National Institute of Standards and Technology (NIST) 800-53 Revision 5

nist_800_53_revision_5_aws

NIST-800-53-Revision-5

OfficialVerified

The NIST 800-53 (Rev. 5) Low-Moderate-High framework represents the security controls and the associated assessment procedures that are defined in NIST SP 800-53 Revision 5 Recommended Security Controls for Federal Information Systems and Organizations. For any discrepancies that are noted in the content between this NIST SP 800-53 framework and the latest published NIST Special Publication SP 800-53 Revision 5, refer to the official published documents that are available at the NIST Computer Security Resource Center.

287requirements105checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance nist_800_53_revision_5_aws

Requirements (287)

Access Control (AC)60621

ac_2_1Support the management of system accounts using [Assignment: organization-defined automated mechanisms].16

Attributes

Item Id: ac_2_1
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac_2_3_aSupport the management of system accounts using [Assignment: organization-defined automated mechanisms].6

Attributes

Item Id: ac_2_3_a
Section: Access Control (AC)
Service: iam
Sub Group: AC-2(3) Disable Accounts
Sub Section: Account Management (AC-2)

ac_2_3_bDisable accounts within [Assignment: organization-defined time period] when the accounts: (b) Are no longer associated with a user or individual.6

Attributes

Item Id: ac_2_3_b
Section: Access Control (AC)
Service: iam
Sub Group: AC-2(3) Disable Accounts
Sub Section: Account Management (AC-2)

ac_2_3_cDisable accounts within [Assignment: organization-defined time period] when the accounts: (c) Are in violation of organizational policy.6

Attributes

Item Id: ac_2_3_c
Section: Access Control (AC)
Service: aws
Sub Group: AC-2(3) Disable Accounts
Sub Section: Account Management (AC-2)

ac_2_3_dDisable accounts within [Assignment: organization-defined time period] when the accounts: (d) Have been inactive for [Assignment: organization-defined time period].6

Attributes

Item Id: ac_2_3_d
Section: Access Control (AC)
Service: iam
Sub Group: AC-2(3) Disable Accounts
Sub Section: Account Management (AC-2)

ac_2_3Disable accounts within [Assignment: organization-defined time period] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for [Assignment: organization-defined time period].6

Attributes

Item Id: ac_2_3
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac_2_4Automatically audit account creation, modification, enabling, disabling, and removal actions.7

Attributes

Item Id: ac_2_4
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac_2_6Implement [Assignment: organization-defined dynamic privilege management capabilities].20

Attributes

Item Id: ac_2_6
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac_2_12_aMonitor system accounts for [Assignment: organization-defined atypical usage].1

Attributes

Item Id: ac_2_12_a
Section: Access Control (AC)
Service: guarduty
Sub Group: AC-2(12) Account Monitoring
Sub Section: Account Management (AC-2)

ac_2_d_1d. Specify: 1. Authorized users of the system;personnel termination and transfer processes.1

Attributes

Item Id: ac_2_d_1
Section: Access Control (AC)
Service: iam
Sub Section: Account Management (AC-2)

ac_2_gThe organization: g. Monitors the use of information system accounts.5

Attributes

Item Id: ac_2_g
Section: Access Control (AC)
Service: iam
Sub Section: Account Management (AC-2)

ac_2_i_2i. Authorize access to the system based on: 2. Intended system usage.4

Attributes

Item Id: ac_2_¡_2
Section: Access Control (AC)
Service: iam
Sub Section: Account Management (AC-2)

ac_2_jThe organization: j. Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency].5

Attributes

Item Id: ac_2_j
Section: Access Control (AC)
Service: iam
Sub Section: Account Management (AC-2)

ac_3Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.22

Attributes

Item Id: ac_3
Section: Access Control (AC)
Service: aws

ac_3_1Employ an audited override of automated access control mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].7

Attributes

Item Id: ac_3_1
Section: Access Control (AC)
Service: aws
Sub Section: Access Enforcement (AC-3)

ac_3_2Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].3

Attributes

Item Id: ac_3_2
Section: Access Control (AC)
Service: iam
Sub Section: Access Enforcement (AC-3)

ac_3_3Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across the covered subjects and objects within the system; (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (1) Passing the information to unauthorized subjects or objects; (2) Granting its privileges to other subjects; (3) Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components; (4) Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects; and (5) Changing the rules governing access control; and (c) Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints.14

Attributes

Item Id: ac_3_3
Section: Access Control (AC)
Service: aws
Sub Section: Access Enforcement (AC-3)

ac_3_3_aEnforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across the covered subjects and objects within the system.14

Attributes

Item Id: ac_3_3_a
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(3) Mandatory Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_3_b_1Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (1) Passing the information to unauthorized subjects or objects.14

Attributes

Item Id: ac_3_3_b_1
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(3) Mandatory Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_3_b_2Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (2) Granting its privileges to other subjects.14

Attributes

Item Id: ac_3_3_b_2
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(3) Mandatory Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_3_b_3Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (3) Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components.14

Attributes

Item Id: ac_3_3_b_3
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(3) Mandatory Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_3_b_4Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (4) Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects.14

Attributes

Item Id: ac_3_3_b_4
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(3) Mandatory Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_3_b_5Enforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (5) Changing the rules governing access.14

Attributes

Item Id: ac_3_3_b_5
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(3) Mandatory Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_3_cEnforce [Assignment: organization-defined mandatory access policy] over the set of covered subjects and objects specified in the policy, and where the policy: (c) Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints.14

Attributes

Item Id: ac_3_3_c
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(3) Mandatory Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_4Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (a) Pass the information to any other subjects or objects; (b) Grant its privileges to other subjects; (c) Change security attributes on subjects, objects, the system, or the system’s components; (d) Choose the security attributes to be associated with newly created or revised objects; or (e) Change the rules governing access control.14

Attributes

Item Id: ac_3_4
Section: Access Control (AC)
Service: aws
Sub Section: Access Enforcement (AC-3)

ac_3_4_aEnforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (a) Pass the information to any other subjects or objects.14

Attributes

Item Id: ac_3_4_a
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(4) Discretionary Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_4_bEnforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (b) Grant its privileges to other subjects.14

Attributes

Item Id: ac_3_4_b
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(4) Discretionary Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_4_cEnforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (c) Change security attributes on subjects, objects, the system, or the system’s components.14

Attributes

Item Id: ac_3_4_c
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(4) Discretionary Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_4_dEnforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (d) Choose the security attributes to be associated with newly created or revised objects.14

Attributes

Item Id: ac_3_4_d
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(4) Discretionary Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_4_eEnforce [Assignment: organization-defined discretionary access policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (e) Change the rules governing access.14

Attributes

Item Id: ac_3_4_e
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(4) Discretionary Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_7Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].20

Attributes

Item Id: ac_3_7
Section: Access Control (AC)
Service: aws
Sub Section: Access Enforcement (AC-3)

ac_3_8Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: organization-defined rules governing the timing of revocations of access authorizations].17

Attributes

Item Id: ac_3_8
Section: Access Control (AC)
Service: aws
Sub Section: Access Enforcement (AC-3)

ac_3_10Employ an audited override of automated access mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].7

Attributes

Item Id: ac_3_10
Section: Access Control (AC)
Service: aws
Sub Section: Access Enforcement (AC-3)

ac_3_12_aRequire applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: organization-defined system applications and functions].14

