanisms associated with each interface - user roles requi
High MACI,MACII,MACIII Security Design And Configuration Hw Baseline A current and comprehensive baseline inventory of all hardware (HW) (to include manufacturer, type, model, physical location and network topology or architecture) required to support enclave operations is maintained by the Configuration Control Board (CCB
High MACI,MACII,MACIII Security Design And Configuration Interconnection Documentation For AIS applications, a list of all (potential) hosting enclaves is developed and maintained along with evidence of deployment planning and coordination and the exchange of connection rules and requirements. For enclaves, a list of all hosted AIS applicat
Medium MACI,MACII,MACIII Security Design And Configuration Ia Impact Assessment Changes to the DoD information system are assessed for IA and accreditation impact prior to implementation.
High MACI,MACII,MACIII Security Design And Configuration Ia For It Services Acquisition or outsourcing of IT services explicitly addresses Government, service provider, and end user IA roles and responsibilities.
Medium MACI,MACII,MACIII Security Design And Configuration Mobile Code The acquisition, development, and/or use of mobile code to be deployed in DoD systems meets the following requirements: 1. Emerging mobile code technologies that have not undergone a risk assessment by NSA and been assigned to a Risk Category by the DoD C
Medium MACI,MACII,MACIII Security Design And Configuration Non-repudiation NIST FIPS 140-2 validated cryptography (e.g., DoD PKI class 3 or 4 token) is used to implement encryption (e.g., AES, 3DES, DES, Skipjack), key exchange (e.g., FIPS 171), digital signature (e.g., DSA, RSA, ECDSA), and hash (e.g., SHA-1, SHA-256, SHA-384,
Low MACI,MACII Security Design And Configuration Partitioning The Application User interface services (e.g., web services) are physically or logically separated from data storage and management services (e.g., database management systems). Separation may be accomplished through the use of different computers, different CPUs, differ
High MACI,MACII Security Design And Configuration Ia Program And Budget A discrete line item for Information Assurance is established in programming and budget documentation.
Medium MACI,MACII,MACIII Security Design And Configuration Public Domain Software Controls Binary or machine executable public domain software products and other software products with limited or no warranty such as those commonly known as freeware or shareware are not used in DoD information systems unless they are necessary for mission accomp
Medium MACI,MACII,MACIII Security Design And Configuration Ports, Protocols, And Services DoD information systems comply with DoD ports, protocols, and services guidance. AIS applications, outsourced IT-based processes and platform IT identify the network ports, protocols, and services they plan to use as early in the life cycle as possible an
High MACI,MACII,MACIII Security Design And Configuration Cm Process A configuration management (CM) process is implemented that includes requirements for: 1. Formally documented CM roles, responsibilities, and procedures to include the management of IA information and documentation; 2. A configuration control board that i
High MACI,MACII,MACIII Security Design And Configuration Ia Documentation All appointments to required IA roles (e.g., DAA and IAM/IAO) are established in writing, to include assigned duties and appointment criteria such as training, security clearance, and IT-designation. A System Security Plan is established that describes th
Medium MACI,MACII,MACIII Security Design And Configuration System Library Management Controls System libraries are managed and maintained to protect privileged programs and to prevent or minimize the introduction of unauthorized code.
Medium MACI,MACII Security Design And Configuration Security Support Structure Partitioning The security support structure is isolated by means of partitions, domains, etc., including control of access to, and integrity of, hardware, software, and firmware that perform security functions. The security support structure maintains separate executi
Medium MACI,MACII,MACIII Security Design And Configuration Software Quality Software quality requirements and validation methods that are focused on the minimization of flawed or malformed software that can negatively impact integrity or availability (e.g., buffer overruns) are specified for all software development initiatives.
