From e350181941fd97464b4a5ab622d268c44b14f108 Mon Sep 17 00:00:00 2001 From: Joyce Quach Date: Wed, 30 Oct 2024 13:55:59 -0400 Subject: [PATCH] Address review comments Signed-off-by: Joyce Quach --- .github/workflows/convert-cci-list.yml | 56 +- .../cards/controltable/ControlRowHeader.vue | 5 +- .../data/converters/cciListXml2json.ts | 9 +- .../src/mappings/CciNistMapping.ts | 4 +- .../src/mappings/CciNistMappingData.ts | 15116 +--------------- .../src/mappings/U_CCI_List.defs.json | 1 + .../src/mappings/U_CCI_List.nist.json | 1 + 7 files changed, 40 insertions(+), 15152 deletions(-) create mode 100644 libs/hdf-converters/src/mappings/U_CCI_List.defs.json create mode 100644 libs/hdf-converters/src/mappings/U_CCI_List.nist.json diff --git a/.github/workflows/convert-cci-list.yml b/.github/workflows/convert-cci-list.yml index 2e6e39cf9a..32190e86a2 100644 --- a/.github/workflows/convert-cci-list.yml +++ b/.github/workflows/convert-cci-list.yml @@ -2,12 +2,17 @@ name: Convert CCI List XML to JSON on: push: - branches: ['master'] + # branches: ['master'] + branches: ['add-convert-cci-list-workflow'] # Run this workflow at 00:00 every month schedule: - cron: '0 0 1 * *' +env: + # This URL is super brittle with how links constantly get changed. + CCI_LIST_ZIP_URL: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CCI_List.zip + jobs: convert-cci-list: runs-on: ubuntu-22.04 @@ -26,49 +31,32 @@ jobs: run: yarn install --frozen-lockfile - name: Prepare environment - run: apt update && apt install -y unzip + run: apt update - name: Download CCI List - run: curl -o U_CCI_List.zip https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CCI_List.zip && unzip U_CCI_List.zip + run: curl -o U_CCI_List.zip $CCI_LIST_ZIP_URL && unzip U_CCI_List.zip + + - name: Get publish date of CCI List + id: publish-date + uses: mavrosxristoforos/get-xml-info@2.0 + with: + xml-file: '/U_CCI_List/U_CCI_List.xml' + xpath: '/cci_list/metadata/publishdate' - name: Convert CCI List XML to two JSON files run: yarn workspace @mitre/hdf-converters cciListXml2json /U_CCI_List/U_CCI_List.xml U_CCI_List.nist.json U_CCI_List.defs.json - - name: Update CciNistMappingData.ts + - name: Update CCI to NIST and CCI to Definition mappings run: | - touch tmp.ts - echo "export const CCI_TO_NIST: Record = " >> tmp.ts - cat U_CCI_List.nist.json >> tmp.ts - echo ";" >> tmp.ts - echo "export const CCI_TO_DEFINITION: Record = " >> tmp.ts - cat U_CCI_List.defs.json >> tmp.ts - echo ";" >> tmp.ts - cat tmp.ts > libs/hdf-converters/src/mappings/CciNistMappingData.ts - rm tmp.ts + mv U_CCI_List.nist.json libs/hdf-converters/src/mappings/ + mv U_CCI_List.defs.json libs/hdf-converters/src/mappings/ - name: Commit changes to CciNistMappingData.ts + env: + DATETIME: ${{steps.publish-date.outputs}} run: | git config --local user.email "saf@groups.mitre.org" git config --local user.name "MITRE SAF Automation" git add libs/hdf-converters/src/mappings/CciNistMappingData.ts - git commit -sm "Update CCI List to NIST and definition mappings" - - - name: Push changes to repository - uses: ad-m/github-push-action@master - with: - github_token: ${{secrets.GITHUB_TOKEN}} - branch: ${{github.ref}} - prettier: - runs-on: ubuntu-latest - - steps: - - name: Checkout the code - uses: actions/checkout@v4 - with: - ref: ${{github.head_ref}} - fetch-depth: 0 - - - name: Prettify code - uses: creyD/prettier_action@v4.3 - with: - only_changed: True + git commit -sm "Update CCI List to the current NIST and definition mappings as of $DATETIME" + git push diff --git a/apps/frontend/src/components/cards/controltable/ControlRowHeader.vue b/apps/frontend/src/components/cards/controltable/ControlRowHeader.vue index 1e48dbd874..3437ce50d1 100644 --- a/apps/frontend/src/components/cards/controltable/ControlRowHeader.vue +++ b/apps/frontend/src/components/cards/controltable/ControlRowHeader.vue @@ -227,7 +227,10 @@ export default class ControlRowHeader extends mixins(HtmlSanitizeMixin) { if (found) { return found; } - } else if (CCI_TO_NIST[tag.toUpperCase()]) { + } else if ( + CCI_TO_NIST[tag.toUpperCase()] && + CCI_TO_DEFINITION[tag.toUpperCase()] + ) { return CCI_TO_DEFINITION[tag.toUpperCase()]; } return 'Unrecognized Tag'; diff --git a/libs/hdf-converters/data/converters/cciListXml2json.ts b/libs/hdf-converters/data/converters/cciListXml2json.ts index 01a9febc7c..7a9a1bd8fc 100644 --- a/libs/hdf-converters/data/converters/cciListXml2json.ts +++ b/libs/hdf-converters/data/converters/cciListXml2json.ts @@ -41,7 +41,7 @@ if (!pathToInfile || !pathToCci2NistOutfile || !pathToCci2DefinitionsOutfile) { const nists: Record = {}; const definitions: Record = {}; // For all CCI items - converted.cci_list.cci_items[0].cci_item.forEach((cciItem) => { + for (const cciItem of converted.cci_list.cci_items[0].cci_item) { // Get the latest reference const newestReference = _.maxBy( cciItem.references?.[0].reference, @@ -53,8 +53,11 @@ if (!pathToInfile || !pathToCci2NistOutfile || !pathToCci2DefinitionsOutfile) { } else { console.error(`No NIST Controls found for ${cciItem.$.id}`); } - }); - fs.writeFileSync(pathToCci2NistOutfile, JSON.stringify(nists)); + } + fs.writeFileSync( + pathToCci2NistOutfile, + JSON.stringify(nists, null, 2) + ); fs.writeFileSync( pathToCci2DefinitionsOutfile, JSON.stringify(definitions) diff --git a/libs/hdf-converters/src/mappings/CciNistMapping.ts b/libs/hdf-converters/src/mappings/CciNistMapping.ts index 9b5bad1a1d..cb91566d73 100644 --- a/libs/hdf-converters/src/mappings/CciNistMapping.ts +++ b/libs/hdf-converters/src/mappings/CciNistMapping.ts @@ -157,9 +157,9 @@ export class CciNistMapping { this.data = []; if (typeof CCI_TO_NIST === 'object') { - Object.entries(CCI_TO_NIST).forEach((item) => { + for (const item of Object.entries(CCI_TO_NIST)) { this.data.push(new CciNistMappingItem(item[0], item[1])); - }); + } } } diff --git a/libs/hdf-converters/src/mappings/CciNistMappingData.ts b/libs/hdf-converters/src/mappings/CciNistMappingData.ts index 876fbcd9e0..1dc452b87f 100644 --- a/libs/hdf-converters/src/mappings/CciNistMappingData.ts +++ b/libs/hdf-converters/src/mappings/CciNistMappingData.ts @@ -1,15113 +1,5 @@ -export const CCI_TO_NIST: Record = { - 'CCI-000001': 'AC-1 a 1', - 'CCI-000002': 'AC-1 a 1 (a)', - 'CCI-000003': 'AC-1 c 1', - 'CCI-000004': 'AC-1 a 2', - 'CCI-000005': 'AC-1 a 2', - 'CCI-000006': 'AC-1 c 2', - 'CCI-000007': 'AC-2 a', - 'CCI-000008': 'AC-2 c', - 'CCI-000009': 'AC-2 c', - 'CCI-000010': 'AC-2 e', - 'CCI-000011': 'AC-2 f', - 'CCI-000012': 'AC-2 j', - 'CCI-000013': 'AC-2 g', - 'CCI-000014': 'AC-2 i', - 'CCI-000015': 'AC-2 (1)', - 'CCI-000016': 'AC-2 (2)', - 'CCI-000017': 'AC-2 (3) (d)', - 'CCI-000018': 'AC-2 (4)', - 'CCI-000019': 'AC-2 (5)', - 'CCI-000020': 'AC-2 (6)', - 'CCI-000021': 'AC-3 (2)', - 'CCI-000022': 'AC-3 (3) (a)', - 'CCI-000023': 'PM-1 a', - 'CCI-000024': 'AC-3 (5)', - 'CCI-000025': 'AC-4 (1)', - 'CCI-000026': 'AC-4 (2)', - 'CCI-000027': 'AC-4 (3)', - 'CCI-000028': 'AC-4 (4)', - 'CCI-000029': 'AC-4 (5)', - 'CCI-000030': 'AC-4 (6)', - 'CCI-000031': 'AC-4 (7)', - 'CCI-000032': 'AC-4 (8) (a)', - 'CCI-000033': 'AC-4 (9)', - 'CCI-000034': 'AC-4 (10)', - 'CCI-000035': 'AC-4 (11)', - 'CCI-000036': 'AC-5 a', - 'CCI-000037': 'AC-5 c', - 'CCI-000038': 'AC-6 (1)', - 'CCI-000039': 'AC-6 (2)', - 'CCI-000040': 'AC-6 (2)', - 'CCI-000041': 'AC-6 (3)', - 'CCI-000042': 'AC-6 (3)', - 'CCI-000043': 'AC-7 a', - 'CCI-000044': 'AC-7 a', - 'CCI-000045': 'AC-7 b', - 'CCI-000046': 'AC-7 b', - 'CCI-000047': 'AC-7 b', - 'CCI-000048': 'AC-8 a', - 'CCI-000049': 'AC-8 a', - 'CCI-000050': 'AC-8 b', - 'CCI-000051': 'AC-8 a', - 'CCI-000052': 'AC-9', - 'CCI-000053': 'AC-9 (1)', - 'CCI-000054': 'AC-10', - 'CCI-000055': 'AC-10', - 'CCI-000056': 'AC-11 b', - 'CCI-000057': 'AC-11 a', - 'CCI-000058': 'AC-11 a', - 'CCI-000059': 'AC-11 a', - 'CCI-000060': 'AC-11 (1)', - 'CCI-000061': 'AC-14 a', - 'CCI-000062': 'AC-14 (1)', - 'CCI-000063': 'AC-17 a', - 'CCI-000064': 'AC-17 b', - 'CCI-000065': 'AC-17 b', - 'CCI-000066': 'AC-17 e', - 'CCI-000067': 'AC-17 (1)', - 'CCI-000068': 'AC-17 (2)', - 'CCI-000069': 'AC-17 (3)', - 'CCI-000070': 'AC-17 (4) (a)', - 'CCI-000071': 'AC-17 (5)', - 'CCI-000072': 'AC-17 (6)', - 'CCI-000073': 'PM-1 a 1', - 'CCI-000074': 'PM-1 a 4', - 'CCI-000075': 'PM-1 b', - 'CCI-000076': 'PM-1 b', - 'CCI-000077': 'PM-1 c', - 'CCI-000078': 'PM-2', - 'CCI-000079': 'AC-17 (7)', - 'CCI-000080': 'PM-3 a', - 'CCI-000081': 'PM-3 b', - 'CCI-000082': 'AC-19 a', - 'CCI-000083': 'AC-19 a', - 'CCI-000084': 'AC-19 b', - 'CCI-000085': 'AC-19 c', - 'CCI-000086': 'AC-19 d', - 'CCI-000087': 'AC-19 e', - 'CCI-000088': 'AC-19 f', - 'CCI-000089': 'AC-19 g', - 'CCI-000090': 'AC-19 (1)', - 'CCI-000091': 'AC-19 (2)', - 'CCI-000092': 'AC-19 (3)', - 'CCI-000093': 'AC-20 a 1', - 'CCI-000094': 'AC-20 b', - 'CCI-000095': 'AC-20 (1) (a)', - 'CCI-000096': 'AC-20 (1) (b)', - 'CCI-000097': 'AC-20 (2)', - 'CCI-000098': 'AC-21 a', - 'CCI-000099': 'AC-21 (1)', - 'CCI-000100': 'AT-1 a 1 (a)', - 'CCI-000101': 'AT-1 a 1 (a)', - 'CCI-000102': 'AT-1 c 1', - 'CCI-000103': 'AT-1 a 2', - 'CCI-000104': 'AT-1 a 2', - 'CCI-000105': 'AT-1 c 2', - 'CCI-000106': 'AT-2 a 1', - 'CCI-000107': 'AT-2 (1)', - 'CCI-000108': 'AT-3 a 1', - 'CCI-000109': 'AT-3 a 2', - 'CCI-000110': 'AT-3 c', - 'CCI-000111': 'AT-3 c', - 'CCI-000112': 'AT-2 a 2', - 'CCI-000113': 'AT-4 a', - 'CCI-000114': 'AT-4 a', - 'CCI-000115': 'AT-5', - 'CCI-000116': 'AT-5', - 'CCI-000117': 'AU-1 a 1 (a)', - 'CCI-000118': 'AU-1 a', - 'CCI-000119': 'AU-1 c 1', - 'CCI-000120': 'AU-1 a 2', - 'CCI-000121': 'AU-1 b', - 'CCI-000122': 'AU-1 c 2', - 'CCI-000123': 'AU-2 a', - 'CCI-000124': 'AU-2 b', - 'CCI-000125': 'AU-2 d', - 'CCI-000126': 'AU-2 c', - 'CCI-000127': 'AU-2 (3)', - 'CCI-000128': 'AU-2 (4)', - 'CCI-000129': 'AU-2 a', - 'CCI-000130': 'AU-3 a', - 'CCI-000131': 'AU-3 b', - 'CCI-000132': 'AU-3 c', - 'CCI-000133': 'AU-3 d', - 'CCI-000134': 'AU-3 e', - 'CCI-000135': 'AU-3 (1)', - 'CCI-000136': 'AU-3 (2)', - 'CCI-000137': 'AU-4', - 'CCI-000138': 'AU-4', - 'CCI-000139': 'AU-5 a', - 'CCI-000140': 'AU-5 b', - 'CCI-000141': 'PM-3 c', - 'CCI-000142': 'PM-4 a 