Attributes

Item Id: ac_3_12_a
Section: Access Control (AC)
Service: aws
Sub Group: AC-3(12) Assert And Enforce Application Access
Sub Section: Access Enforcement (AC-3)

ac_3_12_bProvide an enforcement mechanism to prevent unauthorized access;1

Attributes

Item Id: ac_3_12_b
Section: Access Control (AC)
Service: guarduty
Sub Group: AC-3(12) Assert And Enforce Application Access
Sub Section: Access Enforcement (AC-3)

ac_3_13Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes to assume access permissions].14

Attributes

Item Id: ac_3_13
Section: Access Control (AC)
Service: guarduty
Sub Section: Access Enforcement (AC-3)

ac_3_15_aEnforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy.14

Attributes

Item Id: ac_3_15_a
Section: Access Control (AC)
Service: guarduty
Sub Group: AC-3(15) Discretionary And Mandatory Access Control
Sub Section: Access Enforcement (AC-3)

ac_3_15_bEnforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.14

Attributes

Item Id: ac_3_15_b
Section: Access Control (AC)
Service: guarduty
Sub Group: AC-3(15) Discretionary And Mandatory Access Control
Sub Section: Access Enforcement (AC-3)

ac_4Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].4

Attributes

Item Id: ac_4
Section: Access Control (AC)
Service: aws

ac_4_21Separate information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types of information].17

Attributes

Item Id: ac_4_21
Section: Access Control (AC)
Service: aws
Sub Section: Information Flow Enforcement (AC-4)

ac_4_22Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains.4

Attributes

Item Id: ac_4_22
Section: Access Control (AC)
Service: aws
Sub Section: Information Flow Enforcement (AC-4)

ac_4_26When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.11

Attributes

Item Id: ac_4_26
Section: Access Control (AC)
Service: aws
Sub Section: Information Flow Enforcement (AC-4)

ac_4_28When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.14

Attributes

Item Id: ac_4_28
Section: Access Control (AC)
Service: aws
Sub Section: Information Flow Enforcement (AC-4)

ac_5_bDefine system access authorizations to support separation of duties.3

Attributes

Item Id: ac_5_b
Section: Access Control (AC)
Service: aws
Sub Section: Separation Of Duties (AC-5)

ac_6Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.27

Attributes

Item Id: ac_6
Section: Access Control (AC)
Service: aws

ac_6_2Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.4

Attributes

Item Id: ac_6_2
Section: Access Control (AC)
Service: iam
Sub Section: Least Privilege (AC-6)

ac_6_3Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access in the security plan for the system.4

Attributes

Item Id: ac_6_3
Section: Access Control (AC)
Service: iam
Sub Section: Least Privilege (AC-6)

ac_6_9Log the execution of privileged functions.7

Attributes

Item Id: ac_6_9
Section: Access Control (AC)
Service: aws
Sub Section: Least Privilege (AC-6)

ac_6_10Prevent non-privileged users from executing privileged functions.4

Attributes

Item Id: ac_6_10
Section: Access Control (AC)
Service: iam
Sub Section: Least Privilege (AC-6)

ac_7_4Prevent non-privileged users from executing privileged functions.4

Attributes

Item Id: ac_7_4
Section: Access Control (AC)
Service: iam
Sub Section: Unsuccessful Logon Attempts (AC-7)

ac_7_4_aAllow the use of [Assignment: organization-defined authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded.4

Attributes

Item Id: ac_7_4_a
Section: Access Control (AC)
Service: iam
Sub Group: AC-7(4) Use Of Alternate Authentication Factor
Sub Section: Unsuccessful Logon Attempts (AC-7)

ac_16_bEnsure that the attribute associations are made and retained with the information.1

Attributes

Item Id: ac_16_b
Section: Access Control (AC)
Service: cloudwatch
Sub Section: Security And Privacy Attributes (AC-16)

ac_17_bAuthorize each type of remote access to the system prior to allowing such connections.15

Attributes

Item Id: ac_17_b
Section: Access Control (AC)
Service: aws
Sub Section: Remote Access (AC-17)

ac_17_1Employ automated mechanisms to monitor and control remote access methods.15

Attributes

Item Id: ac_17_1
Section: Access Control (AC)
Service: aws
Sub Section: Remote Access (AC-17)

ac_17_2Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.3

Attributes

Item Id: ac_17_2
Section: Access Control (AC)
Service: aws
Sub Section: Remote Access (AC-17)

ac_17_4_aAuthorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs];14

Attributes

Item Id: ac_17_4_a
Section: Access Control (AC)
Service: aws
Sub Group: AC-17(4) Privileged Commands And Access
Sub Section: Remote Access (AC-17)

ac_17_9Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].15

Attributes

Item Id: ac_17_9
Section: Access Control (AC)
Service: aws
Sub Section: Remote Access (AC-17)

ac_17_10Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].15

Attributes

Item Id: ac_17_10
Section: Access Control (AC)
Service: aws
Sub Section: Remote Access (AC-17)

ac_24[Selection: Establish procedures; Implement mechanisms] to ensure [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement.14

Attributes

Item Id: ac_24
Section: Access Control (AC)
Service: aws

ac_24_1Transmit [Assignment: organization-defined access authorization information] using [Assignment: organization-defined controls] to [Assignment: organization-defined systems] that enforce access control decisions.4

Attributes

Item Id: ac_24_1
Section: Access Control (AC)
Service: aws
Sub Section: Access Control Decisions (AC-24)

Audit and Accountability (AU)34315

au_2_bCoordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.12

Attributes

Item Id: au_2_b
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Event Logging (AU-2)

au_3_1Generate audit records containing the following additional information: [Assignment: organization-defined additional information].2

Attributes

Item Id: au_3_1
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Content of Audit Records (AU-3)

au_3_aEnsure that audit records contain information that establishes the following: a. What type of event occurred.11

Attributes

Item Id: au_3_a
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Content of Audit Records (AU-3)

au_3_bEnsure that audit records contain information that establishes the following: b. When the event occurred.11

Attributes

Item Id: au_3_b
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Content of Audit Records (AU-3)

au_3_cEnsure that audit records contain information that establishes the following: c. Where the event occurred.11

Attributes

Item Id: au_3_c
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Content of Audit Records (AU-3)

au_3_dEnsure that audit records contain information that establishes the following: d. Source of the event.11

Attributes

Item Id: au_3_d
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Content of Audit Records (AU-3)

au_3_eEnsure that audit records contain information that establishes the following: e. Outcome of the event.11

Attributes

Item Id: au_3_e
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Content of Audit Records (AU-3)

au_3_fEnsure that audit records contain information that establishes the following: e. Outcome of the event.10

Attributes

Item Id: au_3_f
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Content of Audit Records (AU-3)

au_4_1Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.1

Attributes

Item Id: au_4_1
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Log Stprage Capacity (AU-4)

au_6_1Integrate audit record review, analysis, and reporting processes using [Assignment: organization-defined automated mechanisms].7

Attributes

Item Id: au_6_1
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Review, Analysis And Reporting (AU-6)

au_6_3Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.12

Attributes

Item Id: au_6_3
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Review, Analysis And Reporting (AU-6)

au_6_4Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.12

Attributes

Item Id: au_6_4
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Review, Analysis And Reporting (AU-6)

au_6_5Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined data/information collected from other sources]] to further enhance the ability to identify inappropriate or unusual activity.7

Attributes

Item Id: au_6_5
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Review, Analysis And Reporting (AU-6)

au_6_6Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.12

Attributes

Item Id: au_6_6
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Review, Analysis And Reporting (AU-6)

au_6_9Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.12

Attributes

Item Id: au_6_9
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Review, Analysis And Reporting (AU-6)

au_7_1Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: organization-defined fields within audit records].1

