VoltVerify™Compliance & Reliability Readiness PlatformVoltBreach

NIST · Shared reference library

NIST SP 800-53 Rev. 5 Common Control Library

Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.

A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.

Sources and crosswalk scope

NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.

Official pinned NIST source

SHA-256: 81cf2de45ede9aef3de7ce09d65ea9d32f662c483bbf916f6e346292b22f7763

GovRAMP readiness programsDownload GovRAMP crosswalk JSONManage organization crosswalk
Reset

60 matching controls · Page 1 of 3

Access Control · Base control

AC-2 · Account Management

Control statement and discussion

NIST control statement

a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [Assignment: prerequisites and criteria] for group and role membership; d. Specify: 1. Authorized users of the system; 2. Group and role membership; and 3. Access authorizations (i.e., privileges) and [Assignment: attributes (as required)] for each account; e. Require approvals by [Assignment: personnel or roles] for requests to create accounts; f. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; g. Monitor the use of accounts; h. Notify account managers and [Assignment: personnel or roles] within: 1. [Assignment: time period] when accounts are no longer required; 2. [Assignment: time period] when users are terminated or transferred; and 3. [Assignment: time period] when system usage or need-to-know changes for an individual; i. Authorize access to the system based on: 1. A valid access authorization; 2. Intended system usage; and 3. [Assignment: attributes (as required)]; j. Review accounts for compliance with account management requirements [Assignment: frequency]; k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l. Align account management processes with personnel termination and transfer processes.

Discussion

Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts. Where access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability. Temporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.

GovRAMP crosswalk

Access Control · Enhancement

AC-2(1) · Automated System Account Management

View parent control
Control statement and discussion

NIST control statement

Support the management of system accounts using [Assignment: automated mechanisms].

Discussion

Automated system account management includes using automated mechanisms to create, enable, modify, disable, and remove accounts; notify account managers when an account is created, enabled, modified, disabled, or removed, or when users are terminated or transferred; monitor system account usage; and report atypical system account usage. Automated mechanisms can include internal system functions and email, telephonic, and text messaging notifications.

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · AC-2 (1) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · AC-2 (1) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · AC-2 (1) — Direct NIST identifier reference. GovRAMP source matrix

Access Control · Enhancement

AC-2(7) · Privileged User Accounts

View parent control
Control statement and discussion

NIST control statement

(a) Establish and administer privileged user accounts in accordance with [Selection (one): a role-based access scheme; an attribute-based access scheme]; (b) Monitor privileged role or attribute assignments; (c) Monitor changes to roles or attributes; and (d) Revoke access when privileged role or attribute assignments are no longer appropriate.

Discussion

Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Privileged roles include key management, account management, database administration, system and network administration, and web administration. A role-based access scheme organizes permitted system access and privileges into roles. In contrast, an attribute-based access scheme specifies allowed system access and privileges based on attributes.

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · AC-2 (7) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · AC-2 (7) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · AC-2 (7) — Direct NIST identifier reference. GovRAMP source matrix

Access Control · Base control

AC-4 · Information Flow Enforcement

Control statement and discussion

NIST control statement

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: information flow control policies].

Discussion

Information flow control regulates where information can travel within a system and between systems (in contrast to who is allowed to access the information) and without regard to subsequent accesses to that information. Flow control restrictions include blocking external traffic that claims to be from within the organization, keeping export-controlled information from being transmitted in the clear to the Internet, restricting web requests that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between organizations may require an agreement specifying how the information flow is enforced (see [CA-3](#ca-3) ). Transferring information between systems in different security or privacy domains with different security or privacy policies introduces the risk that such transfers violate one or more domain security or privacy policies. In such situations, information owners/stewards provide guidance at designated policy enforcement points between connected systems. Organizations consider mandating specific architectural solutions to enforce specific security and privacy policies. Enforcement includes prohibiting information transfers between connected systems (i.e., allowing access only), verifying write permissions before accepting information from another security or privacy domain or connected system, employing hardware mechanisms to enforce one-way information flows, and implementing trustworthy regrading mechanisms to reassign security or privacy attributes and labels. Organizations commonly employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations within systems and between connected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices that employ rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content. Organizations also consider the trustworthiness of filtering and/or inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement. Control enhancements 3 through 32 primarily address cross-domain solution needs that focus on more advanced filtering techniques, in-depth analysis, and stronger flow enforcement mechanisms implemented in cross-domain products, such as high-assurance guards. Such capabilities are generally not available in commercial off-the-shelf products. Information flow enforcement also applies to control plane traffic (e.g., routing and DNS).