1', - 'CCI-000143': 'AU-5 (1)', - 'CCI-000144': 'AU-5 (2)', - 'CCI-000145': 'AU-5 (3)', - 'CCI-000146': 'AU-5 (1)', - 'CCI-000147': 'AU-5 (2)', - 'CCI-000148': 'AU-6 a', - 'CCI-000149': 'AU-6 b', - 'CCI-000150': 'AU-6 b', - 'CCI-000151': 'AU-6 a', - 'CCI-000152': 'AU-6 (1)', - 'CCI-000153': 'AU-6 (3)', - 'CCI-000154': 'AU-6 (4)', - 'CCI-000155': 'AU-6 (5)', - 'CCI-000156': 'AU-7', - 'CCI-000157': 'AU-7', - 'CCI-000158': 'AU-7 (1)', - 'CCI-000159': 'AU-8 a', - 'CCI-000160': 'AU-8 (1)', - 'CCI-000161': 'AU-8 (1) (a)', - 'CCI-000162': 'AU-9 a', - 'CCI-000163': 'AU-9 a', - 'CCI-000164': 'AU-9 a', - 'CCI-000165': 'AU-9 (1)', - 'CCI-000166': 'AU-10', - 'CCI-000167': 'AU-11', - 'CCI-000168': 'AU-11', - 'CCI-000169': 'AU-12 a', - 'CCI-000170': 'PM-4 a 2', - 'CCI-000171': 'AU-12 b', - 'CCI-000172': 'AU-12 c', - 'CCI-000173': 'AU-12 (1)', - 'CCI-000174': 'AU-12 (1)', - 'CCI-000175': 'IA-5 a', - 'CCI-000176': 'IA-5 b', - 'CCI-000177': 'IA-5 d', - 'CCI-000178': 'IA-5 e', - 'CCI-000179': 'IA-5 f', - 'CCI-000180': 'IA-5 f', - 'CCI-000181': 'IA-5 f', - 'CCI-000182': 'IA-5 f', - 'CCI-000183': 'IA-5 g', - 'CCI-000184': 'IA-5 h', - 'CCI-000185': 'IA-5 (2) (b) (1)', - 'CCI-000186': 'IA-5 (2) (a) (1)', - 'CCI-000187': 'IA-5 (2) (a) (2)', - 'CCI-000188': 'IA-5 (3)', - 'CCI-000189': 'IA-5 (4)', - 'CCI-000190': 'IA-5 (5)', - 'CCI-000191': 'IA-5 (1) (a)', - 'CCI-000192': 'IA-5 (1) (a)', - 'CCI-000193': 'IA-5 (1) (a)', - 'CCI-000194': 'IA-5 (1) (a)', - 'CCI-000195': 'IA-5 (1) (b)', - 'CCI-000196': 'IA-5 (1) (c)', - 'CCI-000197': 'IA-5 (1) (c)', - 'CCI-000198': 'IA-5 (1) (d)', - 'CCI-000199': 'IA-5 (1) (d)', - 'CCI-000200': 'IA-5 (1) (e)', - 'CCI-000201': 'IA-5 (6)', - 'CCI-000202': 'IA-5 (7)', - 'CCI-000203': 'IA-5 (7)', - 'CCI-000204': 'IA-5 (8)', - 'CCI-000205': 'IA-5 (1) (a)', - 'CCI-000206': 'IA-6', - 'CCI-000207': 'PM-5', - 'CCI-000208': 'AC-2 (5) (b)', - 'CCI-000209': 'PM-6', - 'CCI-000210': 'PM-6', - 'CCI-000211': 'PM-6', - 'CCI-000212': 'PM-7', - 'CCI-000213': 'AC-3', - 'CCI-000214': 'AC-3 (4) (b)', - 'CCI-000215': 'AC-3 (4) (c)', - 'CCI-000216': 'PM-8', - 'CCI-000217': 'AC-2 (3)', - 'CCI-000218': 'AC-4 (12)', - 'CCI-000219': 'AC-4 (13)', - 'CCI-000221': 'AC-4 (16)', - 'CCI-000223': 'AC-4 (17) (b)', - 'CCI-000224': 'AC-4 (17) (c)', - 'CCI-000225': 'AC-6', - 'CCI-000226': 'AC-6 (4)', - 'CCI-000227': 'PM-9 a 1', - 'CCI-000228': 'PM-9 b', - 'CCI-000229': 'PM-10 a', - 'CCI-000230': 'PM-10 a', - 'CCI-000231': 'PM-10 a', - 'CCI-000232': 'AC-14 b', - 'CCI-000233': 'PM-10 b', - 'CCI-000234': 'PM-10 c', - 'CCI-000235': 'PM-11 a', - 'CCI-000236': 'PM-11 b', - 'CCI-000237': 'AC-2 f', - 'CCI-000238': 'CA-1 c 1', - 'CCI-000239': 'CA-1 a 1 (a)', - 'CCI-000240': 'CA-1 a 1 (a)', - 'CCI-000241': 'CA-1 c 1', - 'CCI-000242': 'CA-1 a 2', - 'CCI-000243': 'CA-1 a 2', - 'CCI-000244': 'CA-1 c 2', - 'CCI-000245': 'CA-2 a', - 'CCI-000246': 'CA-2 b 1', - 'CCI-000247': 'CA-2 b 2', - 'CCI-000248': 'CA-2 b 3', - 'CCI-000249': 'CA-2 a', - 'CCI-000250': 'CA-2 a', - 'CCI-000251': 'CA-2 d', - 'CCI-000252': 'CA-2 d', - 'CCI-000253': 'CA-2 e', - 'CCI-000254': 'CA-2 f', - 'CCI-000255': 'CA-2 (1)', - 'CCI-000256': 'CA-2 (2)', - 'CCI-000257': 'CA-3 a', - 'CCI-000258': 'CA-3 b', - 'CCI-000259': 'CA-3 b', - 'CCI-000260': 'CA-3 b', - 'CCI-000261': 'CA-3 c', - 'CCI-000262': 'CA-3 (1)', - 'CCI-000263': 'CA-3 (2)', - 'CCI-000264': 'CA-5 a', - 'CCI-000265': 'CA-5 b', - 'CCI-000266': 'CA-5 b', - 'CCI-000267': 'CA-5 (1)', - 'CCI-000268': 'CA-5 (1)', - 'CCI-000269': 'CA-5 (1)', - 'CCI-000270': 'CA-6 a', - 'CCI-000271': 'CA-6 c 2', - 'CCI-000272': 'CA-6 e', - 'CCI-000273': 'CA-6 e', - 'CCI-000274': 'CA-7', - 'CCI-000275': 'CA-7 a', - 'CCI-000276': 'CA-7 a', - 'CCI-000277': 'CA-7 b', - 'CCI-000278': 'CA-7 b', - 'CCI-000279': 'CA-7 c', - 'CCI-000280': 'CA-7 g', - 'CCI-000281': 'CA-7 g', - 'CCI-000282': 'CA-7 (1)', - 'CCI-000283': 'CA-7 (2)', - 'CCI-000284': 'CA-7 (2)', - 'CCI-000285': 'CA-7 (2)', - 'CCI-000286': 'CM-1 c 1', - 'CCI-000287': 'CM-1 a 1 (a)', - 'CCI-000288': 'CM-1 a', - 'CCI-000289': 'CM-1 c 1', - 'CCI-000290': 'CM-1 a 2', - 'CCI-000291': 'CM-1 b', - 'CCI-000292': 'CM-1 a 2', - 'CCI-000293': 'CM-2', - 'CCI-000294': 'CM-2', - 'CCI-000295': 'CM-2 a', - 'CCI-000296': 'CM-2 b 1', - 'CCI-000297': 'CM-2 b 2', - 'CCI-000298': 'CM-2 (1) (c)', - 'CCI-000299': 'CM-2 (1) (c)', - 'CCI-000300': 'CM-2 (2)', - 'CCI-000301': 'CM-2 (2)', - 'CCI-000302': 'CM-2 (2)', - 'CCI-000303': 'CM-2 (2)', - 'CCI-000304': 'CM-2 (3)', - 'CCI-000305': 'CM-2 (4) (a)', - 'CCI-000306': 'CM-2 (4) (a)', - 'CCI-000307': 'CM-2 (4) (b)', - 'CCI-000308': 'CM-2 (5) (a)', - 'CCI-000309': 'CM-2 (5) (a)', - 'CCI-000310': 'CM-2 (5) (b)', - 'CCI-000311': 'CM-2 (6)', - 'CCI-000312': 'CM-2 (6)', - 'CCI-000313': 'CM-3 a', - 'CCI-000314': 'CM-3 b', - 'CCI-000315': 'CM-3 c', - 'CCI-000316': 'CM-3 e', - 'CCI-000317': 'CM-3 d', - 'CCI-000318': 'CM-3 f', - 'CCI-000319': 'CM-3 g', - 'CCI-000320': 'CM-3 g', - 'CCI-000321': 'CM-3 g', - 'CCI-000322': 'CM-3 (1) (a)', - 'CCI-000323': 'CM-3 (1) (b)', - 'CCI-000324': 'CM-3 (1) (c)', - 'CCI-000325': 'CM-3 (1) (d)', - 'CCI-000326': 'CM-3 (1) (e)', - 'CCI-000327': 'CM-3 (2)', - 'CCI-000328': 'CM-3 (2)', - 'CCI-000329': 'CM-3 (2)', - 'CCI-000330': 'CM-3 (3)', - 'CCI-000331': 'CM-3 (3)', - 'CCI-000332': 'CM-3 (4)', - 'CCI-000333': 'CM-4', - 'CCI-000334': 'CM-4 (1)', - 'CCI-000335': 'CM-4 (2)', - 'CCI-000336': 'CM-4 (2)', - 'CCI-000337': 'CM-4 (2)', - 'CCI-000338': 'CM-5', - 'CCI-000339': 'CM-5', - 'CCI-000340': 'CM-5', - 'CCI-000341': 'CM-5', - 'CCI-000342': 'CM-5', - 'CCI-000343': 'CM-5', - 'CCI-000344': 'CM-5', - 'CCI-000345': 'CM-5', - 'CCI-000346': 'CM-5 (1)', - 'CCI-000347': 'CM-5 (1)', - 'CCI-000348': 'CM-5 (2)', - 'CCI-000349': 'CM-5 (2)', - 'CCI-000350': 'CM-5 (2)', - 'CCI-000351': 'CM-5 (3)', - 'CCI-000352': 'CM-5 (3)', - 'CCI-000353': 'CM-5 (4)', - 'CCI-000354': 'CM-5 (4)', - 'CCI-000355': 'CM-5 (5) (a)', - 'CCI-000356': 'CM-5 (5) (a)', - 'CCI-000357': 'CM-5 (5) (a)', - 'CCI-000358': 'CM-5 (5) (a)', - 'CCI-000359': 'CM-5 (5) (b)', - 'CCI-000360': 'CM-5 (5) (b)', - 'CCI-000361': 'CM-5 (5) (b)', - 'CCI-000362': 'CM-5 (5) (b)', - 'CCI-000363': 'CM-6 a', - 'CCI-000364': 'CM-6 a', - 'CCI-000365': 'CM-6 a', - 'CCI-000366': 'CM-6 b', - 'CCI-000367': 'CM-6 c', - 'CCI-000368': 'CM-6 c', - 'CCI-000369': 'CM-6 c', - 'CCI-000370': 'CM-6 (1)', - 'CCI-000371': 'CM-6 (1)', - 'CCI-000372': 'CM-6 (1)', - 'CCI-000373': 'CM-6 (2)', - 'CCI-000374': 'CM-6 (2)', - 'CCI-000375': 'CM-6 (3)', - 'CCI-000376': 'CM-6 (3)', - 'CCI-000377': 'CM-6 (3)', - 'CCI-000378': 'CM-6 (3)', - 'CCI-000379': 'CM-6 (4)', - 'CCI-000380': 'CM-7 b', - 'CCI-000381': 'CM-7 a', - 'CCI-000382': 'CM-7 b', - 'CCI-000383': 'CM-7 (1)', - 'CCI-000384': 'CM-7 (1) (a)', - 'CCI-000385': 'CM-7 (1)', - 'CCI-000386': 'CM-7 (2)', - 'CCI-000387': 'CM-7 (3)', - 'CCI-000388': 'CM-7 (3)', - 'CCI-000389': 'CM-8 a 1', - 'CCI-000390': 'CM-8 a 1', - 'CCI-000391': 'CM-8 a', - 'CCI-000392': 'CM-8 a 2', - 'CCI-000393': 'CM-8 a 2', - 'CCI-000394': 'CM-8 b', - 'CCI-000395': 'CM-8 a 3', - 'CCI-000396': 'CM-8 a 3', - 'CCI-000397': 'CM-8 c', - 'CCI-000398': 'CM-8 a 5', - 'CCI-000399': 'CM-8 a 4', - 'CCI-000400': 'CM-8 a 4', - 'CCI-000401': 'CM-8 d', - 'CCI-000402': 'CM-8 e', - 'CCI-000403': 'CM-8 e', - 'CCI-000404': 'CM-8 e', - 'CCI-000405': 'CM-8 e', - 'CCI-000406': 'CM-8 e', - 'CCI-000407': 'CM-8 e', - 'CCI-000408': 'CM-8 (1)', - 'CCI-000409': 'CM-8 (1)', - 'CCI-000410': 'CM-8 (1)', - 'CCI-000411': 'CM-8 (2)', - 'CCI-000412': 'CM-8 (2)', - 'CCI-000413': 'CM-8 (2)', - 'CCI-000414': 'CM-8 (2)', - 'CCI-000415': 'CM-8 (3) (a)', - 'CCI-000416': 'CM-8 (3) (a)', - 'CCI-000417': 'CM-8 (3) (b)', - 'CCI-000418': 'CM-8 (4)', - 'CCI-000419': 'CM-8 (5)', - 'CCI-000420': 'CM-8 (6)', - 'CCI-000421': 'CM-9 a', - 'CCI-000422': 'CM-9 a', - 'CCI-000423': 'CM-9 a', - 'CCI-000424': 'CM-9 c', - 'CCI-000425': 'CM-9 c', - 'CCI-000426': 'CM-9 c', - 'CCI-000427': 'CM-9 b', - 'CCI-000428': 'CM-9 b', - 'CCI-000429': 'CM-9 b', - 'CCI-000430': 'CM-9 c', - 'CCI-000431': 'CM-9 c', - 'CCI-000432': 'CM-9 c', - 'CCI-000433': 'CM-9 c', - 'CCI-000434': 'CM-9 c', - 'CCI-000435': 'CM-9 c', - 'CCI-000436': 'CM-9 (1)', - 'CCI-000437': 'CP-1 c 1', - 'CCI-000438': 'CP-1 a 1 (a)', - 'CCI-000439': 'CP-1 a 1 (a)', - 'CCI-000440': 'CP-1 c 1', - 'CCI-000441': 'CP-1 a 2', - 'CCI-000443': 'CP-2 a 1', - 'CCI-000444': 'CP-2 a 1', - 'CCI-000445': 'CP-2 a 1', - 'CCI-000446': 'CP-2 a 2', - 'CCI-000447': 'CP-2 a 2', - 'CCI-000448': 'CP-2 a 2', - 'CCI-000449': 'CP-2 a 3', - 'CCI-000450': 'CP-2 a 4', - 'CCI-000451': 'CP-2 a 4', - 'CCI-000452': 'CP-2 a 4', - 'CCI-000453': 'CP-2 a 4', - 'CCI-000454': 'CP-2 a 4', - 'CCI-000455': 'CP-2 a 4', - 'CCI-000456': 'CP-2 a 5', - 'CCI-000457': 'CP-2 a 7', - 'CCI-000458': 'CP-2 b', - 'CCI-000459': 'CP-2 b', - 'CCI-000460': 'CP-2 c', - 'CCI-000461': 'CP-2 d', - 'CCI-000462': 'CP-2 d', - 'CCI-000463': 'CP-2 e', - 'CCI-000464': 'CP-2 e', - 'CCI-000465': 'CP-2 e', - 'CCI-000466': 'CP-2 e', - 'CCI-000468': 'CP-2 f', - 'CCI-000469': 'CP-2 (1)', - 'CCI-000470': 'CP-2 (2)', - 'CCI-000471': 'CP-2 (2)', - 'CCI-000472': 'CP-2 (2)', - 'CCI-000473': 'CP-2 (3)', - 'CCI-000474': 'CP-2 (3)', - 'CCI-000475': 'CP-2 (3)', - 'CCI-000476': 'CP-2 (3)', - 'CCI-000477': 'CP-2 (4)', - 'CCI-000478': 'CP-2 (4)', - 'CCI-000479': 'CP-2 (4)', - 'CCI-000480': 'CP-2 (4)', - 'CCI-000481': 'CP-2 (5)', - 'CCI-000482': 'CP-2 (5)', - 'CCI-000483': 'CP-2 (6)', - 'CCI-000484': 'CP-2 (6)', - 'CCI-000485': 'CP-3 a 3', - 'CCI-000486': 'CP-3 a 1', - 'CCI-000487': 'CP-3 a 3', - 'CCI-000488': 'CP-3 (1)', - 'CCI-000489': 'CP-3 (2)', - 'CCI-000490': 'CP-4 a', - 'CCI-000491': 'CP-4', - 'CCI-000492': 'CP-4 a', - 'CCI-000493': 'CP-4', - 'CCI-000494': 'CP-4 a', - 'CCI-000495': 'CP-4 a', - 'CCI-000496': 'CP-4 b', - 'CCI-000497': 'CP-4 c', - 'CCI-000498': 'CP-4 (1)', - 'CCI-000499': 'CP-4 (1)', - 'CCI-000500': 'CP-4 (2) (a)', - 'CCI-000501': 'CP-4 (2)', - 'CCI-000502': 'CP-4 (3)', - 'CCI-000503': 'CP-4 (3)', - 'CCI-000504': 'CP-4 (4)', - 'CCI-000505': 'CP-6 a', - 'CCI-000506': 'CP-6', - 'CCI-000507': 'CP-6 (1)', - 'CCI-000508': 'CP-6 (2)', - 'CCI-000509': 'CP-6 (3)', - 'CCI-000510': 'CP-7 a', - 'CCI-000511': 