Attributes

Item Id: au_7_1
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Reduction And Report Generation (AU-7)

au_8_bRecord time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.11

Attributes

Item Id: au_8_b
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Time Stamps (AU-8)

au_9_aProtect audit information and audit logging tools from unauthorized access, modification, and deletion.1

Attributes

Item Id: au_9_a
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Protection of Audit Information (AU-9)

au_9_2Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.1

Attributes

Item Id: au_9_2
Section: Audit and Accountability (AU)
Service: s3
Sub Section: Protection of Audit Information (AU-9)

au_9_3Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.16

Attributes

Item Id: au_9_3
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Protection of Audit Information (AU-9)

au_9_7Store audit information on a component running a different operating system than the system or component being audited.1

Attributes

Item Id: au_9_7
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Protection of Audit Information (AU-9)

au_10Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions to be covered by non-repudiation].12

Attributes

Item Id: au_10
Section: Audit and Accountability (AU)
Service: aws

au_11Retain audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.1

Attributes

Item Id: au_11
Section: Audit and Accountability (AU)
Service: cloudwatch

au_11_1Employ [Assignment: organization-defined measures] to ensure that long-term audit records generated by the system can be retrieved.1

Attributes

Item Id: au_11_1
Section: Audit and Accountability (AU)
Service: cloudwatch
Sub Section: Audit Record Retention (AU-11)

au_12_aProvide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components].12

Attributes

Item Id: au_12_a
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Generation (AU-12)

au_12_cGenerate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3.12

Attributes

Item Id: au_12_c
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Generation (AU-12)

au_12_1Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail].12

Attributes

Item Id: au_12_1
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Generation (AU-12)

au_12_2Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.12

Attributes

Item Id: au_12_2
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Generation (AU-12)

au_12_3Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds].19

Attributes

Item Id: au_12_3
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Generation (AU-12)

au_12_4Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.11

Attributes

Item Id: au_12_4
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Record Generation (AU-12)

au_14_aProvide and implement the capability for [Assignment: organization-defined users or roles] to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: organization-defined circumstances].19

Attributes

Item Id: au_14_a
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Session Audit (AU-14)

au_14_bDevelop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.19

Attributes

Item Id: au_14_b
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Session Audit (AU-14)

au_14_3Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.11

Attributes

Item Id: au_14_3
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Session Audit (AU-14)

au_16Employ [Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries.1

Attributes

Item Id: au_16
Section: Audit and Accountability (AU)
Service: aws

Assessment, Authorization, And Monitoring (CA)639

ca_2_2Include as part of control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment]].5

Attributes

Item Id: ca_2_2
Section: Assessment, Authorization, And Monitoring (CA)
Service: aws
Sub Section: Control Assessments (CA-2)

ca_2_dAssess the controls in the system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements.2

Attributes

Item Id: ca_2_d
Section: Assessment, Authorization, And Monitoring (CA)
Service: aws
Sub Section: Control Assessments (CA-2)

ca_7Continuously monitor configuration management processes. Determine security impact, environment and operational risks.7

Attributes

Item Id: ca_7
Section: Assessment, Authorization, And Monitoring (CA)
Service: aws

ca_7_bDevelop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness.19

Attributes

Item Id: ca_7_b
Section: Assessment, Authorization, And Monitoring (CA)
Service: aws
Sub Section: Continuous Monitoring (CA-7)

ca_7_4_cEnsure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (c) Change monitoring.2

Attributes

Item Id: ca_7_4_c
Section: Assessment, Authorization, And Monitoring (CA)
Service: aws
Sub Group: CA-7(4) Risk Monitoring
Sub Section: Continuous Monitoring (CA-7)

ca_9_bDocument, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated.4

Attributes

Item Id: ca_9_b
Section: Assessment, Authorization, And Monitoring (CA)
Service: aws
Sub Section: Internal System Connections (CA-9)

Configuration Management (CM)26150

cm_2_aDevelop, document, and maintain under configuration control, a current baseline configuration of the system.5

Attributes

Item Id: cm_2_a
Section: Configuration Management (CM)
Service: aws
Sub Section: Baseline Configuration (CM-2)

cm_2_bReview and update the baseline configuration of the system: 1. [Assignment: organization-defined frequency]; 2. When required due to [Assignment: organization-defined circumstances]; and 3. When system components are installed or upgraded.4

Attributes

Item Id: cm_2_b
Section: Configuration Management (CM)
Service: aws
Sub Section: Baseline Configuration (CM-2)

cm_2_b_1Review and update the baseline configuration of the system: 1. [Assignment: organization-defined frequency].4

Attributes

Item Id: cm_2_b_1
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-2(b)
Sub Section: Baseline Configuration (CM-2)

cm_2_b_2Review and update the baseline configuration of the system: 2. When required due to [Assignment: organization-defined circumstances].4

Attributes

Item Id: cm_2_b_2
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-2(b)
Sub Section: Baseline Configuration (CM-2)

cm_2_b_3Review and update the baseline configuration of the system: 3 When system components are installed or upgraded.4

Attributes

Item Id: cm_2_b_3
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-2(b)
Sub Section: Baseline Configuration (CM-2)

cm_2_2Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].5

Attributes

Item Id: cm_2_2
Section: Configuration Management (CM)
Service: aws
Sub Section: Baseline Configuration (CM-2)

cm_3_3Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms].4

Attributes

Item Id: cm_3_3
Section: Configuration Management (CM)
Service: aws
Sub Section: Configuration Change Control (CM-3)

cm_3_aDetermine and document the types of changes to the system that are configuration-controlled.2

Attributes

Item Id: cm_3_a
Section: Configuration Management (CM)
Service: aws
Sub Section: Configuration Change Control (CM-3)

cm_5_1_aEnforce access restrictions using [Assignment: organization-defined automated mechanisms].14

Attributes

Item Id: cm_5_1_a
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-5(1) Automated Access Enforcement And Audit Records
Sub Section: Access Restrictions For Change (CM-5)

cm_5_1_bAutomatically generate audit records of the enforcement actions.11

Attributes

Item Id: cm_5_1_b
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-5(1) Automated Access Enforcement And Audit Records
Sub Section: Access Restrictions For Change (CM-5)

cm_6The organization: (i) establishes mandatory configuration settings for information technology products employed within the information system; (ii) configures the security settings of information technology products to the most restrictive mode consistent with operational requirements; (iii) documents the configuration settings; and (iv) enforces the configuration settings in all components of the information system.2

Attributes

Item Id: cm_6
Section: Configuration Management (CM)
Service: aws

cm_6_aEstablish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations].32

Attributes

Item Id: cm_6_a
Section: Configuration Management (CM)
Service: aws
Sub Section: Configuration Settings (CM-6)

cm_7_bProhibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].2

Attributes

Item Id: cm_7_b
Section: Configuration Management (CM)
Service: aws
Sub Section: Least Functionality (CM-7)

cm_8_1Update the inventory of system components as part of component installations, removals, and system updates.2

Attributes

Item Id: cm_8_1
Section: Configuration Management (CM)
Service: aws
Sub Section: System Component Inventory (CM-8)

cm_8_2Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms].1

Attributes

Item Id: cm_8_2
Section: Configuration Management (CM)
Service: aws
Sub Section: System Component Inventory (CM-8)

cm_8_3_aDetect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency].3

Attributes

Item Id: cm_8_3_a
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-8(3) Automated Unauthorized Component Detection
Sub Section: System Component Inventory (CM-8)

cm_8_6Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.5

Attributes

Item Id: cm_8_6
Section: Configuration Management (CM)
Service: aws
Sub Section: System Component Inventory (CM-8)

cm_8_aDevelop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other system; 4. Is at the level of granularity deemed necessary for tracking and reporting; and 5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability].2