High PUBLIC Security Design And Configuration Specified Robustness - Basic At a minimum, basic-robustness COTS IA and IA-enabled products are used to protect publicly released information from malicious tampering or destruction and ensure its availability. The basic-robustness requirements for products are defined in the Protect
High SENSITIVE Security Design And Configuration Specified Robustness - Medium At a minimum, medium-robustness COTS IA and IA-enabled products are used to protect sensitive information when the information transits public networks or the system handling the information is accessible by individuals who are not authorized to access th
High CLASSIFIED Security Design And Configuration Specified Robustness – High Only high-robustness GOTS or COTS IA and IA-enabled IT products are used to protect classified information when the information transits networks that are at a lower classification level than the information being transported. High-robustness products hav
High MACIII Security Design And Configuration System State Changes System initialization, shutdown, and aborts are configured to ensure that the system remains in a secure state.
High MACI,MACIICLASSIFIED Security Design And Configuration System State Changes System initialization, shutdown, and aborts are configured to ensure that the system remains in a secure state. Tests are provided and periodically run to ensure the integrity of the system state.
High MACI,MACII,MACIII Security Design And Configuration Sw Baseline A current and comprehensive baseline inventory of all software (SW) (to include manufacturer, type, and version and installation manuals and procedures) required to support DoD information system operations is maintained by the CCB and as part of the C&A
Low PUBLIC Enclave Boundary Defense Boundary Defense Boundary defense mechanisms to include firewalls and network intrusion detection systems (IDS) are deployed at the enclave boundary to the wide area network, and Internet access is permitted from a demilitarized zone (DMZ) that meets the DoD requirement t
Medium SENSITIVE Enclave Boundary Defense Boundary Defense Boundary defense mechanisms, to include firewalls and network intrusion detection systems (IDS) are deployed at the enclave boundary to the wide area network, at layered or internal enclave boundaries, or at key points in the network, as required.  All I
High CLASSIFIED Enclave Boundary Defense Boundary Defense Boundary defense mechanisms to include firewalls and network intrusion detection systems (IDS) are deployed at the enclave boundary to the wide area network, and at layered or internal enclave boundaries and key points in the network as required. All Inte
Medium MACI,MACII,MACIII Enclave Boundary Defense Connection Rules The DoD information system is compliant with established DoD connection rules and approval processes.
High SENSITIVE,PUBLIC Enclave Boundary Defense Public Wan Connection Connections between DoD enclaves and the Internet or other public or commercial wide area networks require a demilitarized zone (DMZ).
High CLASSIFIED,SENSITIVE Enclave Boundary Defense Remote Access For Privileged Functions Remote access for privileged functions is discouraged, is permitted only for compelling operational needs, and is strictly controlled. In addition to EBRU-1, sessions employ security measures such as a VPN with blocking mode enabled. A complete audit trai
High CLASSIFIED,SENSITIVE Enclave Boundary Defense Remote Access For User Functions All remote access to DoD information systems, to include telework access, is mediated through a managed access control point, such as a remote access server in a DMZ. Remote access always uses encryption to protect the confidentiality of the session. The
Medium MACI,MACII,MACIII Enclave Boundary Defense Vpn Controls All VPN traffic is visible to network intrusion detection systems (IDS).
Medium CLASSIFIED,SENSITIVE Enclave Computing Environment Affiliation Display To help prevent inadvertent disclosure of controlled information, all contractors are identified by the inclusion of the abbreviation "ctr" and all foreign nationals are identified by the inclusion of their two character country code in: - DoD user e-mail
High CLASSIFIED,SENSITIVE Enclave Computing Environment Access For Need-to-know Access to all DoD information (classified, sensitive, and public) is determined by both its classification and user need-to-know. Need-to-know is established by the Information Owner and enforced by discretionary or role-based access controls. Access cont
Low PUBLIC Enclave Computing Environment Audit Record Content – Public Systems Audit records include:   · User ID.   · Successful and unsuccessful attempts to access security files.   · Date and time of the event.   · Type of event.