'CP-7', - 'CCI-000512': 'CP-7 a', - 'CCI-000513': 'CP-7 a', - 'CCI-000514': 'CP-7 a', - 'CCI-000515': 'CP-7 b', - 'CCI-000516': 'CP-7 (1)', - 'CCI-000517': 'CP-7 (2)', - 'CCI-000518': 'CP-7 (3)', - 'CCI-000519': 'CP-7 (4)', - 'CCI-000520': 'CP-7 (4)', - 'CCI-000521': 'CP-7 c', - 'CCI-000522': 'CP-8', - 'CCI-000523': 'CP-8', - 'CCI-000524': 'CP-8', - 'CCI-000525': 'CP-8', - 'CCI-000526': 'CP-8 (1) (a)', - 'CCI-000527': 'CP-8 (1) (a)', - 'CCI-000528': 'CP-8 (1) (b)', - 'CCI-000529': 'CP-8 (1) (b)', - 'CCI-000530': 'CP-8 (2)', - 'CCI-000531': 'CP-8 (3)', - 'CCI-000532': 'CP-8 (4) (a)', - 'CCI-000533': 'CP-8 (4) (a)', - 'CCI-000534': 'CP-9 (a)', - 'CCI-000535': 'CP-9 (a)', - 'CCI-000536': 'CP-9 (b)', - 'CCI-000537': 'CP-9 (b)', - 'CCI-000538': 'CP-9 (c)', - 'CCI-000539': 'CP-9 (c)', - 'CCI-000540': 'CP-9 (d)', - 'CCI-000541': 'CP-9 (1)', - 'CCI-000542': 'CP-9 (1)', - 'CCI-000543': 'CP-9 (2)', - 'CCI-000544': 'CP-9 (3)', - 'CCI-000545': 'CP-9 (3)', - 'CCI-000546': 'CP-9 (3)', - 'CCI-000547': 'CP-9 (5)', - 'CCI-000548': 'CP-9 (5)', - 'CCI-000549': 'CP-9 (6)', - 'CCI-000550': 'CP-10', - 'CCI-000551': 'CP-10', - 'CCI-000552': 'CP-10', - 'CCI-000553': 'CP-10 (2)', - 'CCI-000554': 'CP-10 (3)', - 'CCI-000555': 'CP-10 (3)', - 'CCI-000556': 'CP-10 (4)', - 'CCI-000557': 'CP-10 (4)', - 'CCI-000558': 'SI-13 (5)', - 'CCI-000559': 'SI-13 (5)', - 'CCI-000560': 'CP-10 (6)', - 'CCI-000561': 'CP-10 (6)', - 'CCI-000562': 'CP-10 (6)', - 'CCI-000563': 'PL-1 a 1 (a)', - 'CCI-000564': 'PL-1 a 1 (a)', - 'CCI-000565': 'PL-1 a', - 'CCI-000566': 'PL-1 a 2', - 'CCI-000567': 'PL-1 a 2', - 'CCI-000568': 'PL-1 c 2', - 'CCI-000570': 'PL-2 a', - 'CCI-000571': 'PL-2 a 15', - 'CCI-000572': 'PL-2 c', - 'CCI-000573': 'PL-2 c', - 'CCI-000574': 'PL-2 d', - 'CCI-000576': 'PL-2 (1) (a)', - 'CCI-000577': 'PL-7 b', - 'CCI-000578': 'PL-7 b', - 'CCI-000580': 'PL-2 (2) (a)', - 'CCI-000581': 'PL-2 (2) (a)', - 'CCI-000582': 'PL-2 (2) (a)', - 'CCI-000583': 'PL-2 (2) (b)', - 'CCI-000584': 'PL-2 (2) (b)', - 'CCI-000585': 'PL-2 (2) (c)', - 'CCI-000586': 'PL-2 (2) (d)', - 'CCI-000587': 'PL-2 (2) (d)', - 'CCI-000588': 'PL-2 (2) (d)', - 'CCI-000589': 'PL-2 (2) (d)', - 'CCI-000590': 'PL-2 (2) (e)', - 'CCI-000591': 'PL-2 (2) (e)', - 'CCI-000592': 'PL-4 a', - 'CCI-000593': 'PL-4 b', - 'CCI-000594': 'PL-4 (1) (a)', - 'CCI-000595': 'PL-4 (1) (b)', - 'CCI-000596': 'PL-4 (1)', - 'CCI-000597': 'PL-5', - 'CCI-000598': 'PL-6', - 'CCI-000599': 'PL-6', - 'CCI-000600': 'PL-6', - 'CCI-000601': 'SA-1 c 1', - 'CCI-000602': 'SA-1 a 1 (a)', - 'CCI-000603': 'SA-1 a 1', - 'CCI-000604': 'SA-1 c 1', - 'CCI-000605': 'SA-1 a 2', - 'CCI-000606': 'SA-1 a 2', - 'CCI-000607': 'SA-1 c 2', - 'CCI-000608': 'SA-2 a', - 'CCI-000609': 'SA-2 a', - 'CCI-000610': 'SA-2 b', - 'CCI-000611': 'SA-2 b', - 'CCI-000612': 'SA-2 b', - 'CCI-000613': 'SA-2 c', - 'CCI-000614': 'SA-2 c', - 'CCI-000615': 'SA-3 a', - 'CCI-000616': 'SA-3 b', - 'CCI-000617': 'SA-3 b', - 'CCI-000618': 'SA-3 c', - 'CCI-000619': 'SA-4 a', - 'CCI-000620': 'SA-4 b', - 'CCI-000621': 'SA-4 c', - 'CCI-000623': 'SA-4 (1)', - 'CCI-000624': 'SA-4 (2)', - 'CCI-000625': 'SA-4 (2)', - 'CCI-000626': 'SA-4 (3)', - 'CCI-000627': 'SA-4 (3)', - 'CCI-000628': 'SA-4 (3)', - 'CCI-000629': 'SA-4 (4)', - 'CCI-000630': 'SA-4 (5)', - 'CCI-000631': 'SA-4 (6) (a)', - 'CCI-000632': 'SA-4 (6) (a)', - 'CCI-000633': 'SA-4 (6) (b)', - 'CCI-000634': 'SA-4 (7) (a)', - 'CCI-000635': 'SA-4 (7) (b)', - 'CCI-000636': 'SA-5 a', - 'CCI-000637': 'SA-5 a', - 'CCI-000638': 'SA-5 a', - 'CCI-000639': 'SA-5 b', - 'CCI-000640': 'SA-5 b', - 'CCI-000641': 'SA-5 b', - 'CCI-000642': 'SA-5 c', - 'CCI-000643': 'SA-5 (1)', - 'CCI-000644': 'SA-5 (1)', - 'CCI-000645': 'SA-5 (2)', - 'CCI-000646': 'SA-5 (2)', - 'CCI-000647': 'SA-5 (3)', - 'CCI-000648': 'SA-5 (3)', - 'CCI-000650': 'SA-5 (4)', - 'CCI-000651': 'SA-5 (4)', - 'CCI-000653': 'SA-5 (5)', - 'CCI-000654': 'SA-5 (5)', - 'CCI-000655': 'SA-6 a', - 'CCI-000656': 'SA-6 b', - 'CCI-000657': 'SA-6 c', - 'CCI-000658': 'SA-6 c', - 'CCI-000659': 'SA-6 (1) (a)', - 'CCI-000660': 'SA-6 (1) (a)', - 'CCI-000661': 'SA-6 (1) (b)', - 'CCI-000662': 'SA-6 (1) (b)', - 'CCI-000663': 'SA-7', - 'CCI-000664': 'SA-8', - 'CCI-000665': 'SA-8', - 'CCI-000666': 'SA-8', - 'CCI-000667': 'SA-8', - 'CCI-000668': 'SA-8', - 'CCI-000669': 'SA-9', - 'CCI-000670': 'SA-9 a', - 'CCI-000671': 'SA-9 b', - 'CCI-000672': 'SA-9 b', - 'CCI-000673': 'SA-9 b', - 'CCI-000674': 'SA-9 b', - 'CCI-000675': 'SA-9 c', - 'CCI-000676': 'SA-9 (1) (a)', - 'CCI-000677': 'SA-9 (1) (a)', - 'CCI-000678': 'SA-9 (1) (b)', - 'CCI-000679': 'SA-9 (1) (b)', - 'CCI-000680': 'SA-9 (1) (b)', - 'CCI-000681': 'SA-9 (1) (b)', - 'CCI-000682': 'SA-10 (a)', - 'CCI-000683': 'SA-10 (a)', - 'CCI-000684': 'SA-10 (a)', - 'CCI-000685': 'SA-10 (a)', - 'CCI-000686': 'SA-10 (a)', - 'CCI-000687': 'SA-10 (a)', - 'CCI-000688': 'SA-10 (a)', - 'CCI-000689': 'SA-10 (a)', - 'CCI-000690': 'SA-10 (b)', - 'CCI-000691': 'SA-10 (b)', - 'CCI-000692': 'SA-10 c', - 'CCI-000693': 'SA-10 (c)', - 'CCI-000694': 'SA-10 d', - 'CCI-000695': 'SA-10 (d)', - 'CCI-000696': 'SA-10 (e)', - 'CCI-000697': 'SA-10 (e)', - 'CCI-000698': 'SA-10 (1)', - 'CCI-000699': 'SA-10 (1)', - 'CCI-000700': 'SA-10 (2)', - 'CCI-000701': 'SA-10 (2)', - 'CCI-000702': 'SA-11 (a)', - 'CCI-000703': 'SA-11 (a)', - 'CCI-000704': 'SA-11 (a)', - 'CCI-000705': 'SA-11 (a)', - 'CCI-000706': 'SA-11 (b)', - 'CCI-000707': 'SA-11 (b)', - 'CCI-000708': 'SA-11 (c)', - 'CCI-000709': 'SA-11 (c)', - 'CCI-000710': 'SA-11 (c)', - 'CCI-000711': 'SA-11 (c)', - 'CCI-000712': 'SA-11 (1)', - 'CCI-000713': 'SA-11 (1)', - 'CCI-000714': 'SA-11 (2)', - 'CCI-000715': 'SA-11 (2)', - 'CCI-000716': 'SA-11 (2)', - 'CCI-000717': 'SA-11 (2)', - 'CCI-000718': 'SA-11 (2)', - 'CCI-000719': 'SA-11 (2)', - 'CCI-000720': 'SA-11 (3)', - 'CCI-000721': 'SA-11 (3)', - 'CCI-000722': 'SA-12', - 'CCI-000723': 'SA-12', - 'CCI-000724': 'SA-12 (1)', - 'CCI-000725': 'SA-12 (2)', - 'CCI-000726': 'SA-12 (2)', - 'CCI-000727': 'SA-12 (2)', - 'CCI-000728': 'SA-12 (2)', - 'CCI-000729': 'SA-12 (3)', - 'CCI-000730': 'SA-12 (3)', - 'CCI-000731': 'SA-12 (3)', - 'CCI-000732': 'SA-12 (3)', - 'CCI-000733': 'SA-12 (3)', - 'CCI-000734': 'SA-12 (3)', - 'CCI-000735': 'SA-12 (4)', - 'CCI-000736': 'SA-12 (4)', - 'CCI-000737': 'SA-12 (4)', - 'CCI-000738': 'SA-12 (4)', - 'CCI-000739': 'SA-12 (5)', - 'CCI-000740': 'SA-12 (5)', - 'CCI-000741': 'SA-12 (5)', - 'CCI-000742': 'SA-12 (6)', - 'CCI-000743': 'SA-12 (6)', - 'CCI-000744': 'SA-12 (6)', - 'CCI-000745': 'SA-12 (7)', - 'CCI-000746': 'SA-12 (7)', - 'CCI-000747': 'SA-12 (7)', - 'CCI-000748': 'SA-13', - 'CCI-000749': 'SA-13', - 'CCI-000750': 'SA-14', - 'CCI-000751': 'SA-14 a', - 'CCI-000752': 'SA-14 b', - 'CCI-000753': 'SA-14 (1) (a)', - 'CCI-000754': 'SA-14 (1) (b)', - 'CCI-000755': 'SA-14 (1) (b)', - 'CCI-000756': 'IA-1 a 1', - 'CCI-000757': 'IA-1 a 1 (a)', - 'CCI-000758': 'IA-1 c 1', - 'CCI-000759': 'IA-1 c 1', - 'CCI-000760': 'IA-1 a 2', - 'CCI-000761': 'IA-1 a 2', - 'CCI-000762': 'IA-1 c 2', - 'CCI-000763': 'IA-1 c 2', - 'CCI-000764': 'IA-2', - 'CCI-000765': 'IA-2 (1)', - 'CCI-000766': 'IA-2 (2)', - 'CCI-000767': 'IA-2 (3)', - 'CCI-000768': 'IA-2 (4)', - 'CCI-000769': 'IA-2 (5) (a)', - 'CCI-000770': 'IA-2 (5)', - 'CCI-000771': 'IA-2 (6)', - 'CCI-000772': 'IA-2 (7)', - 'CCI-000773': 'IA-2 (8)', - 'CCI-000774': 'IA-2 (8)', - 'CCI-000775': 'IA-2 (9)', - 'CCI-000776': 'IA-2 (9)', - 'CCI-000777': 'IA-3', - 'CCI-000778': 'IA-3', - 'CCI-000779': 'IA-3 (1)', - 'CCI-000780': 'IA-3 (1)', - 'CCI-000781': 'IA-3 (2)', - 'CCI-000782': 'IA-3 (3)', - 'CCI-000783': 'IA-3 (3) (b)', - 'CCI-000784': 'IA-4 a', - 'CCI-000785': 'IA-4 a', - 'CCI-000786': 'IA-4 b', - 'CCI-000787': 'IA-4 b', - 'CCI-000788': 'IA-4 c', - 'CCI-000789': 'IA-4 c', - 'CCI-000790': 'IA-4 d', - 'CCI-000791': 'IA-4 d', - 'CCI-000792': 'IA-4 d', - 'CCI-000793': 'IA-4 d', - 'CCI-000794': 'IA-4 e', - 'CCI-000795': 'IA-4 e', - 'CCI-000796': 'IA-4 (1)', - 'CCI-000797': 'IA-4 (2)', - 'CCI-000798': 'IA-4 (2)', - 'CCI-000799': 'IA-4 (3)', - 'CCI-000800': 'IA-4 (4)', - 'CCI-000801': 'IA-4 (4)', - 'CCI-000802': 'IA-4 (5)', - 'CCI-000803': 'IA-7', - 'CCI-000804': 'IA-8', - 'CCI-000805': 'IR-1 a 1 (a)', - 'CCI-000806': 'IR-1 a 1 (a)', - 'CCI-000807': 'IR-1 c 1', - 'CCI-000808': 'IR-1 c 1', - 'CCI-000809': 'IR-1 a 2', - 'CCI-000810': 'IR-1 a 2', - 'CCI-000811': 'IR-1 c 2', - 'CCI-000812': 'IR-1 c 2', - 'CCI-000813': 'IR-2 a 1', - 'CCI-000814': 'IR-2 a 3', - 'CCI-000815': 'IR-2 c', - 'CCI-000816': 'IR-2 (1)', - 'CCI-000817': 'IR-2 (2)', - 'CCI-000818': 'IR-3', - 'CCI-000819': 'IR-3', - 'CCI-000820': 'IR-3', - 'CCI-000821': 'IR-3 (1)', - 'CCI-000822': 'IR-4 a', - 'CCI-000823': 'IR-4 b', - 'CCI-000824': 'IR-4 c', - 'CCI-000825': 'IR-4 (1)', - 'CCI-000826': 'IR-4 (2)', - 'CCI-000827': 'IR-4 (3)', - 'CCI-000828': 'IR-4 (3)', - 'CCI-000829': 'IR-4 (4)', - 'CCI-000830': 'IR-4 (5)', - 'CCI-000831': 'IR-4 (5)', - 'CCI-000832': 'IR-5', - 'CCI-000833': 'IR-5 (1)', - 'CCI-000834': 'IR-6 a', - 'CCI-000835': 'IR-6 a', - 'CCI-000836': 'IR-6 b', - 'CCI-000837': 'IR-6 (1)', - 'CCI-000838': 'IR-6 (2)', - 'CCI-000839': 'IR-7', - 'CCI-000840': 'IR-7 (1)', - 'CCI-000841': 'IR-7 (2) (a)', - 'CCI-000842': 'IR-7 (2) (b)', - 'CCI-000843': 'IR-8 a', - 'CCI-000844': 'IR-8 a 9', - 'CCI-000845': 'IR-8 b', - 'CCI-000846': 'IR-8 b', - 'CCI-000847': 'IR-8 c', - 'CCI-000848': 'IR-8 c', - 'CCI-000849': 'IR-8 c', - 'CCI-000850': 'IR-8 d', - 'CCI-000851': 'MA-1 c 1', - 'CCI-000852': 'MA-1 a 1 (a)', - 'CCI-000853': 'MA-1 a 1', - 'CCI-000854': 'MA-1 c 1', - 'CCI-000855': 'MA-1 a 2', - 'CCI-000856': 'MA-1 a 2', - 'CCI-000857': 'MA-1 c 2', - 'CCI-000858': 'MA-2 a', - 'CCI-000859': 'MA-2 b', - 'CCI-000860': 'MA-2 c', - 'CCI-000861': 'MA-2 d', - 'CCI-000862': 'MA-2 e', - 'CCI-000863': 'MA-2 (1) (a)(b)(c)(d)(e)', - 'CCI-000864': 'MA-2 (2)', - 'CCI-000865': 'MA-3 a', - 'CCI-000866': 'MA-3 a', - 'CCI-000867': 'MA-3 a', - 'CCI-000868': 'MA-3', - 'CCI-000869': 'MA-3 (1)', - 'CCI-000870': 'MA-3 (2)', - 'CCI-000871': 'MA-3 (3)', - 'CCI-000872': 'MA-3 (4)', - 'CCI-000873': 'MA-4 a', - 'CCI-000874': 'MA-4 a', - 'CCI-000875': 'MA-4 a', - 'CCI-000876': 'MA-4 b', - 'CCI-000877': 'MA-4 c', - 'CCI-000878': 