Attributes

Item Id: cm_8_a
Section: Configuration Management (CM)
Service: aws
Sub Section: System Component Inventory (CM-8)

cm_8_a_1Develop and document an inventory of system components that: 1. Accurately reflects the system.2

Attributes

Item Id: cm_8_a_1
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-8(a)
Sub Section: System Component Inventory (CM-8)

cm_8_a_2Develop and document an inventory of system components that: 2. Includes all components within the system.2

Attributes

Item Id: cm_8_a_2
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-8(a)
Sub Section: System Component Inventory (CM-8)

cm_8_a_3Develop and document an inventory of system components that: 3. Does not include duplicate accounting of components or components assigned to any other system.2

Attributes

Item Id: cm_8_a_3
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-8(a)
Sub Section: System Component Inventory (CM-8)

cm_8_a_4Develop and document an inventory of system components that: 4. Is at the level of granularity deemed necessary for tracking and reporting.2

Attributes

Item Id: cm_8_a_4
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-8(a)
Sub Section: System Component Inventory (CM-8)

cm_8_a_5Develop and document an inventory of system components that: 5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability].2

Attributes

Item Id: cm_8_a_5
Section: Configuration Management (CM)
Service: aws
Sub Group: CM-8(a)
Sub Section: System Component Inventory (CM-8)

cm_8_bReview and update the system component inventory [Assignment: organization-defined frequency].2

Attributes

Item Id: cm_8_b
Section: Configuration Management (CM)
Service: aws
Sub Section: System Component Inventory (CM-8)

cm_9_bDevelop, document, and implement a configuration management plan for the system that: b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items.31

Attributes

Item Id: cm_9_b
Section: Configuration Management (CM)
Service: aws
Sub Section: Configuration Management Plan (CM-9)

cm_12_bIdentify and document the users who have access to the system and system components where the information is processed and stored.1

Attributes

Item Id: cm_12_b
Section: Configuration Management (CM)
Service: aws
Sub Section: Information Location (CM-12)

Contingency Planning (CP)2093

cp_1_a_1_ba. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] contingency planning policy that: (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.3

Attributes

Item Id: cp_1_a_1_b
Section: Contingency Planning (CP)
Service: aws
Sub Group: CP-1(a)
Sub Section: Policy And Procedures (CP-1)

cp_1_a_2a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls.3

Attributes

Item Id: cp_1_a_2
Section: Contingency Planning (CP)
Service: aws
Sub Group: CP-1(a)
Sub Section: Policy And Procedures (CP-1)

cp_1_2Implement transaction recovery for systems that are transaction-based.5

Attributes

Item Id: cp_1_2
Section: Contingency Planning (CP)
Service: aws
Sub Section: Policy And Procedures (CP-1)

cp_2_aa. Develop a contingency plan for the system that: 1. Identifies essential mission and business functions and associated contingency requirements; 2. Provides recovery objectives, restoration priorities, and metrics; 3. Addresses contingency roles, responsibilities, assigned individuals with contact information; 4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6. Addresses the sharing of contingency information; and 7. Is reviewed and approved by [Assignment: organization-defined personnel or roles]3

Attributes

Item Id: cp_2_a
Section: Contingency Planning (CP)
Service: aws
Sub Section: Contingency Plan (CP-2)

cp_2_a_6Develop a contingency plan for the system that: 6. Addresses the sharing of contingency information.3

Attributes

Item Id: cp_2_a_6
Section: Contingency Planning (CP)
Service: aws
Sub Group: CP-2(a)
Sub Section: Contingency Plan (CP-2)

cp_2_a_7Develop a contingency plan for the system that: 7. Is reviewed and approved by [Assignment: organization-defined personnel or roles].3

Attributes

Item Id: cp_2_a_7
Section: Contingency Planning (CP)
Service: aws
Sub Group: CP-2(a)
Sub Section: Contingency Plan (CP-2)

cp_2_dReview the contingency plan for the system [Assignment: organization-defined frequency]3

Attributes

Item Id: cp_2_d
Section: Contingency Planning (CP)
Service: aws
Sub Section: Contingency Plan (CP-2)

cp_2_eUpdate the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing.3

Attributes

Item Id: cp_2_e
Section: Contingency Planning (CP)
Service: aws
Sub Section: Contingency Plan (CP-2)

cp_2_5Plan for the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at primary processing and/or storage sites.9

Attributes

Item Id: cp_2_5
Section: Contingency Planning (CP)
Service: aws
Sub Section: Contingency Plan (CP-2)

cp_2_6Plan for the transfer of [Selection: all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to primary processing and/or storage sites.1

Attributes

Item Id: cp_2_6
Section: Contingency Planning (CP)
Service: aws
Sub Section: Contingency Plan (CP-2)

cp_6_aEstablish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information.4

Attributes

Item Id: cp_6_a
Section: Contingency Planning (CP)
Service: aws
Sub Section: Alternate Storage Sites (CP-6)

cp_6_1Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.4

Attributes

Item Id: cp_6_1
Section: Contingency Planning (CP)
Service: aws
Sub Section: Alternate Storage Sites (CP-6)

cp_6_2Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.6

Attributes

Item Id: cp_6_2
Section: Contingency Planning (CP)
Service: aws
Sub Section: Alternate Storage Sites (CP-6)

cp_9_aConduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives].6

Attributes

Item Id: cp_9_a
Section: Contingency Planning (CP)
Service: aws
Sub Section: System Backup (CP-9)

cp_9_bConduct backups of system-level information contained in the system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives].6

Attributes

Item Id: cp_9_b
Section: Contingency Planning (CP)
Service: aws
Sub Section: System Backup (CP-9)

cp_9_cConduct backups of system documentation, including security- and privacy-related documentation [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives].6

Attributes

Item Id: cp_9_c
Section: Contingency Planning (CP)
Service: aws
Sub Section: System Backup (CP-9)

cp_9_dProtect the confidentiality, integrity, and availability of backup information.11

Attributes

Item Id: cp_9_d
Section: Contingency Planning (CP)
Service: aws
Sub Section: System Backup (CP-9)

cp_9_8Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information].2

Attributes

Item Id: cp_9_8
Section: Contingency Planning (CP)
Service: aws
Sub Section: System Backup (CP-9)

cp_10Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.7

Attributes

Item Id: cp_10
Section: Contingency Planning (CP)
Service: aws

cp_10_2Implement transaction recovery for systems that are transaction-based.5

Attributes

Item Id: cp_10_2
Section: Contingency Planning (CP)
Service: aws
Sub Section: System Recovery And Reconstitution (CP-10)

Identification and Authentication (IA)2547

ia_2The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).1

Attributes

Item Id: ia_2
Section: Identification and Authentication (IA)
Service: iam

ia_2_1Implement multi-factor authentication for access to privileged accounts.3

Attributes

Item Id: ia_2_1
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identification and Authentication (Organizational users) (IA-2)

ia_2_2Implement multi-factor authentication for access to non-privileged accounts.3

Attributes

Item Id: ia_2_2
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identification and Authentication (Organizational users) (IA-2)

ia_2_6Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that: (a) One of the factors is provided by a device separate from the system gaining access; and (b) The device meets [Assignment: organization-defined strength of mechanism requirements].3