Medium SENSITIVE Enclave Computing Environment Audit Record Content – Sensitive Systems Audit records include:   · User ID.   · Successful and unsuccessful attempts to access security files.   · Date and time of the event.   · Type of event.   · Success or failure of event.   · Successful and unsuccessful logons.   · Den
High CLASSIFIED Enclave Computing Environment Audit Record Content – Classified Systems Audit records include:   · User ID.   · Successful and unsuccessful attempts to access security files.   · Date and time of the event.   · Type of event.   · Success or failure of event.   · Successful and unsuccessful logons.   · Den
Low MACIIISENSITIVE,PUBLIC Enclave Computing Environment Audit Trail, Monitoring, Analysis And Reporting Audit trail records from all available sources are regularly reviewed for indications of inappropriate or unusual activity. Suspected violations of IA policies are analyzed and reported in accordance with DoD information system IA procedures.
Medium MACI,MACIICLASSIFIED Enclave Computing Environment Audit Trail, Monitoring, Analysis And Reporting An automated, continuous on-line monitoring and audit trail creation capability is deployed with the capability to immediately alert personnel of any unusual or inappropriate activity with potential IA implications, and with a user configurable capability
Medium MACIII Enclave Computing Environment Changes To Data Access control mechanisms exist to ensure that data is accessed and changed only by authorized personnel.
High MACI,MACIICLASSIFIED Enclave Computing Environment Changes To Data Access control mechanisms exist to ensure that data is accessed and changed only by authorized personnel. Access and changes to the data are recorded in transaction logs that are reviewed periodically or immediately upon system security events. Users are
High CLASSIFIED Enclave Computing Environment Comsec COMSEC activities comply with DoD Directive C-5200.5.
Low SENSITIVE Enclave Computing Environment Encryption For Confidentiality (data At Rest) If required by the information owner, NIST-certified cryptography is used to encrypt stored sensitive information.
Medium CLASSIFIED Enclave Computing Environment Encryption For Confidentiality (data At Rest) If required by the information owner, NIST-certified cryptography is used to encrypt stored classified non-SAMI information.
High CLASSIFIED Enclave Computing Environment Encryption For Confidentiality (data At Rest) If a classified enclave contains SAMI and is accessed by individuals lacking an appropriate clearance for SAMI, then NSA-approved cryptography is used to encrypt all SAMI stored within the enclave.
Medium SENSITIVE Enclave Computing Environment Encryption For Confidentiality (data At Transmit) Unclassified, sensitive data transmitted through a commercial or wireless network are encrypted using NIST-certified cryptography (See also DCSR-2).
High CLASSIFIED Enclave Computing Environment Encryption For Confidentiality (data At Transmit) Classified data transmitted through a network that is cleared to a lower level than the data being transmitted are separately encrypted using NSA-approved cryptography (See also DCSR-3).
Medium MACI,MACII Enclave Computing Environment Data Change Controls Transaction-based systems (e.g., database management systems, transaction processing systems) implement transaction roll-back and transaction journaling, or technical equivalents.
Medium CLASSIFIED,SENSITIVE Enclave Computing Environment Interconnections Among Dod Systems And Enclaves Discretionary access controls are a sufficient IA mechanism for connecting DoD information systems operating at the same classification, but with different need-to-know access rules. A controlled interface is required for interconnections among DoD inform
Medium MACI,MACII Enclave Computing Environment Host Based Ids Host-based intrusion detection systems are deployed for major applications and for network management assets, such as routers, switches, and domain name servers (DNS).
Medium MACI,MACII,MACIII Enclave Computing Environment Instant Messaging Instant messaging traffic to and from instant messaging clients that are independently configured by end users and that interact with a public service provider is prohibited within DoD information systems. Both inbound and outbound public service instant
Low CLASSIFIED Enclave Computing Environment Audit Of Security Label Changes The system automatically records the creation, deletion, or modification of confidentiality or integrity labels, if required by the information owner.