'MA-4 d', - 'CCI-000879': 'MA-4 e', - 'CCI-000880': 'MA-4 (1)', - 'CCI-000881': 'MA-4 (2)', - 'CCI-000882': 'MA-4 (3) (a)', - 'CCI-000883': 'MA-4 (3) (b)', - 'CCI-000884': 'MA-4 (4) (a)', - 'CCI-000885': 'MA-4 (5) (a)', - 'CCI-000886': 'MA-4 (5) (b)', - 'CCI-000887': 'MA-4 (5) (a)', - 'CCI-000888': 'MA-4 (6)', - 'CCI-000889': 'MA-4 (7)', - 'CCI-000890': 'MA-5 a', - 'CCI-000891': 'MA-5 a', - 'CCI-000892': 'MA-5 b', - 'CCI-000893': 'MA-5 (1) (a)', - 'CCI-000894': 'MA-5 (1) (a) (1)', - 'CCI-000895': 'MA-5 (1) (a) (2)', - 'CCI-000896': 'MA-5 (1) (c)', - 'CCI-000897': 'MA-5 (2)', - 'CCI-000898': 'MA-5 (3)', - 'CCI-000899': 'MA-5 (4) (a)', - 'CCI-000900': 'MA-5 (4) (b)', - 'CCI-000901': 'MA-6', - 'CCI-000902': 'MA-6', - 'CCI-000903': 'MA-6', - 'CCI-000904': 'PE-1 a 1 (a)', - 'CCI-000905': 'PE-1 a 1', - 'CCI-000906': 'PE-1 c 1', - 'CCI-000907': 'PE-1 c 1', - 'CCI-000908': 'PE-1 a 2', - 'CCI-000909': 'PE-1 a 2', - 'CCI-000910': 'PE-1 c 2', - 'CCI-000911': 'PE-1 c 2', - 'CCI-000912': 'PE-2 a', - 'CCI-000913': 'PE-2 b', - 'CCI-000914': 'PE-2 c', - 'CCI-000915': 'PE-2 c', - 'CCI-000916': 'PE-2 (1)', - 'CCI-000917': 'PE-2 (2)', - 'CCI-000918': 'PE-2 (3)', - 'CCI-000919': 'PE-3 a', - 'CCI-000920': 'PE-3 a 1', - 'CCI-000921': 'PE-3 a 2', - 'CCI-000922': 'PE-3 d', - 'CCI-000923': 'PE-3 e', - 'CCI-000924': 'PE-3 f', - 'CCI-000925': 'PE-3 f', - 'CCI-000926': 'PE-3 g', - 'CCI-000927': 'PE-3 g', - 'CCI-000928': 'PE-3 (1)', - 'CCI-000929': 'PE-3 (2)', - 'CCI-000930': 'PE-3 (3)', - 'CCI-000931': 'PE-3 (4)', - 'CCI-000932': 'PE-3 (4)', - 'CCI-000933': 'PE-3 (5)', - 'CCI-000934': 'PE-3 (6)', - 'CCI-000935': 'PE-3 (6)', - 'CCI-000936': 'PE-4', - 'CCI-000937': 'PE-5', - 'CCI-000938': 'PE-6 a', - 'CCI-000939': 'PE-6 b', - 'CCI-000940': 'PE-6 b', - 'CCI-000941': 'PE-6 c', - 'CCI-000942': 'PE-6 (1)', - 'CCI-000943': 'PE-6 (2)', - 'CCI-000944': 'PE-7', - 'CCI-000945': 'PE-7 (1)', - 'CCI-000946': 'PE-7 (2)', - 'CCI-000947': 'PE-8 a', - 'CCI-000948': 'PE-8 b', - 'CCI-000949': 'PE-8 b', - 'CCI-000950': 'PE-8 (1)', - 'CCI-000951': 'PE-8 (2)', - 'CCI-000952': 'PE-9', - 'CCI-000953': 'PE-9 (1)', - 'CCI-000954': 'PE-9 (2)', - 'CCI-000955': 'PE-9 (2)', - 'CCI-000956': 'PE-10 a', - 'CCI-000957': 'PE-10 b', - 'CCI-000958': 'PE-10 b', - 'CCI-000959': 'PE-10 c', - 'CCI-000960': 'PE-11', - 'CCI-000961': 'PE-11 (1)', - 'CCI-000962': 'PE-11 (2)', - 'CCI-000963': 'PE-12', - 'CCI-000964': 'PE-12 (1)', - 'CCI-000965': 'PE-13', - 'CCI-000966': 'PE-13 (1)', - 'CCI-000967': 'PE-13 (2)', - 'CCI-000968': 'PE-13 (2) (b)', - 'CCI-000969': 'PE-13 (4)', - 'CCI-000970': 'PE-13 (4)', - 'CCI-000971': 'PE-14 a', - 'CCI-000972': 'PE-14 a', - 'CCI-000973': 'PE-14 b', - 'CCI-000974': 'PE-14 b', - 'CCI-000975': 'PE-14 (1)', - 'CCI-000976': 'PE-14 (2)', - 'CCI-000977': 'PE-15', - 'CCI-000978': 'PE-15', - 'CCI-000979': 'PE-15', - 'CCI-000980': 'PE-15 (1)', - 'CCI-000981': 'PE-16 a', - 'CCI-000982': 'PE-16', - 'CCI-000983': 'PE-16 a', - 'CCI-000984': 'PE-16 b', - 'CCI-000985': 'PE-17 b', - 'CCI-000986': 'PE-17 a', - 'CCI-000987': 'PE-17 c', - 'CCI-000988': 'PE-17 d', - 'CCI-000989': 'PE-18', - 'CCI-000990': 'PE-18', - 'CCI-000991': 'PE-18', - 'CCI-000992': 'PE-18 (1)', - 'CCI-000993': 'PE-19', - 'CCI-000994': 'PE-19 (1)', - 'CCI-000995': 'MP-1 a 1 (a)', - 'CCI-000996': 'MP-1 a 1', - 'CCI-000997': 'MP-1 c 1', - 'CCI-000998': 'MP-1 c 1', - 'CCI-000999': 'MP-1 a 2', - 'CCI-001000': 'MP-1 a 2', - 'CCI-001001': 'MP-1 c 2', - 'CCI-001002': 'MP-1 c 2', - 'CCI-001003': 'MP-2', - 'CCI-001004': 'MP-2', - 'CCI-001005': 'MP-2', - 'CCI-001006': 'MP-2', - 'CCI-001007': 'MP-4 (2)', - 'CCI-001008': 'MP-4 (2)', - 'CCI-001009': 'MP-2 (2)', - 'CCI-001010': 'MP-3 a', - 'CCI-001011': 'MP-3 b', - 'CCI-001012': 'MP-3 b', - 'CCI-001013': 'MP-3 b', - 'CCI-001014': 'MP-4 a', - 'CCI-001015': 'MP-4 a', - 'CCI-001016': 'MP-4 a', - 'CCI-001017': 'MP-4 a', - 'CCI-001018': 'MP-4 b', - 'CCI-001019': 'MP-4 (1)', - 'CCI-001020': 'MP-5 a', - 'CCI-001021': 'MP-5 a', - 'CCI-001022': 'MP-5 a', - 'CCI-001023': 'MP-5 b', - 'CCI-001024': 'MP-5 d', - 'CCI-001025': 'MP-5 c', - 'CCI-001026': 'MP-5 (3)', - 'CCI-001027': 'MP-5 (4)', - 'CCI-001028': 'MP-6 a', - 'CCI-001029': 'MP-6 (1)', - 'CCI-001030': 'MP-6 (2)', - 'CCI-001031': 'MP-6 (2)', - 'CCI-001032': 'MP-6 (3)', - 'CCI-001033': 'MP-6 (3)', - 'CCI-001034': 'MP-6 (4)', - 'CCI-001035': 'MP-6 (5)', - 'CCI-001036': 'MP-6 (6)', - 'CCI-001037': 'RA-1 a 1 (a)', - 'CCI-001038': 'RA-1 a 1 (a)', - 'CCI-001039': 'RA-1 c 1', - 'CCI-001040': 'RA-1 c 1', - 'CCI-001041': 'RA-1 a 2', - 'CCI-001042': 'RA-1 a 2', - 'CCI-001043': 'RA-1 c 2', - 'CCI-001044': 'RA-1 c 2', - 'CCI-001045': 'RA-2 a', - 'CCI-001046': 'RA-2 b', - 'CCI-001047': 'RA-2 c', - 'CCI-001048': 'RA-3 a 2', - 'CCI-001049': 'RA-3 c', - 'CCI-001050': 'RA-3 d', - 'CCI-001051': 'RA-3 d', - 'CCI-001052': 'RA-3 f', - 'CCI-001053': 'RA-3 f', - 'CCI-001054': 'RA-5 a', - 'CCI-001055': 'RA-5 a', - 'CCI-001056': 'RA-5 a', - 'CCI-001057': 'RA-5 b 1', - 'CCI-001058': 'RA-5 c', - 'CCI-001059': 'RA-5 d', - 'CCI-001060': 'RA-5 d', - 'CCI-001061': 'RA-5 e', - 'CCI-001062': 'RA-5 (1)', - 'CCI-001063': 'RA-5 (2)', - 'CCI-001064': 'RA-5 (2)', - 'CCI-001065': 'RA-5 (3)', - 'CCI-001066': 'RA-5 (4)', - 'CCI-001067': 'RA-5 (5)', - 'CCI-001068': 'RA-5 (6)', - 'CCI-001069': 'RA-5 (7)', - 'CCI-001070': 'RA-5 (7)', - 'CCI-001071': 'RA-5 (8)', - 'CCI-001072': 'RA-5 (9) (a)', - 'CCI-001073': 'RA-5 (9) (b)', - 'CCI-001074': 'SC-1 a 1', - 'CCI-001075': 'SC-1 a 1', - 'CCI-001076': 'SC-1 c 1', - 'CCI-001077': 'SC-1 c 1', - 'CCI-001078': 'SC-1 a 2', - 'CCI-001079': 'SC-1 a 2', - 'CCI-001080': 'SC-1 c 2', - 'CCI-001081': 'SC-1 c 2', - 'CCI-001082': 'SC-2', - 'CCI-001083': 'SC-2 (1)', - 'CCI-001084': 'SC-3', - 'CCI-001085': 'SC-3 (1)', - 'CCI-001086': 'SC-3 (2)', - 'CCI-001087': 'SC-3 (3)', - 'CCI-001088': 'SC-3 (4)', - 'CCI-001089': 'SC-3 (5)', - 'CCI-001090': 'SC-4', - 'CCI-001091': 'SC-4 (1)', - 'CCI-001092': 'SC-5', - 'CCI-001093': 'SC-5 a', - 'CCI-001094': 'SC-5 (1)', - 'CCI-001095': 'SC-5 (2)', - 'CCI-001096': 'SC-6', - 'CCI-001097': 'SC-7 a', - 'CCI-001098': 'SC-7 c', - 'CCI-001099': 'SC-7 (1)', - 'CCI-001100': 'SC-7 (2)', - 'CCI-001101': 'SC-7 (3)', - 'CCI-001102': 'SC-7 (4) (a)', - 'CCI-001103': 'SC-7 (4) (b)', - 'CCI-001104': 'SC-7 (4) (c)', - 'CCI-001105': 'SC-7 (4) (d)', - 'CCI-001106': 'SC-7 (4) (e)', - 'CCI-001107': 'SC-7 (4) (e)', - 'CCI-001108': 'SC-7 (4) (e)', - 'CCI-001109': 'SC-7 (5)', - 'CCI-001110': 'SC-7 (6)', - 'CCI-001111': 'SC-7 (7)', - 'CCI-001112': 'SC-7 (8)', - 'CCI-001113': 'SC-7 (8)', - 'CCI-001114': 'SC-7 (8)', - 'CCI-001115': 'SC-7 (9)', - 'CCI-001116': 'SC-7 (10) (a)', - 'CCI-001117': 'SC-7 (11)', - 'CCI-001118': 'SC-7 (12)', - 'CCI-001119': 'SC-7 (13)', - 'CCI-001120': 'SC-7 (13)', - 'CCI-001121': 'SC-7 (14)', - 'CCI-001122': 'SC-7 (14)', - 'CCI-001123': 'SC-7 (15)', - 'CCI-001124': 'SC-7 (16)', - 'CCI-001125': 'SC-7 (17)', - 'CCI-001126': 'SC-7 (18)', - 'CCI-001127': 'SC-8', - 'CCI-001128': 'SC-8 (1)', - 'CCI-001129': 'SC-8 (2)', - 'CCI-001130': 'SC-9', - 'CCI-001131': 'SC-9 (1)', - 'CCI-001132': 'SC-9 (2)', - 'CCI-001133': 'SC-10', - 'CCI-001134': 'SC-10', - 'CCI-001135': 'SC-11 a', - 'CCI-001136': 'SC-11', - 'CCI-001137': 'SC-12', - 'CCI-001138': 'SC-12', - 'CCI-001139': 'SC-12 (1)', - 'CCI-001140': 'SC-12 (2)', - 'CCI-001141': 'SC-12 (3)', - 'CCI-001142': 'SC-12 (4)', - 'CCI-001143': 'SC-12 (5)', - 'CCI-001144': 'SC-13', - 'CCI-001145': 'SC-13 (1)', - 'CCI-001146': 'SC-13 (2)', - 'CCI-001147': 'SC-13 (3)', - 'CCI-001148': 'SC-13 (4)', - 'CCI-001149': 'SC-14', - 'CCI-001150': 'SC-15 a', - 'CCI-001151': 'SC-15 a', - 'CCI-001152': 'SC-15 b', - 'CCI-001153': 'SC-15 (1)', - 'CCI-001154': 'SC-15 (2)', - 'CCI-001155': 'SC-15 (3)', - 'CCI-001156': 'SC-15 (3)', - 'CCI-001157': 'SC-16', - 'CCI-001158': 'SC-16 (1)', - 'CCI-001159': 'SC-17 a', - 'CCI-001160': 'SC-18 a', - 'CCI-001161': 'SC-18 b', - 'CCI-001162': 'SC-18 b', - 'CCI-001163': 'SC-18 b', - 'CCI-001164': 'SC-18 b', - 'CCI-001165': 'SC-18 b', - 'CCI-001166': 'SC-18 (1)', - 'CCI-001167': 'SC-18 (2)', - 'CCI-001168': 'SC-18 (2)', - 'CCI-001169': 'SC-18 (3)', - 'CCI-001170': 'SC-18 (4)', - 'CCI-001171': 'SC-18 (4)', - 'CCI-001172': 'SC-18 (4)', - 'CCI-001173': 'SC-19 a', - 'CCI-001174': 'SC-19 a', - 'CCI-001175': 'SC-19 b', - 'CCI-001176': 'SC-19 b', - 'CCI-001177': 'SC-19 b', - 'CCI-001178': 'SC-20 a', - 'CCI-001179': 'SC-20 b', - 'CCI-001180': 'SC-21', - 'CCI-001181': 'SC-21 (1)', - 'CCI-001182': 'SC-22', - 'CCI-001183': 'SC-22', - 'CCI-001184': 'SC-23', - 'CCI-001185': 'SC-23 (1)', - 'CCI-001186': 'SC-23 (2)', - 'CCI-001187': 'SC-23 (3)', - 'CCI-001188': 'SC-23 (3)', - 'CCI-001189': 'SC-23 (3)', - 'CCI-001190': 'SC-24', - 'CCI-001191': 'SC-24', - 'CCI-001192': 'SC-24', - 'CCI-001193': 'SC-24', - 'CCI-001194': 'SC-25', - 'CCI-001195': 'SC-26', - 'CCI-001196': 'SC-35', - 'CCI-001197': 'SC-27', - 'CCI-001198': 'SC-27', - 'CCI-001199': 'SC-28', - 'CCI-001200': 'SC-28 (1)', - 'CCI-001201': 'SC-29', - 'CCI-001202': 'SC-30', - 'CCI-001203': 'SC-29 (1)', - 'CCI-001204': 'SC-29 (1)', - 'CCI-001205': 'SC-30 (2)', - 'CCI-001206': 'SC-31', - 'CCI-001207': 'SC-31 (1)', - 'CCI-001208': 'SC-32', - 'CCI-001209': 'SC-33', - 'CCI-001210': 'SC-34 a', - 'CCI-001211': 'SC-34 b', - 'CCI-001212': 'SC-34', - 'CCI-001213': 'SC-34 b', - 'CCI-001214': 'SC-34 (1)', - 'CCI-001215': 'SC-34 (1)', - 'CCI-001216': 'SC-34 (2)', - 'CCI-001217': 'SI-1 a 1 (a)', - 'CCI-001218': 'SI-1 a 1', - 'CCI-001219': 'SI-1 c 1', - 'CCI-001220': 'SI-1 a 2', - 'CCI-001221': 'SI-1 a 2', - 'CCI-001222': 'SI-1 c 2', - 'CCI-001223': 'SI-1 c 1', - 'CCI-001224': 'SI-1 c 2', - 'CCI-001225': 'SI-2 a', - 'CCI-001226': 'SI-2 a', - 'CCI-001227': 'SI-2 a', - 'CCI-001228': 'SI-2 b', - 'CCI-001229': 'SI-2 b', - 'CCI-001230': 'SI-2 d', - 'CCI-001231': 'SI-2 (1)', - 'CCI-001232': 'SI-2 (1)', - 'CCI-001233': 'SI-2 (2)', - 'CCI-001234': 'SI-2 (2)', - 'CCI-001235': 'SI-2 (3) (a)', - 'CCI-001236': 'SI-2 (3) (b)', - 'CCI-001237': 'SI-2 (4)', - 'CCI-001238': 'SI-2 (4)', - 'CCI-001239': 'SI-3 a', - 'CCI-001240': 'SI-3 b', - 'CCI-001241': 'SI-3 c 1', - 'CCI-001242': 'SI-3 c 1', - 'CCI-001243': 'SI-3 c 2', - 'CCI-001244': 'SI-3 c 2', - 