Attributes

Item Id: ia_2_6
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identification and Authentication (Organizational users) (IA-2)

ia_2_6_aImplement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that: (a) One of the factors is provided by a device separate from the system gaining access.3

Attributes

Item Id: ia_2_6_a
Section: Identification and Authentication (IA)
Service: iam
Sub Group: IA-2(6) Acces To Accounts — Separate Device
Sub Section: Identification and Authentication (Organizational users) (IA-2)

ia_2_8Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts].3

Attributes

Item Id: ia_2_8
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identification and Authentication (Organizational users) (IA-2)

ia_3_3_bAudit lease information when assigned to a device.11

Attributes

Item Id: ia_3_3_b
Section: Identification and Authentication (IA)
Service: aws
Sub Group: IA-3(3) Dynamic Address Allocation
Sub Section: Device Identification And Authentication (IA-3)

ia_4_bManage system identifiers by: b. Selecting an identifier that identifies an individual, group, role, service, or device.1

Attributes

Item Id: ia_4_b
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identifier Management (IA-4)

ia_4_dManage system identifiers by: d. Preventing reuse of identifiers for [Assignment: organization-defined time period].1

Attributes

Item Id: ia_4_d
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identifier Management (IA-4)

ia_4_4Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristic identifying individual status].1

Attributes

Item Id: ia_4_4
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identifier Management (IA-4)

ia_4_8Generate pairwise pseudonymous identifiers.1

Attributes

Item Id: ia_4_8
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identifier Management (IA-4)

ia_5Authenticate users and devices. Automate administrative control. Enforce restrictions. Protect against unauthorized use.1

Attributes

Item Id: ia_5
Section: Identification and Authentication (IA)
Service: aws

ia_5_bManage system authenticators by: b. Establishing initial authenticator content for any authenticators issued by the organization.1

Attributes

Item Id: ia_5_b
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Authenticator Management (IA-5)

ia_5_cManage system authenticators by: c. Ensuring that authenticators have sufficient strength of mechanism for their intended use.1

Attributes

Item Id: ia_5_c
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Authenticator Management (IA-5)

ia_5_dManage system authenticators by: d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators.1

Attributes

Item Id: ia_5_d
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Authenticator Management (IA-5)

ia_5_fManage system authenticators by: f. Changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur.1

Attributes

Item Id: ia_5_f
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Authenticator Management (IA-5)

ia_5_hManage system authenticators by: h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators.1

Attributes

Item Id: ia_5_h
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Authenticator Management (IA-5)

ia_5_1_cFor password-based authentication: (c) Transmit passwords only over cryptographically-protected channels.3

Attributes

Item Id: ia_5_1_c
Section: Identification and Authentication (IA)
Service: aws
Sub Group: IA-5(1) Password-Based Authentication
Sub Section: Authenticator Management (IA-5)

ia_5_1_fFor password-based authentication: (f) Allow user selection of long passwords and passphrases, including spaces and all printable characters.1

Attributes

Item Id: ia_5_1_f
Section: Identification and Authentication (IA)
Service: iam
Sub Group: IA-5(1) Password-Based Authentication
Sub Section: Authenticator Management (IA-5)

ia_5_1_gFor password-based authentication: (g) Employ automated tools to assist the user in selecting strong password authenticators.1

Attributes

Item Id: ia_5_1_g
Section: Identification and Authentication (IA)
Service: iam
Sub Group: IA-5(1) Password-Based Authentication
Sub Section: Authenticator Management (IA-5)

ia_5_1_hFor password-based authentication: (h) Enforce the following composition and complexity rules: [Assignment: organization-defined composition and complexity rules].1

Attributes

Item Id: ia_5_1_h
Section: Identification and Authentication (IA)
Service: iam
Sub Group: IA-5(1) Password-Based Authentication
Sub Section: Authenticator Management (IA-5)

ia_5_8Implement [Assignment: organization-defined security controls] to manage the risk of compromise due to individuals having accounts on multiple systems.1

Attributes

Item Id: ia_5_8
Section: Identification and Authentication (IA)
Service: iam

ia_5_18_aEmploy [Assignment: organization-defined password managers] to generate and manage passwords.1

Attributes

Item Id: ia_5_18_a
Section: Identification and Authentication (IA)
Service: iam
Sub Group: IA-5(18) Password Managers
Sub Section: Authenticator Management (IA-5)

ia_5_18_bProtect the passwords using [Assignment: organization-defined controls].1

Attributes

Item Id: ia_5_18_b
Section: Identification and Authentication (IA)
Service: iam
Sub Group: IA-5(18) Password Managers
Sub Section: Authenticator Management (IA-5)

ia_8_2_bDocument and maintain a list of accepted external authenticators.1

Attributes

Item Id: ia_8_2_b
Section: Identification and Authentication (IA)
Service: iam
Sub Group: IA-8(2) Acceptance Of External Authenticators
Sub Section: Identification And Authentication (Non-Organizational Users) (IA-8)

Incident Response (IR)11

ir_4_aImplement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.1

Attributes

Item Id: ir_4_a
Section: Incident Response (IR)
Service: guarduty
Sub Section: Incident Handling (IR-4)

Maintenance (MA)212

ma_4_cEmploy strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.1

Attributes

Item Id: ma_4_c
Section: Maintenance (MA)
Service: iam
Sub Section: Nonlocal Maintenance (MA-4)

ma_4_1_aLog [Assignment: organization-defined audit events] for nonlocal maintenance and diagnostic sessions.11

Attributes

Item Id: ma_4_1_a
Section: Maintenance (MA)
Service: aws
Sub Group: MA-4(1) Logging And Review
Sub Section: Nonlocal Maintenance (MA-4)

Media Protection (MP)120

mp_2Restrict access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].20

Attributes

Item Id: mp_2
Section: Media Protection (MP)
Service: aws

Physical And Environmental Protection (PE)22

pe_6_2Recognize [Assignment: organization-defined classes or types of intrusions] and initiate [Assignment: organization-defined response actions] using [Assignment: organization-defined automated mechanisms].1

Attributes

Item Id: pe_6_2
Section: Physical And Environmental Protection (PE)
Service: guarduty
Sub Section: Monitoring Physical Access (PE-6)

pe_6_4Monitor physical access to the system in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces containing one or more components of the system].1

Attributes

Item Id: pe_6_4
Section: Physical And Environmental Protection (PE)
Service: guarduty
Sub Section: Monitoring Physical Access (PE-6)

Program Management (PM)769

pm_11_bDetermine information protection and personally identifiable information processing needs arising from the defined mission and business processes.4

Attributes

Item Id: pm_11_b
Section: Program Management (PM)
Service: aws
Sub Section: Mission And Business Process Defination (PM-11)

pm_14_a_1a. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: 1. Are developed and maintained.19

Attributes

Item Id: pm_14_a_1
Section: Program Management (PM)
Service: aws
Sub Section: Testing, Training, And Monitoring (PM-14)

pm_14_bReview testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.19

Attributes

Item Id: pm_14_b
Section: Program Management (PM)
Service: aws
Sub Section: Testing, Training, And Monitoring (PM-14)

pm_16Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.1

Attributes

Item Id: pm_16
Section: Program Management (PM)
Service: guarduty

pm_17_bReview and update the policy and procedures [Assignment: organization-defined frequency].6