Medium SENSITIVE Enclave Computing Environment Logon Successive logon attempts are controlled using one or more of the following:   · Access is denied after multiple unsuccessful logon attempts.   · The number of access attempts in a given period is limited.   · A time-delay control system is emplo
Medium CLASSIFIED Enclave Computing Environment Logon Successive logon attempts are controlled using one or more of the following:   · Access is denied after multiple unsuccessful logon attempts.   · The number of access attempts in a given period is limited.   · A time-delay control system is emplo
High CLASSIFIED,SENSITIVE,PUBLIC Enclave Computing Environment Least Privilege Access procedures enforce the principles of separation of duties and "least privilege."  Access to privileged accounts is limited to privileged users. Use of privileged accounts is limited to privileged functions; that is, privileged users use non-privil
High CLASSIFIED,SENSITIVE Enclave Computing Environment Marking And Labeling Information and DoD information systems that store, process, transit, or display data in any form or format that is not approved for public release comply with all requirements for marking and labeling contained in policy and guidance documents such as Do
Low SENSITIVE,PUBLIC Enclave Computing Environment Conformance Monitoring And Testing Conformance testing that includes periodic, unannounced in-depth monitoring and provides for specific penetration testing to ensure compliance with all vulnerability mitigation procedures such as the DoD IAVA or other DoD IA practices is planned, schedule
Medium CLASSIFIED Enclave Computing Environment Conformance Monitoring And Testing Conformance testing that includes periodic, unannounced in-depth monitoring and provides for specific penetration testing to ensure compliance with all vulnerability mitigation procedures such as the DoD IAVA or other DoD IA practices is planned, schedule
Low MACIII Enclave Computing Environment Network Device Controls An effective network device control program (e.g., routers, switches, firewalls) is implemented and includes: instructions for restart and recovery procedures; restrictions on source code access, system utility access, and system documentation; protection
Medium MACI,MACII Enclave Computing Environment Network Device Controls An effective network device control program (e.g., routers, switches, firewalls) is implemented and includes: instructions for restart and recovery procedures; restrictions on source code access, system utility access, and system documentation; protection
Medium CLASSIFIED,SENSITIVE Enclave Computing Environment Encryption For Need-to-know Information in transit through a network at the same classification level, but which must be separated for need-to-know reasons, is encrypted, at a minimum, with NIST-certified cryptography. This is in addition to ECCT (encryption for confidentiality –
Medium CLASSIFIED Enclave Computing Environment Encryption For Need-to-know SAMI information in transit through a network at the same classification level is encrypted using NSA-approved cryptography. This is to separate it for need-to-know reasons. This is in addition to ECCT (encryption for confidentiality – data in transit).
High MACI,MACII,MACIII Enclave Computing Environment Privileged Account Control All privileged user accounts are established and administered in accordance with a role-based access scheme that organizes all system and network privileges into roles (e.g., key management, network, system administration, database administration, web-adm
Medium MACIII Enclave Computing Environment Production Code Change Controls Application programmer privileges to change production code and data are limited and are periodically reviewed.
Medium MACI,MACII Enclave Computing Environment Production Code Change Controls Application programmer privileges to change production code and data are limited and reviewed every 3 months.
Medium CLASSIFIED,SENSITIVE Enclave Computing Environment Resource Control All authorizations to the information contained within an object are revoked prior to initial assignment, allocation, or reallocation to a subject from the system's pool of unused objects. No information, including encrypted representations of information
Low MACI,MACII,MACIII Enclave Computing Environment Audit Reduction And Report Generation Tools are available for the review of audit records and for report generation from audit records.
Medium CLASSIFIED,SENSITIVE,PUBLIC Enclave Computing Environment Audit Record Retention If the DoD information system contains sources and methods intelligence (SAMI), then audit records are retained for 5 years. Otherwise, audit records are retained for at least 1 year.
High MACI,MACII,MACIII Enclave Computing Environment Security Configuration Compliance For Enclaves and AIS applications, all DoD security configuration or implementation guides have been applied.
Medium MACIII Enclave Computing Environment Software Development Change Controls Change controls for software development are in place to prevent unauthorized programs or modifications to programs from being implemented.