'CCI-001245': 'SI-3 d', - 'CCI-001246': 'SI-3 (1)', - 'CCI-001247': 'SI-3 (2)', - 'CCI-001248': 'SI-3 (3)', - 'CCI-001249': 'SI-3 (4)', - 'CCI-001250': 'SI-3 (5)', - 'CCI-001251': 'SI-3 (6) (a)', - 'CCI-001252': 'SI-4 a', - 'CCI-001253': 'SI-4 a 1', - 'CCI-001254': 'SI-4 b', - 'CCI-001255': 'SI-4 c 1', - 'CCI-001256': 'SI-4 c 2', - 'CCI-001257': 'SI-4 e', - 'CCI-001258': 'SI-4 f', - 'CCI-001259': 'SI-4 (1)', - 'CCI-001260': 'SI-4 (2)', - 'CCI-001261': 'SI-4 (3)', - 'CCI-001262': 'SI-4 (4)', - 'CCI-001263': 'SI-4 (5)', - 'CCI-001264': 'SI-4 (5)', - 'CCI-001265': 'SI-4 (6)', - 'CCI-001266': 'SI-4 (7) (a)', - 'CCI-001267': 'SI-4 (7) (a)', - 'CCI-001268': 'SI-4 (7) (b)', - 'CCI-001269': 'SI-4 (8)', - 'CCI-001270': 'SI-4 (9)', - 'CCI-001271': 'SI-4 (9)', - 'CCI-001272': 'SI-4 (10)', - 'CCI-001273': 'SI-4 (11)', - 'CCI-001274': 'SI-4 (12)', - 'CCI-001275': 'SI-4 (12)', - 'CCI-001276': 'SI-4 (13) (a)', - 'CCI-001277': 'SI-4 (13) (b)', - 'CCI-001278': 'SI-4 (13) (c)', - 'CCI-001279': 'SI-4 (13) (c)', - 'CCI-001280': 'SI-4 (13) (c)', - 'CCI-001281': 'SI-4 (14)', - 'CCI-001282': 'SI-4 (15)', - 'CCI-001283': 'SI-4 (16)', - 'CCI-001284': 'SI-4 (17)', - 'CCI-001285': 'SI-5 a', - 'CCI-001286': 'SI-5 b', - 'CCI-001287': 'SI-5 c', - 'CCI-001288': 'SI-5 c', - 'CCI-001289': 'SI-5 d', - 'CCI-001290': 'SI-5 (1)', - 'CCI-001291': 'SI-6', - 'CCI-001292': 'SI-6', - 'CCI-001293': 'SI-6', - 'CCI-001294': 'SI-6 c', - 'CCI-001295': 'SI-6 (2)', - 'CCI-001296': 'SI-6 (3)', - 'CCI-001297': 'SI-7', - 'CCI-001298': 'SI-7 (1)', - 'CCI-001299': 'SI-7 (1)', - 'CCI-001300': 'SI-7 (2)', - 'CCI-001301': 'SI-7 (3)', - 'CCI-001302': 'SI-7 (4)', - 'CCI-001303': 'SI-7 (4)', - 'CCI-001304': 'SI-7 (4)', - 'CCI-001305': 'SI-8 a', - 'CCI-001306': 'SI-8 b', - 'CCI-001307': 'SI-8 (1)', - 'CCI-001308': 'SI-8 (2)', - 'CCI-001309': 'SI-9', - 'CCI-001310': 'SI-10', - 'CCI-001311': 'SI-11 a', - 'CCI-001312': 'SI-11 a', - 'CCI-001313': 'SI-11 b', - 'CCI-001314': 'SI-11 b', - 'CCI-001315': 'SI-12', - 'CCI-001316': 'SI-13 a', - 'CCI-001317': 'SI-13 a', - 'CCI-001318': 'SI-13 b', - 'CCI-001319': 'SI-13 (1)', - 'CCI-001320': 'SI-13 (1)', - 'CCI-001321': 'SI-7 (16)', - 'CCI-001322': 'SI-7 (16)', - 'CCI-001323': 'SI-13 (3)', - 'CCI-001324': 'SI-13 (3)', - 'CCI-001325': 'SI-13 (3)', - 'CCI-001326': 'SI-13 (4) (a)', - 'CCI-001327': 'SI-13 (4) (a)', - 'CCI-001328': 'SI-13 (4) (b)', - 'CCI-001329': 'SI-13 (4) (b)', - 'CCI-001330': 'AC-19 (4) (a)', - 'CCI-001331': 'AC-19 (4) (b) (1)', - 'CCI-001332': 'AC-19 (4) (b) (2)', - 'CCI-001333': 'AC-19 (4) (b) (3)', - 'CCI-001334': 'AC-19 (4) (b) (4)', - 'CCI-001335': 'AC-19 (4) (b) (4)', - 'CCI-001336': 'AT-4 b', - 'CCI-001337': 'AT-4 b', - 'CCI-001338': 'AU-10 (1)', - 'CCI-001339': 'AU-10 (2)', - 'CCI-001340': 'AU-10 (3)', - 'CCI-001341': 'AU-10 (4) (a)', - 'CCI-001342': 'AU-10 (5)', - 'CCI-001343': 'AU-5 (4)', - 'CCI-001344': 'AU-6 (7)', - 'CCI-001345': 'AU-6 (8)', - 'CCI-001346': 'AU-6 (8)', - 'CCI-001347': 'AU-6 (9)', - 'CCI-001348': 'AU-9 (2)', - 'CCI-001349': 'AU-9 (2)', - 'CCI-001350': 'AU-9 (3)', - 'CCI-001351': 'AU-9 (4)', - 'CCI-001352': 'AU-9 (4) (b)', - 'CCI-001353': 'AU-12 (2)', - 'CCI-001354': 'AC-2 h', - 'CCI-001355': 'AC-2 h', - 'CCI-001356': 'AC-2 (5) (c)', - 'CCI-001357': 'AC-2 (5) (d)', - 'CCI-001358': 'AC-2 (7) (a)', - 'CCI-001359': 'AC-2 (7) (b)', - 'CCI-001360': 'AC-2 (7) (b)', - 'CCI-001361': 'AC-2 (2)', - 'CCI-001362': 'AC-3 (4)', - 'CCI-001363': 'AC-3 (4) (a)', - 'CCI-001365': 'AC-2 (2)', - 'CCI-001366': 'AC-3 (6)', - 'CCI-001367': 'AC-3 (6)', - 'CCI-001368': 'AC-4', - 'CCI-001371': 'AC-4 (14)', - 'CCI-001372': 'AC-4 (14)', - 'CCI-001373': 'AC-4 (15)', - 'CCI-001374': 'AC-4 (15)', - 'CCI-001376': 'AC-4 (17) (a)', - 'CCI-001377': 'AC-4 (17) (a)', - 'CCI-001380': 'AC-5 b', - 'CCI-001382': 'AC-7 (2)', - 'CCI-001383': 'AC-7 (2)', - 'CCI-001384': 'AC-8 c 1', - 'CCI-001385': 'AC-8 c 2', - 'CCI-001386': 'AC-8 c 2', - 'CCI-001387': 'AC-8 c 2', - 'CCI-001388': 'AC-8 c 3', - 'CCI-001389': 'AC-9 (2)', - 'CCI-001390': 'AC-9 (2)', - 'CCI-001391': 'AC-9 (2)', - 'CCI-001392': 'AC-9 (2)', - 'CCI-001393': 'AC-9 (3)', - 'CCI-001394': 'AC-9 (3)', - 'CCI-001395': 'AC-9 (3)', - 'CCI-001396': 'AC-16', - 'CCI-001397': 'AC-16', - 'CCI-001398': 'AC-16', - 'CCI-001399': 'AC-16', - 'CCI-001400': 'AC-16', - 'CCI-001401': 'AC-16', - 'CCI-001402': 'AC-17 c', - 'CCI-001403': 'AC-2 (4)', - 'CCI-001404': 'AC-2 (4)', - 'CCI-001405': 'AC-2 (4)', - 'CCI-001406': 'AC-2 (5)', - 'CCI-001407': 'AC-2 (7) (a)', - 'CCI-001408': 'AC-3 (2)', - 'CCI-001409': 'AC-3 (3)', - 'CCI-001410': 'AC-3 (3)', - 'CCI-001411': 'AC-3 (5)', - 'CCI-001412': 'AC-3 (6)', - 'CCI-001413': 'AC-3 (6)', - 'CCI-001414': 'AC-4', - 'CCI-001415': 'AC-4 (5)', - 'CCI-001416': 'AC-4 (7)', - 'CCI-001417': 'AC-4 (8) (a)', - 'CCI-001418': 'AC-4 (9)', - 'CCI-001419': 'AC-6 (2)', - 'CCI-001420': 'AC-6 (3)', - 'CCI-001421': 'AC-6 (5)', - 'CCI-001422': 'AC-6 (6)', - 'CCI-001423': 'AC-7 a', - 'CCI-001424': 'AC-16 (1)', - 'CCI-001425': 'AC-16 (2)', - 'CCI-001426': 'AC-16 (3)', - 'CCI-001427': 'AC-16 (4)', - 'CCI-001428': 'AC-16 (5)', - 'CCI-001429': 'AC-16 (5)', - 'CCI-001430': 'AC-16 (5)', - 'CCI-001431': 'AC-17 (5)', - 'CCI-001432': 'AC-17 (5)', - 'CCI-001433': 'AC-17 (7)', - 'CCI-001434': 'AC-17 (7)', - 'CCI-001435': 'AC-17 (8)', - 'CCI-001436': 'AC-17 (8)', - 'CCI-001437': 'AC-17 (4)', - 'CCI-001438': 'AC-18 a', - 'CCI-001439': 'AC-18 a', - 'CCI-001440': 'AC-18 b', - 'CCI-001441': 'AC-18 b', - 'CCI-001442': 'AC-18 d', - 'CCI-001443': 'AC-18 (1)', - 'CCI-001444': 'AC-18 (1)', - 'CCI-001445': 'AC-18 (2)', - 'CCI-001446': 'AC-18 (2)', - 'CCI-001447': 'AC-18 (2)', - 'CCI-001448': 'AC-18 (2)', - 'CCI-001449': 'AC-18 (3)', - 'CCI-001450': 'AC-18 (4)', - 'CCI-001451': 'AC-18 (5)', - 'CCI-001452': 'AC-7 a', - 'CCI-001453': 'AC-17 (2)', - 'CCI-001454': 'AC-17 (7)', - 'CCI-001455': 'AC-17 (8)', - 'CCI-001456': 'AC-19 f', - 'CCI-001457': 'AC-19 g', - 'CCI-001458': 'AC-19 (4) (b) (4)', - 'CCI-001459': 'AU-12 a', - 'CCI-001460': 'AU-13 a', - 'CCI-001461': 'AU-13 a', - 'CCI-001462': 'AU-14 (2)', - 'CCI-001463': 'AU-14 b', - 'CCI-001464': 'AU-14 (1)', - 'CCI-001465': 'AC-20 b', - 'CCI-001466': 'AC-20 b', - 'CCI-001467': 'AC-20 (1) (a)', - 'CCI-001468': 'AC-20 (1) (a)', - 'CCI-001469': 'AC-20 (1) (a)', - 'CCI-001470': 'AC-21 a', - 'CCI-001471': 'AC-21 b', - 'CCI-001472': 'AC-21 b', - 'CCI-001473': 'AC-22 a', - 'CCI-001474': 'AC-22 b', - 'CCI-001475': 'AC-22 c', - 'CCI-001476': 'AC-22 d', - 'CCI-001477': 'AC-22 d', - 'CCI-001478': 'AC-22 d', - 'CCI-001479': 'AT-2 c', - 'CCI-001480': 'AT-2', - 'CCI-001481': 'AT-3 (1)', - 'CCI-001482': 'AT-3 (1)', - 'CCI-001483': 'AT-3 (1)', - 'CCI-001484': 'AU-2 c', - 'CCI-001485': 'AU-2 c', - 'CCI-001486': 'AU-2 (3)', - 'CCI-001487': 'AU-3 f', - 'CCI-001488': 'AU-3 (1)', - 'CCI-001489': 'AU-3 (2)', - 'CCI-001490': 'AU-5 b', - 'CCI-001491': 'AU-6 (6)', - 'CCI-001492': 'AU-8 (1) (a)', - 'CCI-001493': 'AU-9 a', - 'CCI-001494': 'AU-9 a', - 'CCI-001495': 'AU-9 a', - 'CCI-001496': 'AU-9 (3)', - 'CCI-001497': 'CM-2 b 1', - 'CCI-001498': 'CM-3 (1) (c)', - 'CCI-001499': 'CM-5 (6)', - 'CCI-001500': 'CM-5 (7)', - 'CCI-001501': 'CM-5 (7)', - 'CCI-001502': 'CM-6 d', - 'CCI-001503': 'CM-6 d', - 'CCI-001504': 'PS-1 a 1 (a)', - 'CCI-001505': 'PS-1 a 1', - 'CCI-001506': 'PS-1 c 1', - 'CCI-001507': 'PS-1 c 1', - 'CCI-001508': 'PS-1 c 2', - 'CCI-001509': 'PS-1 a 2', - 'CCI-001510': 'PS-1 a 2', - 'CCI-001511': 'PS-1 c 2', - 'CCI-001512': 'PS-2 a', - 'CCI-001513': 'PS-2 b', - 'CCI-001514': 'PS-2 c', - 'CCI-001515': 'PS-2 c', - 'CCI-001516': 'PS-3 a', - 'CCI-001517': 'PS-3 b', - 'CCI-001518': 'PS-3 b', - 'CCI-001519': 'PS-3 b', - 'CCI-001520': 'PS-3 (1)', - 'CCI-001521': 'PS-3 (2)', - 'CCI-001522': 'PS-4 a', - 'CCI-001523': 'PS-4 c', - 'CCI-001524': 'PS-4 d', - 'CCI-001525': 'PS-4 e', - 'CCI-001526': 'PS-4 e', - 'CCI-001527': 'PS-5 a', - 'CCI-001528': 'PS-5 b', - 'CCI-001529': 'PS-5 b', - 'CCI-001530': 'PS-5 b', - 'CCI-001531': 'PS-6 c 1', - 'CCI-001532': 'PS-6 b', - 'CCI-001533': 'PS-6 b', - 'CCI-001534': 'PS-6 (1) (a)', - 'CCI-001535': 'PS-6 (1) (b)', - 'CCI-001536': 'PS-6 (2) (a)', - 'CCI-001537': 'PS-6 (2) (b)', - 'CCI-001538': 'PS-6 (2) (c)', - 'CCI-001539': 'PS-7 a', - 'CCI-001540': 'PS-7 c', - 'CCI-001541': 'PS-7 e', - 'CCI-001542': 'PS-8 a', - 'CCI-001543': 'PM-1 a', - 'CCI-001544': 'IA-5 c', - 'CCI-001545': 'AC-1 c 1', - 'CCI-001546': 'AC-1 c 2', - 'CCI-001547': 'AC-2 j', - 'CCI-001548': 'AC-4', - 'CCI-001549': 'AC-4', - 'CCI-001550': 'AC-4', - 'CCI-001551': 'AC-4', - 'CCI-001552': 'AC-4 (3)', - 'CCI-001553': 'AC-4 (10)', - 'CCI-001554': 'AC-4 (11)', - 'CCI-001555': 'AC-4 (17) (a)', - 'CCI-001556': 'AC-4 (17) (a)', - 'CCI-001557': 'AC-4 (17) c', - 'CCI-001558': 'AC-6 (1) (a)', - 'CCI-001559': 'AC-16 (2)', - 'CCI-001560': 'AC-16 (4)', - 'CCI-001561': 'AC-17 (3)', - 'CCI-001562': 'AC-17 (5)', - 'CCI-001563': 'AC-18 (2)', - 'CCI-001564': 'AT-1 c 1', - 'CCI-001565': 'AT-1 c 2', - 'CCI-001566': 'AT-3 (2)', - 'CCI-001567': 'AT-3 (2)', - 'CCI-001568': 'AT-3 (2)', - 'CCI-001569': 'AU-1 c 1', - 'CCI-001570': 'AU-1 c 2', - 'CCI-001571': 'AU-2 a', - 'CCI-001572': 'AU-5 a', - 'CCI-001573': 'AU-5 (3)', - 'CCI-001574': 'AU-5 (3)', - 'CCI-001575': 'AU-9 (2)', - 'CCI-001576': 'AU-12 (1)', - 'CCI-001577': 'AU-12 (1)', - 'CCI-001578': 'CA-1 c 2', - 'CCI-001579': 'CA-2 (2)', - 'CCI-001580': 'CA-3 b', - 'CCI-001581': 'CA-7 g', - 'CCI-001582': 'CA-2 (2)', - 'CCI-001583': 'CA-2 (2)', - 'CCI-001584': 'CM-1 c 2', - 'CCI-001585': 'CM-2 b 2', - 'CCI-001586': 'CM-3 g', - 'CCI-001587': 'CM-4 (1)', - 'CCI-001588': 'CM-6 a', - 'CCI-001589': 'CM-6 (3)', - 'CCI-001590': 'CM-7 (2)', - 'CCI-001591': 'CM-7 (2)', - 'CCI-001592': 'CM-7 (2)', - 'CCI-001593': 'CM-7 (2)', - 'CCI-001594': 'CM-7 (2)', - 'CCI-001595': 'CM-7 (2)', - 'CCI-001596': 'CP-1 c 2', - 'CCI-001597': 'CP-1 a 2', - 'CCI-001598': 'CP-1 c 2', - 'CCI-001599': 'CP-2 (5)', - 'CCI-001600': 'CP-2 (5)', - 'CCI-001601': 'CP-2 (6)', - 'CCI-001602': 'CP-2 (6)', - 'CCI-001603': 'CP-6 (1)', - 'CCI-001604': 'CP-6 (3)', - 'CCI-001605': 'CP-7 (1)', - 'CCI-001606': 'CP-7 (2)', - 'CCI-001607': 'CP-8 (2)', - 'CCI-001608': 'CP-8 (3)', - 'CCI-001609': 'CP-9 (6)', - 