Attributes

Item Id: pm_17_b
Section: Program Management (PM)
Service: aws
Sub Section: Protecting Controlled Unclassified Information On External Systems (PM-17)

pm_21_bRetain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.1

Attributes

Item Id: pm_21_b
Section: Program Management (PM)
Service: cloudwatch
Sub Section: Accounting Of Disclosures (PM-21)

pm_31Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a. Establishing the following organization-wide metrics to be monitored: [Assignment: organization-defined metrics]; b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness; c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy; d. Correlation and analysis of information generated by control assessments and monitoring; e. Response actions to address results of the analysis of control assessment and monitoring information; and f. Reporting the security and privacy status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].19

Attributes

Item Id: pm_31
Section: Program Management (PM)
Service: aws

Risk Assessment (RA)1011

ra_1_aEstablish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existing controls.1

Attributes

Item Id: ra_1_a
Section: Risk Assessment (RA)
Service: guarduty
Sub Section: Policy And Procedures (RA-1)

ra_1_a_1Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems.1

Attributes

Item Id: ra_1_a_1
Section: Risk Assessment (RA)
Service: guarduty
Sub Group: RA-1(a)
Sub Section: Policy And Procedures (RA-1)

ra_1_a_2a. Establish and maintain a cyber threat hunting capability to: 2. Detect, track, and disrupt threats that evade existing controls.1

Attributes

Item Id: ra_1_a_2
Section: Risk Assessment (RA)
Service: guarduty
Sub Group: RA-1(a)
Sub Section: Policy And Procedures (RA-1)

ra_3_4Employ the following advanced automation and analytics capabilities to predict and identify risks to [Assignment: organization-defined systems or system components]: [Assignment: organization-defined advanced automation and analytics capabilities].1

Attributes

Item Id: ra_3_4
Section: Risk Assessment (RA)
Service: guarduty
Sub Section: Risk Assessment (RA-3)

ra_3_a_1a. Conduct a risk assessment, including: 1. Identifying threats to and vulnerabilities in the system.2

Attributes

Item Id: ra_3_a_1
Section: Risk Assessment (RA)
Service: guarduty
Sub Section: Risk Assessment (RA-3)

ra_5_aMonitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported.1

Attributes

Item Id: ra_5_a
Section: Risk Assessment (RA)
Service: guarduty
Sub Section: Vulnerability Monitoring And Scanning (RA-5)

ra_5_4Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].1

Attributes

Item Id: ra_5_4
Section: Risk Assessment (RA)
Service: guarduty
Sub Section: Vulnerability Monitoring And Scanning (RA-5)

ra_10_aEstablish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existings.1

Attributes

Item Id: ra_10_a
Section: Risk Assessment (RA)
Service: guarduty
Sub Section: Threat Hunting (RA-10)

ra_10_a_1Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existings.1

Attributes

Item Id: ra_10_a_1
Section: Risk Assessment (RA)
Service: guarduty
Sub Group: RA-10(a)
Sub Section: Threat Hunting (RA-10)

ra_10_a_2a. Establish and maintain a cyber threat hunting capability to: 2. Detect, track, and disrupt threats that evade existings.1

Attributes

Item Id: ra_10_a_2
Section: Risk Assessment (RA)
Service: guarduty
Sub Group: RA-10(a)
Sub Section: Threat Hunting (RA-10)

System and Services Acquisition (SA)45

sa_1_1Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.1

Attributes

Item Id: sa_1_1
Section: System and Services Acquisition (SA)
Service: cloudtrail
Sub Section: Policy And Procedures (SA-1)

sa_9_6Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.1

Attributes

Item Id: sa_9_6
Section: System and Services Acquisition (SA)
Service: kms
Sub Section: External System Services (SA-9)

sa_10_1Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.1

Attributes

Item Id: sa_10_1
Section: System and Services Acquisition (SA)
Service: kms
Sub Section: Developer Configuration Management (SA-10)

sa_15_a_4a. Require the developer of the system, system component, or system service to follow a documented development process that: 4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development.2

Attributes

Item Id: sa_15_a_4
Section: System and Services Acquisition (SA)
Service: aws
Sub Section: Development Process, Standards, And Tools (SA-15)

System and Communications Protection (SC)49423

sc_5_1Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: [Assignment: organization-defined denial-of-service attacks].1

Attributes

Item Id: sc_5_1
Section: System and Communications Protection (SC)
Service: guarduty
Sub Section: Denial Of Service Protection (SC-5)

sc_5_2Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding denial-of-service attacks.9

Attributes

Item Id: sc_5_2
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Denial Of Service Protection (SC-5)

sc_5_3_aEmploy the following monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system: [Assignment: organization-defined monitoring tools].1

Attributes

Item Id: sc_5_3_a
Section: System and Communications Protection (SC)
Service: guarduty
Sub Group: SC-5(3) Detection And Monitoring
Sub Section: Denial Of Service Protection (SC-5)

sc_5_3_bMonitor the following system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks: [Assignment: organization-defined system resources].1

Attributes

Item Id: sc_5_3_b
Section: System and Communications Protection (SC)
Service: guarduty
Sub Group: SC-5(3) Detection And Monitoring
Sub Section: Denial Of Service Protection (SC-5)

sc_5_a[Selection: Protect against; Limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events].1

Attributes

Item Id: sc_5_a
Section: System and Communications Protection (SC)
Service: guarduty
Sub Section: Denial Of Service Protection (SC-5)

sc_5_bEmploy the following controls to achieve the denial-of-service objective: [Assignment: organization-defined controls by type of denial-of-service event].1

Attributes

Item Id: sc_5_b
Section: System and Communications Protection (SC)
Service: guarduty
Sub Section: Denial Of Service Protection (SC-5)

sc_6Protect the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more): priority; quota; [Assignment: organization-defined controls]].1

Attributes

Item Id: sc_6
Section: System and Communications Protection (SC)
Service: aws

sc_7_2Provide the capability to dynamically isolate [Assignment: organization-defined system components] from other system components.12

Attributes

Item Id: sc_7_2
Section: System and Communications Protection (SC)
Service: guarduty
Sub Section: Boundary Protection (SC-7)

sc_7_3Limit the number of external network connections to the system.13

Attributes

Item Id: sc_7_3
Section: System and Communications Protection (SC)
Service: guarduty
Sub Section: Boundary Protection (SC-7)

sc_7_4_bEstablish a traffic flow policy for each managed interface.4

Attributes

Item Id: sc_7_4_b
Section: System and Communications Protection (SC)
Service: aws
Sub Group: SC-7(4) External Telecommunications Services
Sub Section: Boundary Protection (SC-7)

sc_7_4_gPublish information to enable remote networks to detect unauthorized control plane traffic from internal networks.4

Attributes

Item Id: sc_7_4_g
Section: System and Communications Protection (SC)
Service: aws
Sub Group: SC-7(4) External Telecommunications Services
Sub Section: Boundary Protection (SC-7)

sc_7_5Deny network communications traffic by default and allow network communications traffic by exception [Selection (one or more): at managed interfaces; for [Assignment: organization-defined systems]].6

Attributes

Item Id: sc_7_5
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_7Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: organization-defined safeguards].14

Attributes

Item Id: sc_7_7
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_9_aDetect and deny outgoing communications traffic posing a threat to external systems.12

Attributes

Item Id: sc_7_9_a
Section: System and Communications Protection (SC)
Service: aws
Sub Group: SC-7(9) Restrict Threatening Outgoing Communications Traffic
Sub Section: Boundary Protection (SC-7)

sc_7_9_bAudit the identity of internal users associated with denied communications.10