High MACI,MACII Enclave Computing Environment Software Development Change Controls Change controls for software development are in place to prevent unauthorized programs or modifications to programs from being implemented. Change controls include review and approval of application change requests and technical system features to assure
Medium MACI,MACIICLASSIFIED Enclave Computing Environment Audit Trail Backup The audit records are backed up not less than weekly onto a different system or media than the system being audited.
High CLASSIFIED,SENSITIVE Enclave Computing Environment Tempest Controls Measures to protect against compromising emanations have been implemented according to DoD Directive S-5200.19.
Medium MACIII Enclave Computing Environment Transmission Integrity Controls Good engineering practices with regards to the integrity mechanisms of COTS, GOTS and custom developed solutions are implemented for incoming and outgoing files, such as parity checks and cyclic redundancy checks (CRCs).
Medium MACI,MACII Enclave Computing Environment Transmission Integrity Controls Good engineering practices with regards to the integrity mechanisms of COTS, GOTS, and custom developed solutions are implemented for incoming and outgoing files, such as parity checks and cyclic redundancy checks (CRCs). Mechanisms are in place to assure
Medium MACI,MACII,MACIII Enclave Computing Environment Audit Trail Protection The contents of audit trails are protected against unauthorized access, modification or deletion.
Medium MACI,MACII,MACIII Enclave Computing Environment Voice-over-ip (voip) Protection Voice over Internet Protocol (VoIP) traffic to and from workstation IP telephony clients that are independently configured by end users for personal use is prohibited within DoD information systems. Both inbound and outbound individually configured voice
High MACI,MACII,MACIII Enclave Computing Environment Virus Protection All Servers, workstations and mobile computing devices (i.e. laptop, PDAs) implement virus protection that includes a capability for automatic updates.
Low CLASSIFIED,SENSITIVE,PUBLIC Enclave Computing Environment Warning Message All users are warned that they are entering a Government information system, and are provided with appropriate privacy and security notices to include statements informing them that they are subject to monitoring, recording and auditing.
High MACI,MACII,MACIII Enclave Computing Environment Wireless Computing And Network Wireless computing and networking capabilities from workstations, laptops, personal digital assistants (PDAs), handheld computers, cellular phones, or other portable electronic devices are implemented in accordance with DoD wireless policy, as issued. (Se
High CLASSIFIED,SENSITIVE Identification And Authentication Account Control A comprehensive account management process is implemented to ensure that only authorized users can gain access to workstations, applications, and networks and that individual accounts designated as inactive, suspended, or terminated are promptly deactivat
Medium CLASSIFIED,SENSITIVE Identification And Authentication Group Authentication Group authenticators for application or network access may be used only in conjunction with an individual authenticator. Any use of group authenticators not based on the DoD PKI has been explicitly approved by the Designated Approving Authority (DAA).
High SENSITIVE Identification And Authentication Individual Identification And Authentication DoD information system access is gained through the presentation of an individual identifier (e.g., a unique token or user login ID) and password. For systems utilizing a logon ID as the individual identifier, passwords are, at a minimum, a case sensitive
High CLASSIFIED Identification And Authentication Individual Identification And Authentication DoD information system access is gained through the presentation of an individual identifier (e.g., a unique token or user logon ID) and password. For systems utilizing a logon ID as the individual identifier, passwords are, at a minimum, a case sensitive
Medium MACIII Identification And Authentication Key Management Symmetric Keys are produced, controlled, and distributed using NIST-approved key management technology and processes. Asymmetric Keys are produced, controlled, and distributed using DoD PKI Class 3 certificates or pre-placed keying material.
Medium MACI,MACII Identification And Authentication Key Management Symmetric Keys are produced, controlled and distributed using NSA-approved key management technology and processes. Asymmetric Keys are produced, controlled, and distributed using DoD PKI Medium Assurance or High Assurance  certificates and hardware secu
Medium CLASSIFIED Identification And Authentication Key Management Symmetric and asymmetric keys are produced, controlled and distributed using NSA-approved key management technology and processes.