GovRAMP crosswalk

Access Control · Base control

AC-6 · Least Privilege

Control statement and discussion

NIST control statement

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

Discussion

Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.

GovRAMP crosswalk

Access Control · Enhancement

AC-6(2) · Non-privileged Access for Nonsecurity Functions

View parent control
Control statement and discussion

NIST control statement

Require that users of system accounts (or roles) with access to [Assignment: security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.

Discussion

Requiring the use of non-privileged accounts when accessing nonsecurity functions limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies, such as role-based access control, and where a change of role provides the same degree of assurance in the change of access authorizations for the user and the processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · AC-6 (2) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · AC-6 (2) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · AC-6 (2) — Direct NIST identifier reference. GovRAMP source matrix

Access Control · Enhancement

AC-6(10) · Prohibit Non-privileged Users from Executing Privileged Functions

View parent control
Control statement and discussion

NIST control statement

Prevent non-privileged users from executing privileged functions.

Discussion

Privileged functions include disabling, circumventing, or altering implemented security or privacy controls, establishing system accounts, performing system integrity checks, and administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Privileged functions that require protection from non-privileged users include circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms. Preventing non-privileged users from executing privileged functions is enforced by [AC-3](#ac-3).

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · AC-6 (10) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · AC-6 (10) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · AC-6 (10) — Direct NIST identifier reference. GovRAMP source matrix

Access Control · Base control

AC-17 · Remote Access

Control statement and discussion

NIST control statement

a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to the system prior to allowing such connections.

Discussion

Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of [CA-3](#ca-3) . Enforcing access restrictions for remote access is addressed via [AC-3](#ac-3).

GovRAMP crosswalk

Access Control · Enhancement

AC-17(2) · Protection of Confidentiality and Integrity Using Encryption

View parent control
Control statement and discussion

NIST control statement

Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

Discussion

Virtual private networks can be used to protect the confidentiality and integrity of remote access sessions. Transport Layer Security (TLS) is an example of a cryptographic protocol that provides end-to-end communications security over networks and is used for Internet communications and online transactions.

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · AC-17 (2) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · AC-17 (2) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · AC-17 (2) — Direct NIST identifier reference. GovRAMP source matrix

Audit and Accountability · Base control

AU-7 · Audit Record Reduction and Report Generation

Control statement and discussion

NIST control statement

Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and b. Does not alter the original content or time ordering of audit records.

Discussion

Audit record reduction is a process that manipulates collected audit log information and organizes it into a summary format that is more meaningful to analysts. Audit record reduction and report generation capabilities do not always emanate from the same system or from the same organizational entities that conduct audit logging activities. The audit record reduction capability includes modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the system can generate customizable reports. Time ordering of audit records can be an issue if the granularity of the timestamp in the record is insufficient.

GovRAMP crosswalk

Audit and Accountability · Enhancement

AU-7(1) · Automatic Processing

View parent control
Control statement and discussion

NIST control statement

Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: fields within audit records].

Discussion

Events of interest can be identified by the content of audit records, including system resources involved, information objects accessed, identities of individuals, event types, event locations, event dates and times, Internet Protocol addresses involved, or event success or failure. Organizations may define event criteria to any degree of granularity required, such as locations selectable by a general networking location or by specific system component.

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · AU-7 (1) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · AU-7 (1) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · AU-7 (1) — Direct NIST identifier reference. GovRAMP source matrix

Audit and Accountability · Base control

AU-11 · Audit Record Retention

Control statement and discussion

NIST control statement

Retain audit records for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Discussion

Organizations retain audit records until it is determined that the records are no longer needed for administrative, legal, audit, or other operational purposes. This includes the retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on records retention.

GovRAMP crosswalk

Configuration Management · Base control

CM-2 · Baseline Configuration

Control statement and discussion

NIST control statement

a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [Assignment: frequency]; 2. When required due to [Assignment: circumstances] ; and 3. When system components are installed or upgraded.

Discussion

Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.

GovRAMP crosswalk

Configuration Management · Enhancement

CM-2(2) · Automation Support for Accuracy and Currency

View parent control
Control statement and discussion

NIST control statement

Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: automated mechanisms].

Discussion

Automated mechanisms that help organizations maintain consistent baseline configurations for systems include configuration management tools, hardware, software, firmware inventory tools, and network management tools. Automated tools can be used at the organization level, mission and business process level, or system level on workstations, servers, notebook computers, network components, or mobile devices. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels. Automation support for accuracy and currency can be satisfied by the implementation of [CM-8(2)](#cm-8.2) for organizations that combine system component inventory and baseline configuration activities.