Attributes

Item Id: sc_7_9_b
Section: System and Communications Protection (SC)
Service: aws
Sub Group: SC-7(9) Restrict Threatening Outgoing Communications Traffic
Sub Section: Boundary Protection (SC-7)

sc_7_11Only allow incoming communications from [Assignment: organization-defined authorized sources] to be routed to [Assignment: organization-defined authorized destinations].16

Attributes

Item Id: sc_7_11
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_12Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components].16

Attributes

Item Id: sc_7_12
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_16Prevent the discovery of specific system components that represent a managed interface.16

Attributes

Item Id: sc_7_16
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_20Prevent the discovery of specific system components that represent a managed interface.12

Attributes

Item Id: sc_7_20
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_21Employ boundary protection mechanisms to isolate [Assignment: organization-defined system components] supporting [Assignment: organization-defined missions and/or business functions].15

Attributes

Item Id: sc_7_21
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_24_bFor systems that process personally identifiable information: (b) Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system.15

Attributes

Item Id: sc_7_24_b
Section: System and Communications Protection (SC)
Service: aws
Sub Group: SC-7(24) Personally Identifiable Information
Sub Section: Boundary Protection (SC-7)

sc_7_25Prohibit the direct connection of [Assignment: organization-defined unclassified national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].14

Attributes

Item Id: sc_7_25
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_26Prohibit the direct connection of a classified national security system to an external network without the use of [Assignment: organization-defined boundary protection device].14

Attributes

Item Id: sc_7_26
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_27Prohibit the direct connection of [Assignment: organization-defined unclassified non-national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].14

Attributes

Item Id: sc_7_27
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_28Prohibit the direct connection of [Assignment: organization-defined system] to a public network.14

Attributes

Item Id: sc_7_28
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_aMonitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system.16

Attributes

Item Id: sc_7_a
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_bImplement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks.12

Attributes

Item Id: sc_7_b
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7_cConnect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.15

Attributes

Item Id: sc_7_c
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_8Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.4

Attributes

Item Id: sc_8
Section: System and Communications Protection (SC)
Service: aws

sc_8_1Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.9

Attributes

Item Id: sc_8_1
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Transmission Confidentiality And Integrity (SC-8)

sc_8_2Maintain the [Selection (one or more): confidentiality; integrity] of information during preparation for transmission and during reception.4

Attributes

Item Id: sc_8_2
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Transmission Confidentiality And Integrity (SC-8)

sc_8_3Implement cryptographic mechanisms to protect message externals unless otherwise protected by [Assignment: organization-defined alternative physical controls].16

Attributes

Item Id: sc_8_3
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Transmission Confidentiality And Integrity (SC-8)

sc_8_4Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls].16

Attributes

Item Id: sc_8_4
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Transmission Confidentiality And Integrity (SC-8)

sc_8_5Implement [Assignment: organization-defined protected distribution system] to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.4

Attributes

Item Id: sc_8_5
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Transmission Confidentiality And Integrity (SC-8)

sc_12Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].4

Attributes

Item Id: sc_12
Section: System and Communications Protection (SC)
Service: kms

sc_12_2Produce, control, and distribute symmetric cryptographic keys using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes.1

Attributes

Item Id: sc_12_2
Section: System and Communications Protection (SC)
Service: kms
Sub Section: Cryptographic Key Establishment And Management (SC-12)

sc_12_6Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.1

Attributes

Item Id: sc_12_6
Section: System and Communications Protection (SC)
Service: kms
Sub Section: Cryptographic Key Establishment And Management (SC-12)

sc_13_aDetermine the [Assignment: organization-defined cryptographic uses].16

Attributes

Item Id: sc_13_a
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Cryptographic Protection (SC-13)

sc_16_1Verify the integrity of transmitted security and privacy attributes.4

Attributes

Item Id: sc_16_1
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Transmission Of Security And Privacy Attributes (SC-16)

sc_22Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation.3

Attributes

Item Id: sc_22
Section: System and Communications Protection (SC)
Service: aws

sc_23Protect the authenticity of communications sessions.4

Attributes

Item Id: sc_23
Section: System and Communications Protection (SC)
Service: aws

sc_23_3Generate a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognize only session identifiers that are system-generated.14

Attributes

Item Id: sc_23_3
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Session Authenticity (SC-23)

sc_23_5Only allow the use of [Assignment: organization-defined certificate authorities] for verification of the establishment of protected sessions.5

Attributes

Item Id: sc_23_5
Section: System and Communications Protection (SC)
Service: elb
Sub Section: Session Authenticity (SC-23)

sc_25Employ minimal functionality and information storage on the following system components: [Assignment: organization-defined system components].16

Attributes

Item Id: sc_25
Section: System and Communications Protection (SC)
Service: aws

sc_28_1Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: organization-defined system components or media]: [Assignment: organization-defined information].15

Attributes

Item Id: sc_28_1
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Protection Of Information At Rest (SC-28)

sc_28_2Remove the following information from online storage and store offline in a secure location: [Assignment: organization-defined information].1

Attributes

Item Id: sc_28_2
Section: System and Communications Protection (SC)
Service: cloudwatch
Sub Section: Protection Of Information At Rest (SC-28)

sc_36Distribute the following processing and storage components across multiple [Selection: physical locations; logical domains]: [Assignment: organization-defined processing and storage components].1

Attributes

Item Id: sc_36
Section: System and Communications Protection (SC)
Service: aws

sc_36_1_aEmploy polling techniques to identify potential faults, errors, or compromises to the following processing and storage components: [Assignment: organization-defined distributed processing and storage components].5

Attributes

Item Id: sc_36_1_a
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Distributed Processing And Storage (SC-36)

sc_43_bAuthorize, monitor, and control the use of such components within the system.1

Attributes

Item Id: sc_43_b
Section: System and Communications Protection (SC)
Service: guarduty
Sub Section: Usage Restrictions (SC-43)

System and Information integrity (SI)40136

si_1_a_2a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;.6

Attributes

Item Id: si_1_a_2
Section: System and Information integrity (SI)
Service: aws
Sub Section: Policy And Procedures (SI-1)

si_1_1_cAudit the use of the manual override capability.7

Attributes

Item Id: si_1_1_c
Section: System and Information integrity (SI)
Service: aws
Sub Section: Policy And Procedures (SI-1)

si_2_5Install [Assignment: organization-defined security-relevant software and firmware updates] automatically to [Assignment: organization-defined system components].2

Attributes

Item Id: si_2_5
Section: System and Information integrity (SI)
Service: aws
Sub Section: Flaw Remediation (SI-2)

si_2_2Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency].2

Attributes

Item Id: si_2_2
Section: System and Information integrity (SI)
Service: aws
Sub Section: Flaw Remediation (SI-2)

si_2_aIdentify, report, and correct system flaws.5

Attributes

Item Id: si_2_a
Section: System and Information integrity (SI)
Service: aws
Sub Section: Flaw Remediation (SI-2)

si_2_cInstall security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates.2

Attributes

Item Id: si_2_c
Section: System and Information integrity (SI)
Service: aws
Sub Section: Flaw Remediation (SI-2)

si_2_dIncorporate flaw remediation into the organizational configuration management process.2

Attributes

Item Id: si_2_d
Section: System and Information integrity (SI)
Service: aws
Sub Section: Flaw Remediation (SI-2)

si_3_c_2c. Configure malicious code protection mechanisms to: 2. [Selection (one or more): block malicious code; quarantine malicious code; take [Assignment: organization-defined action]]; and send alert to [Assignment: organization-defined personnel or roles] in response to malicious code detection.2