Medium MACIII Identification And Authentication Token And Certificate Standards Identification and authentication is accomplished using the DoD PKI Class 3 certificate and hardware security token (when available).
Medium MACI,MACII Identification And Authentication Token And Certificate Standards Identification and authentication is accomplished using the DoD PKI Class 3 or 4 certificate and hardware security token (when available) or an NSA-certified product.
High SENSITIVE Physical And Environmental Access To Computing Facilities Only authorized personnel with a need-to-know are granted physical access to computing facilities that process sensitive information or unclassified information that has not been cleared for release.
High CLASSIFIED Physical And Environmental Access To Computing Facilities Only authorized personnel with appropriate clearances are granted physical access to computing facilities that process classified information.
High SENSITIVE Physical And Environmental Clearing And Sanitizing All documents, equipment, and machine-readable media containing sensitive data are cleared and sanitized before being released outside of the Department of Defense according to DoD 5200.1-R and ASD(C3I) Memorandum, dated June 4, 2001, subject: "Dispositio
High CLASSIFIED Physical And Environmental Clearing And Sanitizing All documents, equipment, and machine-readable media containing classified data are cleared and sanitized before being released outside its security domain according to DoD 5200.1-R.
High CLASSIFIED Physical And Environmental Destruction All documents, machine-readable media, and equipment are destroyed using procedures that comply with DoD policy (e.g., DoD 5200.1-R).
High CLASSIFIED,SENSITIVE Physical And Environmental Data Interception Devices that display or output classified or sensitive information in human-readable form are positioned to deter unauthorized individuals from reading the information.
Low MACIII Physical And Environmental Emergency Lighting An automatic emergency lighting system is installed that covers emergency exits and evacuation routes.
Medium MACI,MACII Physical And Environmental Emergency Lighting An automatic emergency lighting system is installed that covers all areas necessary to maintain mission or business essential functions, to include emergency exits and evacuation routes.
High MACIII Physical And Environmental Fire Detection Battery-operated or electric stand-alone smoke detectors are installed in the facility.
High MACI,MACII Physical And Environmental Fire Detection A servicing fire department receives an automatic notification of any activation of the smoke detection or fire suppression system.
Medium MACI,MACII,MACIII Physical And Environmental Fire Inspection Computing facilities undergo a periodic fire marshal inspection. Deficiencies are promptly resolved.
Medium MACIII Physical And Environmental Fire Suppression Handheld fire extinguishers or fixed fire hoses are available should an alarm be sounded or a fire be detected.
High MACI,MACII Physical And Environmental Fire Suppression A fully automatic fire suppression system is installed that automatically activates when it detects heat, smoke, or particles.
Medium MACIII Physical And Environmental Humidity Controls Humidity controls are installed that provide an alarm of fluctuations potentially harmful to personnel or equipment operation; adjustments to humidifier/de-humidifier systems may be made manually.
Medium MACI,MACII Physical And Environmental Humidity Controls Automatic humidity controls are installed to prevent humidity fluctuations potentially harmful to personnel or equipment operation.
High MACI,MACII,MACIII Physical And Environmental Master Power Switch A master power switch or emergency cut-off switch to IT equipment is present. It is located near the main entrance of the IT area and it is labeled and protected by a cover to prevent accidental shut-off.
High SENSITIVE Physical And Environmental Physical Protection Of Facilities Every physical access point to facilities housing workstations that process or display sensitive information or unclassified information that has not been cleared for release is controlled during working hours and guarded or locked during non-work hours.
High CLASSIFIED Physical And Environmental Physical Protection Of Facilities Every physical access point to facilities housing workstations that process or display classified information is guarded or alarmed 24 X 7. Intrusion alarms are monitored.  Two (2) forms of identification are required to gain access to the facility (e.g.
Low CLASSIFIED,SENSITIVE Physical And Environmental Physical Security Testing A facility penetration testing process is in place that includes periodic, unannounced attempts to penetrate key computing facilities.