'CCI-001610': 'IA-5 f', - 'CCI-001611': 'IA-5 (1) (a)', - 'CCI-001612': 'IA-5 (1) (a)', - 'CCI-001613': 'IA-5 (1) (a)', - 'CCI-001614': 'IA-5 (1) (a)', - 'CCI-001615': 'IA-5 (1) (b)', - 'CCI-001616': 'IA-5 (1) (d)', - 'CCI-001617': 'IA-5 (1) (d)', - 'CCI-001618': 'IA-5 (1) (e)', - 'CCI-001619': 'IA-5 (1) (a)', - 'CCI-001620': 'IA-5 (3)', - 'CCI-001621': 'IA-5 (8)', - 'CCI-001622': 'IR-2', - 'CCI-001623': 'IR-2', - 'CCI-001624': 'IR-3', - 'CCI-001625': 'IR-4 c', - 'CCI-001626': 'IR-5 (1)', - 'CCI-001627': 'IR-5 (1)', - 'CCI-001628': 'MA-1 c 2', - 'CCI-001629': 'MA-2 (2)', - 'CCI-001630': 'MA-4 (1)', - 'CCI-001631': 'MA-4 (3) (b)', - 'CCI-001632': 'MA-4 (4) (b) (1)', - 'CCI-001633': 'MP-3 a', - 'CCI-001634': 'PE-2 (3)', - 'CCI-001635': 'PE-2 d', - 'CCI-001636': 'PL-1 c 1', - 'CCI-001637': 'PL-1 c 1', - 'CCI-001638': 'PL-1 c 2', - 'CCI-001639': 'PL-4 a', - 'CCI-001640': 'PM-8', - 'CCI-001641': 'RA-5 a', - 'CCI-001642': 'RA-3 c', - 'CCI-001643': 'RA-5 a', - 'CCI-001644': 'RA-5 (3)', - 'CCI-001645': 'RA-5 (5)', - 'CCI-001646': 'SA-1 c 2', - 'CCI-001647': 'SA-4 (7) (b)', - 'CCI-001648': 'SA-5 (5)', - 'CCI-001649': 'SA-7', - 'CCI-001650': 'SA-10 (b)', - 'CCI-001651': 'SA-10 (b)', - 'CCI-001652': 'SA-10 (b)', - 'CCI-001653': 'SA-10 (b)', - 'CCI-001654': 'SA-10 (b)', - 'CCI-001655': 'SA-10 (b)', - 'CCI-001656': 'SC-3', - 'CCI-001657': 'SC-7 a', - 'CCI-001658': 'SC-7 a', - 'CCI-001659': 'SC-7 (2)', - 'CCI-001660': 'SC-7 (14)', - 'CCI-001661': 'SC-11 b', - 'CCI-001662': 'SC-18 (1)', - 'CCI-001663': 'SC-20 b', - 'CCI-001664': 'SC-23 (3)', - 'CCI-001665': 'SC-24', - 'CCI-001666': 'SC-28 (1)', - 'CCI-001667': 'SI-2 (3)', - 'CCI-001668': 'SI-3 a', - 'CCI-001669': 'SI-3 (6) (a)', - 'CCI-001670': 'SI-4 (7) (b)', - 'CCI-001671': 'SI-4 (11)', - 'CCI-001672': 'SI-4 (14)', - 'CCI-001673': 'SI-4 (14)', - 'CCI-001674': 'SI-6', - 'CCI-001675': 'SI-6 (3)', - 'CCI-001676': 'SI-6', - 'CCI-001677': 'SI-8 a', - 'CCI-001678': 'SI-12', - 'CCI-001679': 'SI-13 b', - 'CCI-001680': 'PM-1 a 2', - 'CCI-001681': 'CA-2 (2)', - 'CCI-001682': 'AC-2 (2)', - 'CCI-001683': 'AC-2 (4)', - 'CCI-001684': 'AC-2 (4)', - 'CCI-001685': 'AC-2 (4)', - 'CCI-001686': 'AC-2 (4)', - 'CCI-001687': 'SC-18 (2)', - 'CCI-001688': 'SC-18 (2)', - 'CCI-001689': 'SI-13 (4) (b)', - 'CCI-001690': 'SA-5 (1)', - 'CCI-001691': 'SA-5 (1)', - 'CCI-001692': 'SA-5 (4)', - 'CCI-001693': 'AC-3 (4)', - 'CCI-001694': 'AC-3 (4)', - 'CCI-001695': 'SC-18 (3)', - 'CCI-001726': 'CM-10 a', - 'CCI-001727': 'CM-10 a', - 'CCI-001728': 'CM-10 a', - 'CCI-001729': 'CM-10 a', - 'CCI-001730': 'CM-10 b', - 'CCI-001731': 'CM-10 b', - 'CCI-001732': 'CM-10 c', - 'CCI-001733': 'CM-10 c', - 'CCI-001734': 'CM-10 (1)', - 'CCI-001735': 'CM-10 (1)', - 'CCI-001736': 'CM-2 (3)', - 'CCI-001737': 'CM-2 (7) (a)', - 'CCI-001738': 'CM-2 (7) (a)', - 'CCI-001739': 'CM-2 (7) (a)', - 'CCI-001740': 'CM-3 b', - 'CCI-001741': 'CM-3 c', - 'CCI-001742': 'CM-3 (1) (b)', - 'CCI-001743': 'CM-3 (5)', - 'CCI-001744': 'CM-3 (5)', - 'CCI-001745': 'CM-3 (6)', - 'CCI-001746': 'CM-3 (6)', - 'CCI-001747': 'CM-5 (3)', - 'CCI-001748': 'CM-5 (3)', - 'CCI-001749': 'CM-5 (3)', - 'CCI-001750': 'CM-5 (3)', - 'CCI-001751': 'CM-5 (4)', - 'CCI-001752': 'CM-5 (4)', - 'CCI-001753': 'CM-5 (5) (a)', - 'CCI-001754': 'CM-5 (5) (a)', - 'CCI-001755': 'CM-6 c', - 'CCI-001756': 'CM-6 c', - 'CCI-001757': 'CM-6 (2)', - 'CCI-001758': 'CM-6 (2)', - 'CCI-001759': 'CM-6 (2)', - 'CCI-001760': 'CM-7 (1) (a)', - 'CCI-001761': 'CM-7 (1) (b)', - 'CCI-001762': 'CM-7 (1) (b)', - 'CCI-001763': 'CM-7 (2)', - 'CCI-001764': 'CM-7 (2)', - 'CCI-001765': 'CM-7 (4) (a)', - 'CCI-001766': 'CM-7 (4) (a)', - 'CCI-001767': 'CM-7 (4) (b)', - 'CCI-001768': 'CM-7 (4) (c)', - 'CCI-001769': 'CM-7 (4) (c)', - 'CCI-001770': 'CM-7 (4) (c)', - 'CCI-001771': 'CM-7 (4) (c)', - 'CCI-001772': 'CM-7 (5) (a)', - 'CCI-001773': 'CM-7 (5) (a)', - 'CCI-001774': 'CM-7 (5) (b)', - 'CCI-001775': 'CM-7 (5) (c)', - 'CCI-001776': 'CM-7 (5) (c)', - 'CCI-001777': 'CM-7 (5) (c)', - 'CCI-001778': 'CM-7 (5) (c)', - 'CCI-001779': 'CM-8 b', - 'CCI-001780': 'CM-8 b', - 'CCI-001781': 'CM-8 b', - 'CCI-001782': 'CM-8 b', - 'CCI-001783': 'CM-8 (3) (b)', - 'CCI-001784': 'CM-8 (3) (b)', - 'CCI-001785': 'CM-8 (7)', - 'CCI-001786': 'CM-8 (8)', - 'CCI-001787': 'CM-8 (9) (a)', - 'CCI-001788': 'CM-8 (9) (a)', - 'CCI-001789': 'CM-8 (9) (b)', - 'CCI-001790': 'CM-9 b', - 'CCI-001791': 'CM-9 b', - 'CCI-001792': 'CM-9 b', - 'CCI-001793': 'CM-9 b', - 'CCI-001794': 'CM-9 b', - 'CCI-001795': 'CM-9 b', - 'CCI-001796': 'CM-9 c', - 'CCI-001797': 'CM-9 c', - 'CCI-001798': 'CM-9 c', - 'CCI-001799': 'CM-9 e', - 'CCI-001800': 'CM-9 d', - 'CCI-001801': 'CM-9 e', - 'CCI-001802': 'CM-10 b', - 'CCI-001803': 'CM-10 b', - 'CCI-001804': 'CM-11 a', - 'CCI-001805': 'CM-11 a', - 'CCI-001806': 'CM-11 b', - 'CCI-001807': 'CM-11 b', - 'CCI-001808': 'CM-11 c', - 'CCI-001809': 'CM-11 c', - 'CCI-001810': 'CM-11 (1)', - 'CCI-001811': 'CM-11 (1)', - 'CCI-001812': 'CM-11 (2)', - 'CCI-001813': 'CM-5 (1) (a)', - 'CCI-001814': 'CM-5 (1)', - 'CCI-001815': 'CM-2 (7) (b)', - 'CCI-001816': 'CM-2 (7) (b)', - 'CCI-001817': 'CM-4 (1)', - 'CCI-001818': 'CM-4 (1)', - 'CCI-001819': 'CM-3 d', - 'CCI-001820': 'CM-1 a 1', - 'CCI-001821': 'CM-1 a 1 (a)', - 'CCI-001822': 'CM-1 a 1 (a)', - 'CCI-001823': 'CM-1 a 2', - 'CCI-001824': 'CM-1 a 2', - 'CCI-001825': 'CM-1 a 2', - 'CCI-001826': 'CM-5 (2)', - 'CCI-001827': 'CM-5 (5) (b)', - 'CCI-001828': 'CM-5 (5) (b)', - 'CCI-001829': 'CM-5 (5) (b)', - 'CCI-001830': 'CM-5 (5) (b)', - 'CCI-001831': 'AU-1 a 1', - 'CCI-001832': 'AU-1 a 1 (a)', - 'CCI-001833': 'AU-1 a 2', - 'CCI-001834': 'AU-1 a 2', - 'CCI-001835': 'AU-1 b 1', - 'CCI-001836': 'AU-1 b 1', - 'CCI-001837': 'AU-1 b 1', - 'CCI-001838': 'AU-1 b 1', - 'CCI-001839': 'AU-1 b 2', - 'CCI-001840': 'AU-1 b 2', - 'CCI-001841': 'AU-1 b 2', - 'CCI-001842': 'AU-1 b 2', - 'CCI-001843': 'AU-2 (3)', - 'CCI-001844': 'AU-3 (2)', - 'CCI-001845': 'AU-3 (2)', - 'CCI-001846': 'AU-3 (2)', - 'CCI-001847': 'AU-3 (2)', - 'CCI-001848': 'AU-4', - 'CCI-001849': 'AU-4', - 'CCI-001850': 'AU-4 (1)', - 'CCI-001851': 'AU-4 (1)', - 'CCI-001852': 'AU-5 (1)', - 'CCI-001853': 'AU-5 (1)', - 'CCI-001854': 'AU-5 (1)', - 'CCI-001855': 'AU-5 (1)', - 'CCI-001856': 'AU-5 (2)', - 'CCI-001857': 'AU-5 (2)', - 'CCI-001858': 'AU-5 (2)', - 'CCI-001859': 'AU-5 (3)', - 'CCI-001860': 'AU-5 (4)', - 'CCI-001861': 'AU-5 (4)', - 'CCI-001862': 'AU-6 a', - 'CCI-001863': 'AU-6 b', - 'CCI-001864': 'AU-6 (1)', - 'CCI-001865': 'AU-6 (1)', - 'CCI-001866': 'AU-6 (5)', - 'CCI-001867': 'AU-6 (5)', - 'CCI-001868': 'AU-6 (7)', - 'CCI-001869': 'AU-6 (7)', - 'CCI-001870': 'AU-6 (8)', - 'CCI-001871': 'AU-6 (9)', - 'CCI-001872': 'AU-6 (10)', - 'CCI-001873': 'AU-6 (10)', - 'CCI-001874': 'AU-6 (10)', - 'CCI-001875': 'AU-7 a', - 'CCI-001876': 'AU-7 a', - 'CCI-001877': 'AU-7 a', - 'CCI-001878': 'AU-7 a', - 'CCI-001879': 'AU-7 a', - 'CCI-001880': 'AU-7 a', - 'CCI-001881': 'AU-7 b', - 'CCI-001882': 'AU-7 b', - 'CCI-001883': 'AU-7 (1)', - 'CCI-001884': 'AU-7 (2)', - 'CCI-001885': 'AU-7 (2)', - 'CCI-001886': 'AU-7 (2)', - 'CCI-001887': 'AU-7 (2)', - 'CCI-001888': 'AU-8 b', - 'CCI-001889': 'AU-8 b', - 'CCI-001890': 'AU-8 b', - 'CCI-001891': 'AU-8 (1) (a)', - 'CCI-001892': 'AU-8 (1) (b)', - 'CCI-001893': 'AU-8 (2)', - 'CCI-001894': 'AU-9 (4)', - 'CCI-001895': 'AU-9 (5)', - 'CCI-001896': 'AU-9 (5)', - 'CCI-001897': 'AU-9 (6)', - 'CCI-001898': 'AU-9 (6)', - 'CCI-001899': 'AU-10', - 'CCI-001900': 'AU-10 (1) (a)', - 'CCI-001901': 'AU-10 (1) (a)', - 'CCI-001902': 'AU-10 (1) (b)', - 'CCI-001903': 'AU-10 (2) (a)', - 'CCI-001904': 'AU-10 (2) (a)', - 'CCI-001905': 'AU-10 (2) (b)', - 'CCI-001906': 'AU-10 (2) (b)', - 'CCI-001907': 'AU-10 (4) (a)', - 'CCI-001908': 'AU-10 (4) (b)', - 'CCI-001909': 'AU-10 (4) (b)', - 'CCI-001910': 'AU-12 b', - 'CCI-001911': 'AU-12 (3)', - 'CCI-001912': 'AU-12 (3)', - 'CCI-001913': 'AU-12 (3)', - 'CCI-001914': 'AU-12 (3)', - 'CCI-001915': 'AU-13 a', - 'CCI-001916': 'AU-13 (1)', - 'CCI-001917': 'AU-13 (2)', - 'CCI-001918': 'AU-13 (2)', - 'CCI-001919': 'AU-14 a', - 'CCI-001920': 'AU-14 (3)', - 'CCI-001921': 'AU-15', - 'CCI-001922': 'AU-15', - 'CCI-001923': 'AU-16', - 'CCI-001924': 'AU-16', - 'CCI-001925': 'AU-16', - 'CCI-001926': 'AU-16 (1)', - 'CCI-001927': 'AU-16 (2)', - 'CCI-001928': 'AU-16 (2)', - 'CCI-001929': 'AU-16 (2)', - 'CCI-001930': 'AU-1 a 1', - 'CCI-001931': 'AU-1 a 2', - 'CCI-001932': 'IA-1 a 1', - 'CCI-001933': 'IA-1 a 1', - 'CCI-001934': 'IA-1 a 2', - 'CCI-001935': 'IA-2 (6)', - 'CCI-001936': 'IA-2 (6)', - 'CCI-001937': 'IA-2 (6)', - 'CCI-001938': 'IA-2 (7)', - 'CCI-001939': 'IA-2 (7)', - 'CCI-001940': 'IA-2 (7)', - 'CCI-001941': 'IA-2 (8)', - 'CCI-001942': 'IA-2 (9)', - 'CCI-001943': 'IA-2 (10)', - 'CCI-001944': 'IA-2 (10)', - 'CCI-001945': 'IA-2 (10)', - 'CCI-001946': 'IA-2 (10)', - 'CCI-001947': 'IA-2 (11)', - 'CCI-001948': 'IA-2 (11)', - 'CCI-001949': 'IA-2 (11)', - 'CCI-001950': 'IA-2 (11)', - 'CCI-001951': 'IA-2 (11)', - 'CCI-001952': 'IA-2 (11)', - 'CCI-001953': 'IA-2 (12)', - 'CCI-001954': 'IA-2 (12)', - 'CCI-001955': 'IA-2 (13)', - 'CCI-001956': 'IA-2 (13)', - 'CCI-001957': 'IA-2 (13)', - 'CCI-001958': 'IA-3', - 'CCI-001959': 'IA-3 (1)', - 'CCI-001960': 'IA-3 (3) (a)', - 'CCI-001961': 'IA-3 (3) (a)', - 'CCI-001962': 'IA-3 (3) (a)', - 'CCI-001963': 'IA-3 (3) (a)', - 'CCI-001964': 'IA-3 (4)', - 'CCI-001965': 'IA-3 (4)', - 'CCI-001966': 'IA-3 (4)', - 'CCI-001967': 'IA-3 (1)', - 'CCI-001968': 'IA-3 (4)', - 'CCI-001969': 'IA-3 (4)', - 'CCI-001970': 'IA-4 a', - 'CCI-001971': 'IA-4 a', - 'CCI-001972': 'IA-4 b', - 'CCI-001973': 'IA-4 c', - 'CCI-001974': 'IA-4 d', - 'CCI-001975': 'IA-4 d', - 'CCI-001976': 'IA-4 (5)', - 'CCI-001977': 'IA-4 (6)', - 'CCI-001978': 'IA-4 (6)', - 'CCI-001979': 'IA-4 (7)', - 'CCI-001980': 'IA-5 a', - 'CCI-001981': 'IA-5 d', - 'CCI-001982': 'IA-5 d', - 'CCI-001983': 'IA-5 d', - 'CCI-001984': 'IA-5 d', - 'CCI-001985': 'IA-5 d', - 'CCI-001986': 'IA-5 d', - 'CCI-001987': 'IA-5 d', - 'CCI-001988': 'IA-5 d', - 'CCI-001989': 'IA-5 e', - 'CCI-001990': 'IA-5 i', - 'CCI-001991': 'IA-5 (2) (d)', - 'CCI-001992': 'IA-5 (3)', - 'CCI-001993': 'IA-5 (3)', - 'CCI-001994': 'IA-5 (3)', - 'CCI-001995': 'IA-5 (3)', - 'CCI-001996': 'IA-5 (4)', - 'CCI-001997': 'IA-5 (4)', - 'CCI-001998': 'IA-5 (5)', - 'CCI-001999': 'IA-5 (9)', - 'CCI-002000': 'IA-5 (9)', - 'CCI-002001': 'IA-5 (10)', - 'CCI-002002': 'IA-5 (11)', - 'CCI-002003': 'IA-5 (11)', - 'CCI-002004': 'IA-5 (12)', - 'CCI-002005': 'IA-5 (12)', - 'CCI-002006': 'IA-5 (13)', - 'CCI-002007': 'IA-5 (13)', - 'CCI-002008': 'IA-5 (14)', - 'CCI-002009': 'IA-8 (1)', - 'CCI-002010': 'IA-8 (1)', - 'CCI-002011': 'IA-8 (2)', - 'CCI-002012': 'IA-8 (3)', - 'CCI-002013': 'IA-8 (3)', - 'CCI-002014': 'IA-8 (4)', - 'CCI-002015': 'IA-8 (5)', - 'CCI-002016': 'IA-8 (5)', - 'CCI-002017': 'IA-9', - 'CCI-002018': 'IA-9', - 'CCI-002019': 'IA-9', - 'CCI-002020': 'IA-9', - 'CCI-002021': 'IA-9', - 'CCI-002022': 'IA-9', - 'CCI-002023': 'IA-9 (1)', - 'CCI-002024': 'IA-9 (1)', - 'CCI-002025': 'IA-9 (1)', - 'CCI-002026': 'IA-9 (1)', - 'CCI-002027': 'IA-9 (1)', - 'CCI-002028': 'IA-9 (1)', - 'CCI-002029': 'IA-9 (2)', - 'CCI-002030': 'IA-9 (2)', - 'CCI-002031': 'IA-9 (2)', - 'CCI-002032': 'IA-9 (2)', - 'CCI-002033': 'IA-10', - 'CCI-002034': 'IA-10', - 'CCI-002035': 'IA-10', - 'CCI-002036': 'IA-11', - 'CCI-002037': 'IA-11', - 'CCI-002038': 'IA-11', - 'CCI-002039': 'IA-11', - 'CCI-002040': 'IA-4 (2)', - 'CCI-002041': 'IA-5 (1) (f)', - 'CCI-002042': 'IA-5 g', - 'CCI-002043': 'IA-5 (15)', - 'CCI-002044': 'AU-11 (1)', - 'CCI-002045': 'AU-11 (1)', - 'CCI-002046': 'AU-8 (1) (b)', - 'CCI-002047': 'AU-12 (3)', - 'CCI-002048': 'AT-1 a 1 (a)', - 'CCI-002049': 'AT-1 a 2', - 'CCI-002050': 'AT-3 (1)', - 'CCI-002051': 'AT-3 (2)', - 'CCI-002052': 'AT-3 (3)', - 'CCI-002053': 'AT-3 (4)', - 'CCI-002054': 'AT-3 (4)', - 'CCI-002055': 'AT-2 (2)', - 'CCI-002056': 'CM-3 d', - 'CCI-002057': 'CM-3 (1) (f)', - 'CCI-002058': 'CM-3 (1) (f)', - 'CCI-002059': 'CM-6 (1)', - 'CCI-002060': 'CA-1 a 1', - 'CCI-002061': 'CA-1 a 1 (a)', - 'CCI-002062': 'CA-1 a 2', - 'CCI-002063': 'CA-2 (1)', - 'CCI-002064': 'CA-2 (2)', - 'CCI-002065': 'CA-2 (2)', - 'CCI-002066': 'CA-2 (3)', - 'CCI-002067': 'CA-2 (3)', - 'CCI-002068': 'CA-2 (3)', - 'CCI-002069': 'CA-2 (3)', - 'CCI-002070': 'CA-2 b 3', - 'CCI-002071': 'CA-2 f', - 'CCI-002072': 'CA-3 (1)', - 'CCI-002073': 'CA-3 (1)', - 'CCI-002074': 'CA-3 (2)', - 'CCI-002075': 'CA-3 (3)', - 'CCI-002076': 'CA-3 (3)', - 'CCI-002077': 'CA-3 (3)', - 'CCI-002078': 'CA-3 (4)', - 'CCI-002079': 'CA-3 (4)', - 'CCI-002080': 'CA-3 (5)', - 'CCI-002081': 'CA-3 (5)', - 'CCI-002082': 'CA-3 (5)', - 'CCI-002083': 'CA-3 c', - 'CCI-002084': 'CA-3 c', - 'CCI-002085': 'CA-7 (1)', - 'CCI-002086': 'CA-7 (3)', - 'CCI-002087': 'CA-7 a', - 'CCI-002088': 'CA-7 b', - 'CCI-002089': 'CA-7 b', - 'CCI-002090': 'CA-7 d', - 'CCI-002091': 'CA-7 e', - 'CCI-002092': 'CA-7 f', - 'CCI-002093': 'CA-8', - 'CCI-002094': 'CA-8', - 'CCI-002095': 'CA-8', - 'CCI-002096': 'CA-8 (1)', - 'CCI-002097': 'CA-8 (2)', - 'CCI-002098': 'CA-8 (2)', - 'CCI-002099': 'CA-8 (2)', - 'CCI-002100': 'CA-9 (1)', - 'CCI-002101': 'CA-9 (a)', - 'CCI-002102': 'CA-9 (a)', - 'CCI-002103': 'CA-9 (b)', - 'CCI-002104': 'CA-9 (b)', - 'CCI-002105': 'CA-9 (b)', - 'CCI-002106': 'AC-1 a 1', - 'CCI-002107': 'AC-1 a 1 (a)', - 'CCI-002108': 'AC-1 a 2', - 'CCI-002109': 'AC-1 a 2', - 'CCI-002110': 'AC-2 a', - 'CCI-002111': 'AC-2 a', - 'CCI-002112': 'AC-2 b', - 'CCI-002113': 'AC-2 c', - 'CCI-002114': 'AC-2 d', - 'CCI-002115': 'AC-2 d 1', - 'CCI-002116': 'AC-2 d 2', - 'CCI-002117': 'AC-2 d 2', - 'CCI-002118': 'AC-2 d 3', - 'CCI-002119': 'AC-2 d 3', - 'CCI-002120': 'AC-2 e', - 'CCI-002121': 'AC-2 f', - 'CCI-002122': 'AC-2 g', - 'CCI-002123': 'AC-2 h 1', - 'CCI-002124': 'AC-2 h 2', - 'CCI-002125': 'AC-2 h 3', - 'CCI-002126': 'AC-2 i 1', - 'CCI-002127': 'AC-2 i 2', - 'CCI-002128': 'AC-2 i 3', - 'CCI-002129': 'AC-2 k', - 'CCI-002130': 'AC-2 (4)', - 'CCI-002131': 'AC-2 (4)', - 'CCI-002132': 'AC-2 (4)', - 'CCI-002133': 'AC-2 (5)', - 'CCI-002134': 'AC-2 (6)', - 'CCI-002135': 'AC-2 (6)', - 'CCI-002136': 'AC-2 (7) (c)', - 'CCI-002137': 'AC-2 (7) (d)', - 'CCI-002138': 'AC-2 (8)', - 'CCI-002139': 'AC-2 (8)', - 'CCI-002140': 'AC-2 (9)', - 'CCI-002141': 'AC-2 (9)', - 'CCI-002142': 'AC-2 (10)', - 'CCI-002143': 'AC-2 (11)', - 'CCI-002144': 'AC-2 (11)', - 'CCI-002145': 'AC-2 (11)', - 'CCI-002146': 'AC-2 (12) (a)', - 'CCI-002147': 'AC-2 (12) (a)', - 'CCI-002148': 'AC-2 (12) (b)', - 'CCI-002149': 'AC-2 (12) (b)', - 'CCI-002150': 'AC-2 (13)', - 'CCI-002151': 'AC-2 (13)', - 'CCI-002152': 'AC-3 (2)', - 'CCI-002153': 'AC-3 (3)', - 'CCI-002154': 'AC-3 (3) (a)', - 'CCI-002155': 'AC-3 (3) (b) (1)', - 'CCI-002156': 'AC-3 (3) (b) (2)', - 'CCI-002157': 'AC-3 (3) (b) (3)', - 'CCI-002158': 'AC-3 (3) (b) (4)', - 'CCI-002159': 'AC-3 (3) (b) (4)', - 'CCI-002160': 'AC-3 (3) (b) (5)', - 'CCI-002161': 'AC-3 (3) (c)', - 'CCI-002162': 'AC-3 (3) (c)', - 'CCI-002163': 'AC-3 (4)', - 'CCI-002164': 'AC-3 (4)', - 'CCI-002165': 'AC-3 (4)', - 'CCI-002166': 'AC-3 (7)', - 'CCI-002167': 'AC-3 (7)', - 'CCI-002168': 'AC-3 (7)', - 'CCI-002169': 'AC-3 (7)', - 'CCI-002170': 'AC-3 (7)', - 'CCI-002171': 'AC-3 (7)', - 'CCI-002172': 'AC-3 (7)', - 'CCI-002173': 'AC-3 (7)', - 'CCI-002174': 'AC-3 (7)', - 'CCI-002175': 'AC-3 (7)', - 'CCI-002176': 'AC-3 (7)', - 'CCI-002177': 'AC-3 (8)', - 'CCI-002178': 'AC-3 (8)', - 'CCI-002179': 'AC-3 (8)', - 'CCI-002180': 'AC-3 (9) (a)', - 'CCI-002181': 'AC-3 (9) (a)', - 'CCI-002182': 'AC-3 (9) (a)', - 'CCI-002183': 'AC-3 (9) (b)', - 'CCI-002184': 'AC-3 (9) (b)', - 'CCI-002185': 'AC-3 (10)', - 'CCI-002186': 'AC-3 (10)', - 'CCI-002187': 'AC-4 (1)', - 'CCI-002188': 'AC-4 (1)', - 'CCI-002189': 'AC-4 (1)', - 'CCI-002190': 'AC-4 (1)', - 'CCI-002191': 'AC-4 (2)', - 'CCI-002192': 'AC-4 (3)', - 'CCI-002193': 'AC-4 (4)', - 'CCI-002194': 'AC-4 (6)', - 'CCI-002195': 'AC-4 (8) (a)', - 'CCI-002196': 'AC-4 (9)', - 'CCI-002197': 'AC-4 (9)', - 'CCI-002198': 'AC-4 (9)', - 'CCI-002199': 'AC-4 (10)', - 'CCI-002200': 'AC-4 (12)', - 'CCI-002201': 'AC-4 (12)', - 'CCI-002202': 'AC-4 (13)', - 'CCI-002203': 'AC-4 (15)', - 'CCI-002204': 'AC-4 (15)', - 'CCI-002205': 'AC-4 (17)', - 'CCI-002206': 'AC-4 (17)', - 'CCI-002207': 'AC-4 (17)', - 'CCI-002208': 'AC-4 (17)', - 'CCI-002209': 'AC-4 (18)', - 'CCI-002210': 'AC-4 (18)', - 'CCI-002211': 'AC-4 (19)', - 'CCI-002212': 'AC-4 (20)', - 'CCI-002213': 'AC-4 (20)', - 'CCI-002214': 'AC-4 (20)', - 'CCI-002215': 'AC-4 (21)', - 'CCI-002216': 'AC-4 (21)', - 'CCI-002217': 'AC-4 (21)', - 'CCI-002218': 'AC-4 (22)', - 'CCI-002219': 'AC-5 a', - 'CCI-002220': 'AC-5 b', - 'CCI-002221': 'AC-6 (1) (b)', - 'CCI-002222': 'AC-6 (1) (a)', - 'CCI-002223': 'AC-6 (1) (b)', - 'CCI-002224': 'AC-6 (3)', - 'CCI-002225': 'AC-6 (4)', - 'CCI-002226': 'AC-6 (5)', - 'CCI-002227': 'AC-6 (5)', - 'CCI-002228': 'AC-6 (7) (a)', - 'CCI-002229': 'AC-6 (7) (a)', - 'CCI-002230': 'AC-6 (7) (a)', - 'CCI-002231': 'AC-6 (7) (b)', - 'CCI-002232': 'AC-6 (8)', - 'CCI-002233': 'AC-6 (8)', - 'CCI-002234': 'AC-6 (9)', - 'CCI-002235': 'AC-6 (10)', - 'CCI-002236': 'AC-7 b', - 'CCI-002237': 'AC-7 b', - 'CCI-002238': 'AC-7 b', - 'CCI-002239': 'AC-7 (2)', - 'CCI-002240': 'AC-7 (2)', - 'CCI-002241': 'AC-7 (2)', - 'CCI-002242': 'AC-7 (2)', - 'CCI-002243': 'AC-8 a 1', - 'CCI-002244': 'AC-8 a 2', - 'CCI-002245': 'AC-8 a 3', - 'CCI-002246': 'AC-8 a 4', - 'CCI-002247': 'AC-8 a', - 'CCI-002248': 'AC-8 c 1', - 'CCI-002249': 'AC-9 (4)', - 'CCI-002250': 'AC-9 (4)', - 'CCI-002251': 'AC-9 (4)', - 'CCI-002252': 'AC-10', - 'CCI-002253': 'AC-10', - 'CCI-002254': 'AC-12', - 'CCI-002255': 'AC-14 a', - 'CCI-002256': 'AC-16 a', - 'CCI-002257': 'AC-16 a', - 'CCI-002258': 'AC-16 a', - 'CCI-002259': 'AC-16 a', - 'CCI-002260': 'AC-16 a', - 'CCI-002261': 'AC-16 a', - 'CCI-002262': 'AC-16 a', - 'CCI-002263': 'AC-16 a', - 'CCI-002264': 'AC-16 a', - 'CCI-002265': 'AC-16 b', - 'CCI-002266': 'AC-16 b', - 'CCI-002267': 'AC-16 c', - 'CCI-002268': 'AC-16 c', - 'CCI-002269': 'AC-16 c', - 'CCI-002270': 'AC-16 d', - 'CCI-002271': 'AC-16 d', - 'CCI-002272': 'AC-16 (1)', - 'CCI-002273': 'AC-16 (1)', - 'CCI-002274': 'AC-16 (1)', - 'CCI-002275': 'AC-16 (1)', - 'CCI-002276': 'AC-16 (2)', - 'CCI-002277': 'AC-16 (2)', - 'CCI-002278': 'AC-16 (3)', - 'CCI-002279': 'AC-16 (3)', - 'CCI-002280': 'AC-16 (3)', - 'CCI-002281': 'AC-16 (3)', - 'CCI-002282': 'AC-16 (3)', - 'CCI-002283': 'AC-16 (3)', - 'CCI-002284': 'AC-16 (3)', - 'CCI-002285': 'AC-16 (4)', - 'CCI-002286': 'AC-16 (4)', - 'CCI-002287': 'AC-16 (4)', - 'CCI-002288': 'AC-16 (4)', - 'CCI-002289': 'AC-16 (4)', - 'CCI-002290': 'AC-16 (4)', - 'CCI-002291': 'AC-16 (6)', - 'CCI-002292': 'AC-16 (6)', - 'CCI-002293': 'AC-16 (6)', - 'CCI-002294': 'AC-16 (6)', - 'CCI-002295': 'AC-16 (6)', - 'CCI-002296': 'AC-16 (6)', - 'CCI-002297': 'AC-16 (6)', - 'CCI-002298': 'AC-16 (6)', - 'CCI-002299': 'AC-16 (7)', - 'CCI-002300': 'AC-16 (8)', - 'CCI-002301': 'AC-16 (8)', - 'CCI-002302': 'AC-16 (8)', - 'CCI-002303': 'AC-16 (9)', - 'CCI-002304': 'AC-16 (9)', - 'CCI-002305': 'AC-16 (10)', - 'CCI-002306': 'AC-16 (10)', - 'CCI-002307': 'AC-16 (10)', - 'CCI-002308': 'AC-16 (10)', - 'CCI-002309': 'AC-16 (10)', - 'CCI-002310': 'AC-17 a', - 'CCI-002311': 'AC-17 a', - 'CCI-002312': 'AC-17 a', - 'CCI-002313': 'AC-17 (1)', - 'CCI-002314': 'AC-17 (1)', - 'CCI-002315': 'AC-17 (3)', - 'CCI-002316': 'AC-17 (4) (a)', - 'CCI-002317': 'AC-17 (4) (a)', - 'CCI-002318': 'AC-17 (4) (a)', - 'CCI-002319': 'AC-17 (4) (b)', - 'CCI-002320': 'AC-17 (4) (b)', - 'CCI-002321': 'AC-17 (9)', - 'CCI-002322': 'AC-17 (9)', - 'CCI-002323': 'AC-18 a', - 'CCI-002324': 'AC-18 (4)', - 'CCI-002325': 'AC-19 a', - 'CCI-002326': 'AC-19 a', - 'CCI-002327': 'AC-19 (4) (c)', - 'CCI-002328': 'AC-19 (4) (c)', - 'CCI-002329': 'AC-19 (5)', - 'CCI-002330': 'AC-19 (5)', - 'CCI-002331': 'AC-19 (5)', - 'CCI-002332': 'AC-20 a 2', - 'CCI-002333': 'AC-20 (1) (a)', - 'CCI-002334': 'AC-20 (1) (a)', - 'CCI-002335': 'AC-20 (1) (a)', - 'CCI-002336': 'AC-20 (1) (a)', - 'CCI-002337': 'AC-20 (1) (b)', - 'CCI-002338': 'AC-20 (3)', - 'CCI-002339': 'AC-20 (4)', - 'CCI-002340': 'AC-20 (4)', - 'CCI-002341': 'AC-21 (2)', - 'CCI-002342': 'AC-21 (2)', - 'CCI-002343': 'AC-23', - 'CCI-002344': 'AC-23', - 'CCI-002345': 'AC-23', - 'CCI-002346': 'AC-23', - 'CCI-002347': 'AC-23', - 'CCI-002348': 'AC-24', - 'CCI-002349': 'AC-24', - 'CCI-002350': 