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · CM-2 (2) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · CM-2 (2) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · CM-2 (2) — Direct NIST identifier reference. GovRAMP source matrix

Configuration Management · Base control

CM-4 · Impact Analyses

Control statement and discussion

NIST control statement

Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.

Discussion

Organizational personnel with security or privacy responsibilities conduct impact analyses. Individuals conducting impact analyses possess the necessary skills and technical expertise to analyze the changes to systems as well as the security or privacy ramifications. Impact analyses include reviewing security and privacy plans, policies, and procedures to understand control requirements; reviewing system design documentation and operational procedures to understand control implementation and how specific system changes might affect the controls; reviewing the impact of changes on organizational supply chain partners with stakeholders; and determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks. Impact analyses also include risk assessments to understand the impact of the changes and determine if additional controls are required.

GovRAMP crosswalk

Configuration Management · Base control

CM-5 · Access Restrictions for Change

Control statement and discussion

NIST control statement

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Discussion

Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see [AC-3](#ac-3) and [PE-3](#pe-3) ), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).

GovRAMP crosswalk

Configuration Management · Enhancement

CM-5(1) · Automated Access Enforcement and Audit Records

View parent control
Control statement and discussion

NIST control statement

(a) Enforce access restrictions using [Assignment: automated mechanisms] ; and (b) Automatically generate audit records of the enforcement actions.

Discussion

Organizations log system accesses associated with applying configuration changes to ensure that configuration change control is implemented and to support after-the-fact actions should organizations discover any unauthorized changes.

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · CM-5 (1) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · CM-5 (1) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · CM-5 (1) — Direct NIST identifier reference. GovRAMP source matrix

Configuration Management · Enhancement

CM-5(5) · Privilege Limitation for Production and Operation

View parent control
Control statement and discussion

NIST control statement

(a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges [Assignment: organization-defined frequency].

Discussion

In many organizations, systems support multiple mission and business functions. Limiting privileges to change system components with respect to operational systems is necessary because changes to a system component may have far-reaching effects on mission and business processes supported by the system. The relationships between systems and mission/business processes are, in some cases, unknown to developers. System-related information includes operational procedures.

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · CM-5 (5) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · CM-5 (5) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · CM-5 (5) — Direct NIST identifier reference. GovRAMP source matrix

Configuration Management · Base control

CM-6 · Configuration Settings

Control statement and discussion

NIST control statement

a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: common secure configurations]; b. Implement the configuration settings; c. Identify, document, and approve any deviations from established configuration settings for [Assignment: system components] based on [Assignment: operational requirements] ; and d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.

Discussion

Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system. Common secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors. Implementation of a common secure configuration may be mandated at the organization level, mission and business process level, system level, or at a higher level, including by a regulatory agency. Common secure configurations include the United States Government Configuration Baseline [USGCB](#98498928-3ca3-44b3-8b1e-f48685373087) and security technical implementation guides (STIGs), which affect the implementation of [CM-6](#cm-6) and other controls such as [AC-19](#ac-19) and [CM-7](#cm-7) . The Security Content Automation Protocol (SCAP) and the defined standards within the protocol provide an effective method to uniquely identify, track, and control configuration settings.

GovRAMP crosswalk

Configuration Management · Enhancement

CM-6(1) · Automated Management, Application, and Verification

View parent control
Control statement and discussion

NIST control statement

Manage, apply, and verify configuration settings for [Assignment: system components] using [Assignment: organization-defined automated mechanisms].

Discussion

Automated tools (e.g., hardening tools, baseline configuration tools) can improve the accuracy, consistency, and availability of configuration settings information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.

GovRAMP crosswalk

  • GovRAMP Security Snapshot Readiness · CM-6 (1) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Core Readiness — 60 Controls · CM-6 (1) — Direct NIST identifier reference. GovRAMP source matrix
  • GovRAMP Moderate Readiness · CM-6 (1) — Direct NIST identifier reference. GovRAMP source matrix

Configuration Management · Base control

CM-8 · System Component Inventory

Control statement and discussion

NIST control statement

a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other system; 4. Is at the level of granularity deemed necessary for tracking and reporting; and 5. Includes the following information to achieve system component accountability: [Assignment: information] ; and b. Review and update the system component inventory [Assignment: frequency].