Medium MACI,MACII,MACIII Physical And Environmental Screen Lock Unless there is an overriding technical or operational problem, workstation screen-lock functionality is associated with each workstation. When activated, the screen-lock function places an unclassified pattern onto the entire screen of the workstation, t
Medium CLASSIFIED,SENSITIVE Physical And Environmental Workplace Security Procedures Procedures are implemented to ensure the proper handling and storage of information, such as end-of-day security checks, unannounced security checks, and, where appropriate, the imposition of a two-person rule within the computing facility.
High CLASSIFIED,SENSITIVE Physical And Environmental Storage Documents and equipment are stored in approved containers or facilities with maintenance and accountability procedures that comply with DoD 5200.1-R.
Low MACIII Physical And Environmental Temperature Controls Temperature controls are installed that provide an alarm when temperature fluctuations potentially harmful to personnel or equipment operation are detected; adjustments to heating or cooling systems may be made manually.
Medium MACI,MACII Physical And Environmental Temperature Controls Automatic temperature controls are installed to prevent temperature fluctuations potentially harmful to personnel or equipment operation.
Low MACI,MACII,MACIII Physical And Environmental Environmental Control Training Employees receive initial and periodic training in the operation of environmental controls.
High CLASSIFIED,SENSITIVE Physical And Environmental Visitor Control To Computing Facilities Current signed procedures exist for controlling visitor access and maintaining a detailed log of all visitors to the computing facility.
High MACI,MACII,MACIII Physical And Environmental Voltage Regulators Automatic voltage control is implemented for key IT assets.
High SENSITIVE Personnel Access To Information Individuals requiring access to sensitive information are processed for access authorization in accordance with DoD personnel security policies.
High CLASSIFIED Personnel Access To Information Individuals requiring access to classified information are processed for access authorization in accordance with DoD personnel security policies.
High SENSITIVE,PUBLIC Personnel Maintenance Personnel Maintenance is performed only by authorized personnel. The processes for determining authorization and the list of authorized maintenance personnel is documented.
High CLASSIFIED Personnel Maintenance Personnel Maintenance is performed only by authorized personnel. The processes for determining authorization and the list of authorized maintenance personnel is documented. Except as authorized by the DAA, personnel who perform maintenance on classified DoD informa
High CLASSIFIED,SENSITIVE,PUBLIC Personnel Access To Need-to-know Information Only individuals who have a valid need-to-know that is demonstrated by assigned official Government duties and who satisfy all personnel security criteria (e.g., IT position sensitivity background investigation requirements outlined in DoD 5200.2-R) are g
High MACI,MACII,MACIII Personnel Security Rules Of Behavior Or Acceptable Use Policy A set of rules that describe the IA operations of the DoD information system and clearly delineate IA responsibilities and expected behavior of all personnel is in place. The rules include the consequences of inconsistent behavior or non-compliance. Signe
High CLASSIFIED,SENSITIVE Personnel Information Assurance Training A program is implemented to ensure that upon arrival and periodically thereafter, all personnel receive training and familiarization to perform their assigned IA responsibilities, to include familiarization with their prescribed roles in all IA- related p
Medium MACIII Vulnerability And Incident Management Incident Response Planning An incident response plan exists that identifies the responsible CND Service Provider in accordance with DoD Instruction O-8530.2 and CJCS Instruction 6510.01D, defines reportable incidents, outlines a standard operating procedure for incident response to
High MACI,MACII Vulnerability And Incident Management Incident Response Planning An incident response plan exists that identifies the responsible CND Service Provider in accordance with DoD Instruction O-8530.2 and CJCS Instruction 6510.01D, defines reportable incidents, outlines a standard operating procedure for incident response to
Medium MACI,MACII,MACIII Vulnerability And Incident Management Vulnerability Management A comprehensive vulnerability management process that includes the systematic identification and mitigation of software and hardware vulnerabilities is in place. Wherever system capabilities permit, mitigation is independently validated through inspection