Attributes

Item Id: si_3_c_2
Section: System and Information integrity (SI)
Service: aws
Sub Section: Malicious Code Protection (SI-3)

si_3_8_aDetect the following unauthorized operating system commands through the kernel application programming interface on [Assignment: organization-defined system hardware components]: [Assignment: organization-defined unauthorized operating system commands].1

Attributes

Item Id: si_3_8_a
Section: System and Information integrity (SI)
Service: aws
Sub Group: SI-3(8) Detect Unauthorized Commands
Sub Section: Malicious Code Protection (SI-3)

si_3_8_b[Selection (one or more): issue a warning; audit the command execution; prevent the execution of the command].7

Attributes

Item Id: si_3_8_b
Section: System and Information integrity (SI)
Service: aws
Sub Group: SI-3(8) Detect Unauthorized Commands
Sub Section: Malicious Code Protection (SI-3)

si_4_aMonitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and 2. Unauthorized local, network, and remote connections.1

Attributes

Item Id: si_4_a
Section: System and Information integrity (SI)
Service: guarduty
Sub Section: System Monitoring (SI-4)

si_4_a_1a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and 2. Unauthorized local, network, and remote connections.1

Attributes

Item Id: si_4_a_1
Section: System and Information integrity (SI)
Service: guarduty
Sub Group: SI-4(a)
Sub Section: System Monitoring (SI-4)

si_4_a_2a. Monitor the system to detect: 2. Unauthorized local, network, and remote connections.1

Attributes

Item Id: si_4_a_2
Section: System and Information integrity (SI)
Service: guarduty
Sub Group: SI-4(a)
Sub Section: System Monitoring (SI-4)

si_4_bIdentify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods].1

Attributes

Item Id: si_4_b
Section: System and Information integrity (SI)
Service: guarduty
Sub Section: System Monitoring (SI-4)

si_4_cc. Invoke internal monitoring capabilities or deploy monitoring devices: 1. Strategically within the system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization.1

Attributes

Item Id: si_4_c
Section: System and Information integrity (SI)
Service: guarduty
Sub Section: System Monitoring (SI-4)

si_4_dAnalyze detected events and anomalies.1

Attributes

Item Id: si_4_d
Section: System and Information integrity (SI)
Service: cloudtrail
Sub Section: System Monitoring (SI-4)

si_4_1Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.1

Attributes

Item Id: si_4_1
Section: System and Information integrity (SI)
Service: guarduty
Sub Section: System Monitoring (SI-4)

si_4_2Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring]. Employ automated tools and mechanisms to support near real-time analysis of events.10

Attributes

Item Id: si_4_2
Section: System and Information integrity (SI)
Service: aws
Sub Section: System Monitoring (SI-4)

si_4_3Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.1

Attributes

Item Id: si_4_3
Section: System and Information integrity (SI)
Service: guarduty
Sub Section: System Monitoring (SI-4)

si_4_4_aDetermine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic.1

Attributes

Item Id: si_4_4_a
Section: System and Information integrity (SI)
Service: guarduty
Sub Group: SI-4(4) Inbound and Outbound Communications Traffic
Sub Section: System Monitoring (SI-4)

si_4_4_bMonitor inbound and outbound communications traffic [Assignment: organization-defined frequency] for [Assignment: organization-defined unusual or unauthorized activities or conditions].1

Attributes

Item Id: si_4_4_b
Section: System and Information integrity (SI)
Service: guarduty
Sub Group: SI-4(4) Inbound and Outbound Communications Traffic
Sub Section: System Monitoring (SI-4)

si_4_10Make provisions so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined system monitoring tools and mechanisms].1

Attributes

Item Id: si_4_10
Section: System and Information integrity (SI)
Service: guarduty
Sub Section: System Monitoring (SI-4)

si_4_12Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: organization-defined activities that trigger alerts].4

Attributes

Item Id: si_4_12
Section: System and Information integrity (SI)
Service: cloudwatch
Sub Section: System Monitoring (SI-4)

si_4_13_aAnalyze communications traffic and event patterns for the system.1

Attributes

Item Id: si_4_13_a
Section: System and Information integrity (SI)
Service: guarduty
Sub Group: SI-4(13) Analyze Traffic And Event Patterns
Sub Section: System Monitoring (SI-4)

si_4_14Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.1

Attributes

Item Id: si_4_14
Section: System and Information integrity (SI)
Service: guarduty
Sub Section: System Monitoring (SI-4)

si_4_17Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.12

Attributes

Item Id: si_4_17
Section: System and Information integrity (SI)
Service: aws
Sub Section: System Monitoring (SI-4)

si_4_20Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring].7

Attributes

Item Id: si_4_20
Section: System and Information integrity (SI)
Service: aws
Sub Section: System Monitoring (SI-4)

si_4_23Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms].1

Attributes

Item Id: si_4_23
Section: System and Information integrity (SI)
Service: guarduty
Sub Section: System Monitoring (SI-4)

si_4_25Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.1

Attributes

Item Id: si_4_25
Section: System and Information integrity (SI)
Service: aws
Sub Section: System Monitoring (SI-4)

si_5_1Broadcast security alert and advisory information throughout the organization using [Assignment: organization-defined automated mechanisms].5

Attributes

Item Id: si_5_1
Section: System and Information integrity (SI)
Service: aws
Sub Section: Secuity Alerts, Advisories, And Directives (SI-5)

si_5_bGenerate internal security alerts, advisories, and directives as deemed necessary.5

Attributes

Item Id: si_5_b
Section: System and Information integrity (SI)
Service: aws
Sub Section: Secuity Alerts, Advisories, And Directives (SI-5)

si_7_1Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]].1

Attributes

Item Id: si_7_1
Section: System and Information integrity (SI)
Service: cloudtrail
Sub Section: Software, Firmware, and Information Integrity (SI-7)

si_7_3Employ centrally managed integrity verification tools.1

Attributes

Item Id: si_7_3
Section: System and Information integrity (SI)
Service: cloudtrail
Sub Section: Software, Firmware, and Information Integrity (SI-7)

si_7_7Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined security-relevant changes to the system].1

Attributes

Item Id: si_7_7
Section: System and Information integrity (SI)
Service: cloudtrail
Sub Section: Software, Firmware, and Information Integrity (SI-7)

si_7_8Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user; alert [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined other actions]].11

Attributes

Item Id: si_7_8
Section: System and Information integrity (SI)
Service: aws
Sub Section: Software, Firmware, and Information Integrity (SI-7)

si_7_aEmploy integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information].2

Attributes

Item Id: si_7_a
Section: System and Information integrity (SI)
Service: cloudtrail
Sub Section: Software, Firmware, and Information Integrity (SI-7)

si_10_1_cAudit the use of the manual override capability.7

Attributes

Item Id: si_10_1_c
Section: System and Information integrity (SI)
Service: aws
Sub Group: SI-10(1) Manual Override Capability
Sub Section: Information Input Validation (SI-10)

si_12Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.1

Attributes

Item Id: si_12
Section: System and Information integrity (SI)
Service: cloudwatch

si_13_5Provide [Selection: real-time; near real-time] [Assignment: organization-defined failover capability] for the system.7

Attributes

Item Id: si_13_5
Section: System and Information integrity (SI)
Service: aws
Sub Section: Predictable Failure Prevention (SI-13)

si_19_4Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.11

Attributes

Item Id: si_19_4
Section: System and Information integrity (SI)
Service: aws
Sub Section: De-Identification (SI-19)