Discussion

System components are discrete, identifiable information technology assets that include hardware, software, and firmware. Organizations may choose to implement centralized system component inventories that include components from all organizational systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information, and for networked components, the machine names and network addresses across all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include date of receipt, cost, model, serial number, manufacturer, supplier information, component type, and physical location. Preventing duplicate accounting of system components addresses the lack of accountability that occurs when component ownership and system association is not known, especially in large or complex connected systems. Effective prevention of duplicate accounting of system components necessitates use of a unique identifier for each component. For software inventory, centrally managed software that is accessed via other systems is addressed as a component of the system on which it is installed and managed. Software installed on multiple organizational systems and managed at the system level is addressed for each individual system and may appear more than once in a centralized component inventory, necessitating a system association for each software instance in the centralized inventory to avoid duplicate accounting of components. Scanning systems implementing multiple network protocols (e.g., IPv4 and IPv6) can result in duplicate components being identified in different address spaces. The implementation of [CM-8(7)](#cm-8.7) can help to eliminate duplicate accounting of components.

GovRAMP crosswalk

Configuration Management · Base control

CM-9 · Configuration Management Plan

Control statement and discussion

NIST control statement

Develop, document, and implement a configuration management plan for the system that: a. Addresses roles, responsibilities, and configuration management processes and procedures; b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items; c. Defines the configuration items for the system and places the configuration items under configuration management; d. Is reviewed and approved by [Assignment: personnel or roles] ; and e. Protects the configuration management plan from unauthorized disclosure and modification.

Discussion

Configuration management activities occur throughout the system development life cycle. As such, there are developmental configuration management activities (e.g., the control of code and software libraries) and operational configuration management activities (e.g., control of installed components and how the components are configured). Configuration management plans satisfy the requirements in configuration management policies while being tailored to individual systems. Configuration management plans define processes and procedures for how configuration management is used to support system development life cycle activities. Configuration management plans are generated during the development and acquisition stage of the system development life cycle. The plans describe how to advance changes through change management processes; update configuration settings and baselines; maintain component inventories; control development, test, and operational environments; and develop, release, and update key documents. Organizations can employ templates to help ensure the consistent and timely development and implementation of configuration management plans. Templates can represent a configuration management plan for the organization with subsets of the plan implemented on a system by system basis. Configuration management approval processes include the designation of key stakeholders responsible for reviewing and approving proposed changes to systems, and personnel who conduct security and privacy impact analyses prior to the implementation of changes to the systems. Configuration items are the system components, such as the hardware, software, firmware, and documentation to be configuration-managed. As systems continue through the system development life cycle, new configuration items may be identified, and some existing configuration items may no longer need to be under configuration control.

GovRAMP crosswalk

Contingency Planning · Base control

CP-7 · Alternate Processing Site

Control statement and discussion

NIST control statement

a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: system operations] for essential mission and business functions within [Assignment: time period] when the primary processing capabilities are unavailable; b. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and c. Provide controls at the alternate processing site that are equivalent to those at the primary site.

Discussion

Alternate processing sites are geographically distinct from primary processing sites and provide processing capability if the primary processing site is not available. The alternate processing capability may be addressed using a physical processing site or other alternatives, such as failover to a cloud-based service provider or other internally or externally provided processing service. Geographically distributed architectures that support contingency requirements may also be considered alternate processing sites. Controls that are covered by alternate processing site agreements include the environmental conditions at alternate sites, access rules, physical and environmental protection requirements, and the coordination for the transfer and assignment of personnel. Requirements are allocated to alternate processing sites that reflect the requirements in contingency plans to maintain essential mission and business functions despite disruption, compromise, or failure in organizational systems.

GovRAMP crosswalk

Contingency Planning · Base control

CP-8 · Telecommunications Services

Control statement and discussion

NIST control statement

Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: system operations] for essential mission and business functions within [Assignment: time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

Discussion

Telecommunications services (for data and voice) for primary and alternate processing and storage sites are in scope for [CP-8](#cp-8) . Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential mission and business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary or alternate sites. Alternate telecommunications services include additional organizational or commercial ground-based circuits or lines, network-based approaches to telecommunications, or the use of satellites. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.

GovRAMP crosswalk

Contingency Planning · Enhancement

CP-8(1) · Priority of Service Provisions

View parent control
Control statement and discussion

NIST control statement

(a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and (b) Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.

Discussion

Organizations consider the potential mission or business impact in situations where telecommunications service providers are servicing other organizations with similar priority of service provisions. Telecommunications Service Priority (TSP) is a Federal Communications Commission (FCC) program that directs telecommunications service providers (e.g., wireline and wireless phone companies) to give preferential treatment to users enrolled in the program when they need to add new lines or have their lines restored following a disruption of service, regardless of the cause. The FCC sets the rules and policies for the TSP program, and the Department of Homeland Security manages the TSP program. The TSP program is always in effect and not contingent on a major disaster or attack taking place. Federal sponsorship is required to enroll in the TSP program.

GovRAMP crosswalk