'AC-24 (1)', - 'CCI-002351': 'AC-24 (1)', - 'CCI-002352': 'AC-24 (1)', - 'CCI-002353': 'AC-24 (1)', - 'CCI-002354': 'AC-24 (2)', - 'CCI-002355': 'AC-24 (2)', - 'CCI-002356': 'AC-25', - 'CCI-002357': 'AC-25', - 'CCI-002358': 'AC-25', - 'CCI-002359': 'AC-25', - 'CCI-002360': 'AC-12', - 'CCI-002361': 'AC-12', - 'CCI-002362': 'AC-12 (1)', - 'CCI-002363': 'AC-12 (1)', - 'CCI-002364': 'AC-12 (2)', - 'CCI-002365': 'IA-5 i', - 'CCI-002366': 'IA-5 i', - 'CCI-002367': 'IA-5 (7)', - 'CCI-002368': 'RA-1 a 1 (a)', - 'CCI-002369': 'RA-1 a 2', - 'CCI-002370': 'RA-3 e', - 'CCI-002371': 'RA-3 e', - 'CCI-002372': 'RA-5 (10)', - 'CCI-002373': 'RA-5 (3)', - 'CCI-002374': 'RA-5 (4)', - 'CCI-002375': 'RA-5 (4)', - 'CCI-002376': 'RA-5 e', - 'CCI-002377': 'SC-1 a 1', - 'CCI-002378': 'SC-1 a 1', - 'CCI-002379': 'SC-1 a 2', - 'CCI-002380': 'SC-1 a 2', - 'CCI-002381': 'SC-3 (3)', - 'CCI-002382': 'SC-3 (4)', - 'CCI-002383': 'SC-4 (2)', - 'CCI-002384': 'SC-4 (2)', - 'CCI-002385': 'SC-5 a', - 'CCI-002386': 'SC-5', - 'CCI-002387': 'SC-5 (1)', - 'CCI-002388': 'SC-5 (3) (a)', - 'CCI-002389': 'SC-5 (3) (a)', - 'CCI-002390': 'SC-5 (3) (b)', - 'CCI-002391': 'SC-5 (3) (b)', - 'CCI-002392': 'SC-6', - 'CCI-002393': 'SC-6', - 'CCI-002394': 'SC-6', - 'CCI-002395': 'SC-7 b', - 'CCI-002396': 'SC-7 (4) (c)', - 'CCI-002397': 'SC-7 (7)', - 'CCI-002398': 'SC-7 (9) (a)', - 'CCI-002399': 'SC-7 (9) (a)', - 'CCI-002400': 'SC-7 (9) (b)', - 'CCI-002401': 'SC-7 (11)', - 'CCI-002402': 'SC-7 (11)', - 'CCI-002403': 'SC-7 (11)', - 'CCI-002404': 'SC-7 (12)', - 'CCI-002405': 'SC-7 (12)', - 'CCI-002406': 'SC-7 (12)', - 'CCI-002407': 'SC-7 (14)', - 'CCI-002408': 'SC-7 (19)', - 'CCI-002409': 'SC-7 (19)', - 'CCI-002410': 'SC-7 (20)', - 'CCI-002411': 'SC-7 (20)', - 'CCI-002412': 'SC-7 (21)', - 'CCI-002413': 'SC-7 (21)', - 'CCI-002414': 'SC-7 (21)', - 'CCI-002415': 'SC-7 (21)', - 'CCI-002416': 'SC-7 (22)', - 'CCI-002417': 'SC-7 (23)', - 'CCI-002418': 'SC-8', - 'CCI-002419': 'SC-8 (1)', - 'CCI-002420': 'SC-8 (2)', - 'CCI-002421': 'SC-8 (1)', - 'CCI-002422': 'SC-8 (2)', - 'CCI-002423': 'SC-8 (3)', - 'CCI-002424': 'SC-8 (4)', - 'CCI-002425': 'SC-8 (4)', - 'CCI-002426': 'SC-11 (1) (a)', - 'CCI-002427': 'SC-8 (3)', - 'CCI-002428': 'SC-12', - 'CCI-002429': 'SC-12', - 'CCI-002430': 'SC-12', - 'CCI-002431': 'SC-12', - 'CCI-002432': 'SC-12', - 'CCI-002433': 'SC-12', - 'CCI-002434': 'SC-12', - 'CCI-002435': 'SC-12', - 'CCI-002436': 'SC-12', - 'CCI-002437': 'SC-12', - 'CCI-002438': 'SC-12', - 'CCI-002439': 'SC-12', - 'CCI-002440': 'SC-12', - 'CCI-002441': 'SC-12', - 'CCI-002442': 'SC-12', - 'CCI-002443': 'SC-12 (2)', - 'CCI-002444': 'SC-12 (2)', - 'CCI-002445': 'SC-12 (2)', - 'CCI-002446': 'SC-12 (3)', - 'CCI-002447': 'SC-12 (3)', - 'CCI-002448': 'SC-12 (3)', - 'CCI-002449': 'SC-13', - 'CCI-002450': 'SC-13 b', - 'CCI-002451': 'SC-15 (3)', - 'CCI-002452': 'SC-15 (4)', - 'CCI-002453': 'SC-15 (4)', - 'CCI-002454': 'SC-16', - 'CCI-002455': 'SC-16', - 'CCI-002456': 'SC-17 a', - 'CCI-002457': 'SC-18 (1)', - 'CCI-002458': 'SC-18 (1)', - 'CCI-002459': 'SC-18 (3)', - 'CCI-002460': 'SC-18 (4)', - 'CCI-002461': 'SC-18 (5)', - 'CCI-002462': 'SC-20 a', - 'CCI-002463': 'SC-20 (2)', - 'CCI-002464': 'SC-20 (2)', - 'CCI-002465': 'SC-21', - 'CCI-002466': 'SC-21', - 'CCI-002467': 'SC-21', - 'CCI-002468': 'SC-21', - 'CCI-002469': 'SC-23 (5)', - 'CCI-002470': 'SC-23 (5)', - 'CCI-002471': 'SC-25', - 'CCI-002472': 'SC-28', - 'CCI-002473': 'SC-28 (1)', - 'CCI-002474': 'SC-28 (1)', - 'CCI-002475': 'SC-28 (1)', - 'CCI-002476': 'SC-28 (1)', - 'CCI-002477': 'SC-28 (2)', - 'CCI-002478': 'SC-28 (2)', - 'CCI-002479': 'SC-28 (2)', - 'CCI-002480': 'SC-29', - 'CCI-002481': 'SC-29 (1)', - 'CCI-002482': 'SC-30', - 'CCI-002483': 'SC-30', - 'CCI-002484': 'SC-30', - 'CCI-002485': 'SC-30', - 'CCI-002486': 'SC-30 (2)', - 'CCI-002487': 'SC-30 (2)', - 'CCI-002488': 'SC-30 (2)', - 'CCI-002489': 'SC-30 (3)', - 'CCI-002490': 'SC-30 (3)', - 'CCI-002491': 'SC-30 (3)', - 'CCI-002492': 'SC-30 (3)', - 'CCI-002493': 'SC-30 (4)', - 'CCI-002494': 'SC-30 (4)', - 'CCI-002495': 'SC-30 (5)', - 'CCI-002496': 'SC-30 (5)', - 'CCI-002497': 'SC-30 (5)', - 'CCI-002498': 'SC-31 a', - 'CCI-002499': 'SC-31 b', - 'CCI-002500': 'SC-31 (2)', - 'CCI-002501': 'SC-31 (2)', - 'CCI-002502': 'SC-31 (3)', - 'CCI-002503': 'SC-31 (3)', - 'CCI-002504': 'SC-32', - 'CCI-002505': 'SC-32', - 'CCI-002506': 'SC-32', - 'CCI-002507': 'SC-34 (2)', - 'CCI-002508': 'SC-51 a', - 'CCI-002509': 'SC-51 a', - 'CCI-002510': 'SC-51 b', - 'CCI-002511': 'SC-51 b', - 'CCI-002512': 'SC-51 b', - 'CCI-002513': 'SC-36', - 'CCI-002514': 'SC-36', - 'CCI-002515': 'SC-36', - 'CCI-002516': 'SC-36', - 'CCI-002517': 'SC-36 (1) (a)', - 'CCI-002518': 'SC-36 (1) (a)', - 'CCI-002519': 'SC-36 (1) (a)', - 'CCI-002520': 'SC-36 (1) (a)', - 'CCI-002521': 'SC-37', - 'CCI-002522': 'SC-37', - 'CCI-002523': 'SC-37, SC-37 (1)', - 'CCI-002524': 'SC-37', - 'CCI-002525': 'SC-37 (1)', - 'CCI-002526': 'SC-37 (1)', - 'CCI-002527': 'SC-37 (1)', - 'CCI-002528': 'SC-38', - 'CCI-002529': 'SC-38', - 'CCI-002530': 'SC-39', - 'CCI-002531': 'SC-39 (1)', - 'CCI-002532': 'SC-39 (2)', - 'CCI-002533': 'SC-39 (2)', - 'CCI-002534': 'SC-40', - 'CCI-002535': 'SC-40', - 'CCI-002536': 'SC-40', - 'CCI-002537': 'SC-40 (1)', - 'CCI-002538': 'SC-40 (1)', - 'CCI-002539': 'SC-40 (2)', - 'CCI-002540': 'SC-40 (2)', - 'CCI-002541': 'SC-40 (3)', - 'CCI-002542': 'SC-40 (4)', - 'CCI-002543': 'SC-40 (4)', - 'CCI-002544': 'SC-41', - 'CCI-002545': 'SC-41', - 'CCI-002546': 'SC-41', - 'CCI-002547': 'SC-42 a', - 'CCI-002548': 'SC-42 a', - 'CCI-002549': 'SC-42 b', - 'CCI-002550': 'SC-42 b', - 'CCI-002551': 'SC-42 (1)', - 'CCI-002552': 'SC-42 (1)', - 'CCI-002553': 'SC-42 (2)', - 'CCI-002554': 'SC-42 (2)', - 'CCI-002555': 'SC-42 (2)', - 'CCI-002556': 'SC-42 a', - 'CCI-002557': 'SC-42 a', - 'CCI-002558': 'SC-42 (3)', - 'CCI-002559': 'SC-43 a', - 'CCI-002560': 'SC-43 a', - 'CCI-002561': 'SC-43 b', - 'CCI-002562': 'SC-43 b', - 'CCI-002563': 'SC-43 b', - 'CCI-002564': 'SC-44', - 'CCI-002565': 'SC-44', - 'CCI-002566': 'MP-1 a 1', - 'CCI-002567': 'MP-6 (1)', - 'CCI-002568': 'MP-6 (1)', - 'CCI-002569': 'MP-6 (1)', - 'CCI-002570': 'MP-6 (1)', - 'CCI-002571': 'MP-6 (1)', - 'CCI-002572': 'MP-6 (1)', - 'CCI-002573': 'MP-6 (7)', - 'CCI-002574': 'MP-6 (7)', - 'CCI-002575': 'MP-6 (8)', - 'CCI-002576': 'MP-6 (8)', - 'CCI-002577': 'MP-6 (8)', - 'CCI-002578': 'MP-6 a', - 'CCI-002579': 'MP-6 a', - 'CCI-002580': 'MP-6 b', - 'CCI-002581': 'MP-7 (a)', - 'CCI-002582': 'MP-7 (a)', - 'CCI-002583': 'MP-7 (a)', - 'CCI-002584': 'MP-7 (a)', - 'CCI-002585': 'MP-7 (b)', - 'CCI-002586': 'MP-7 (2)', - 'CCI-002587': 'MP-8 (1)', - 'CCI-002588': 'MP-8 (2)', - 'CCI-002589': 'MP-8 (2)', - 'CCI-002590': 'MP-8 (2)', - 'CCI-002591': 'MP-8 (2)', - 'CCI-002592': 'MP-8 (3)', - 'CCI-002593': 'MP-8 (3)', - 'CCI-002594': 'MP-8 (4)', - 'CCI-002595': 'MP-8 a', - 'CCI-002596': 'MP-8 a', - 'CCI-002597': 'MP-8 a', - 'CCI-002598': 'MP-8 b', - 'CCI-002599': 'MP-8 c', - 'CCI-002600': 'MP-8 d', - 'CCI-002601': 'SI-1 a', - 'CCI-002602': 'SI-2 b', - 'CCI-002603': 'SI-2 b', - 'CCI-002604': 'SI-2 c', - 'CCI-002605': 'SI-2 c', - 'CCI-002606': 'SI-2 c', - 'CCI-002607': 'SI-2 c', - 'CCI-002608': 'SI-2 (3) (b)', - 'CCI-002609': 'SI-2 (5)', - 'CCI-002610': 'SI-2 (5)', - 'CCI-002611': 'SI-2 (5)', - 'CCI-002612': 'SI-2 (5)', - 'CCI-002613': 'SI-2 (5)', - 'CCI-002614': 'SI-2 (5)', - 'CCI-002615': 'SI-2 (6)', - 'CCI-002616': 'SI-2 (6)', - 'CCI-002617': 'SI-2 (6)', - 'CCI-002618': 'SI-2 (6)', - 'CCI-002619': 'SI-3 a', - 'CCI-002620': 'SI-3 a', - 'CCI-002621': 'SI-3 a', - 'CCI-002622': 'SI-3 a', - 'CCI-002623': 'SI-3 c 1', - 'CCI-002624': 'SI-3 c 1', - 'CCI-002625': 'SI-3 (6) (b)', - 'CCI-002626': 'SI-3 (6) (b)', - 'CCI-002627': 'SI-3 (7)', - 'CCI-002628': 'SI-3 (8) (a)', - 'CCI-002629': 'SI-3 (8) (a)', - 'CCI-002630': 'SI-3 (8) (a)', - 'CCI-002631': 'SI-3 (8) (b)', - 'CCI-002632': 'SI-3 (9)', - 'CCI-002633': 'SI-3 (9)', - 'CCI-002634': 'SI-3 (10) (a)', - 'CCI-002635': 'SI-3 (10) (a)', - 'CCI-002636': 'SI-3 (10) (a)', - 'CCI-002637': 'SI-3 (9)', - 'CCI-002638': 'SI-3 (10) (a)', - 'CCI-002639': 'SI-3 (10) (b)', - 'CCI-002640': 'SI-3 (10) (b)', - 'CCI-002641': 'SI-4 a 1', - 'CCI-002642': 'SI-4 a 2', - 'CCI-002643': 'SI-4 a 2', - 'CCI-002644': 'SI-4 a 2', - 'CCI-002645': 'SI-4 b', - 'CCI-002646': 'SI-4 b', - 'CCI-002647': 'SI-4 d', - 'CCI-002648': 'SI-4 d', - 'CCI-002649': 'SI-4 d', - 'CCI-002650': 'SI-4 g', - 'CCI-002651': 'SI-4 g', - 'CCI-002652': 'SI-4 g', - 'CCI-002653': 'SI-4', - 'CCI-002654': 'SI-4 g', - 'CCI-002655': 'SI-4 (1)', - 'CCI-002656': 'SI-4 (1)', - 'CCI-002657': 'SI-4 (3)', - 'CCI-002658': 'SI-4 (3)', - 'CCI-002659': 'SI-4 (4) (b)', - 'CCI-002660': 'SI-4 (4) (b)', - 'CCI-002661': 'SI-4 (4) (b)', - 'CCI-002662': 'SI-4 (4) (b)', - 'CCI-002663': 'SI-4 (5)', - 'CCI-002664': 'SI-4 (5)', - 'CCI-002665': 'SI-4 (10)', - 'CCI-002666': 'SI-4 (10)', - 'CCI-002667': 'SI-4 (10)', - 'CCI-002668': 'SI-4 (11)', - 'CCI-002669': 'SI-4 (13) (c)', - 'CCI-002670': 'SI-4 (18)', - 'CCI-002671': 'SI-4 (18)', - 'CCI-002672': 'SI-4 (18)', - 'CCI-002673': 'SI-4 (19)', - 'CCI-002674': 'SI-4 (19)', - 'CCI-002675': 'SI-4 (19)', - 'CCI-002676': 'SI-4 (20)', - 'CCI-002677': 'SI-4 (20)', - 'CCI-002678': 'SI-4 (21)', - 'CCI-002679': 'SI-4 (21)', - 'CCI-002680': 'SI-4 (21)', - 'CCI-002681': 'SI-4 (22) (a)', - 'CCI-002682': 'SI-4 (22) (a)', - 'CCI-002683': 'SI-4 (22) (a)', - 'CCI-002684': 'SI-4 (22) (b)', - 'CCI-002685': 'SI-4 (23)', - 'CCI-002686': 'SI-4 (23)', - 'CCI-002687': 'SI-4 (23)', - 'CCI-002688': 'SI-4 (24)', - 'CCI-002689': 'SI-4 (24)', - 'CCI-002690': 'SI-4 (24)', - 'CCI-002691': 'SI-4 (24)', - 'CCI-002692': 'SI-5 a', - 'CCI-002693': 'SI-5 c', - 'CCI-002694': 'SI-5 c', - 'CCI-002695': 'SI-6 a', - 'CCI-002696': 'SI-6 a', - 'CCI-002697': 'SI-6 b', - 'CCI-002698': 'SI-6 b', - 'CCI-002699': 'SI-6 b', - 'CCI-002700': 'SI-6 c', - 'CCI-002701': 'SI-6 d', - 'CCI-002702': 'SI-6 d', - 'CCI-002703': 'SI-7', - 'CCI-002704': 'SI-7 a', - 'CCI-002705': 'SI-7 (1)', - 'CCI-002706': 'SI-7 (1)', - 'CCI-002707': 'SI-7 (1)', - 'CCI-002708': 'SI-7 (1)', - 'CCI-002709': 'SI-7 (1)', - 'CCI-002710': 'SI-7 (1)', - 'CCI-002711': 'SI-7 (1)', - 'CCI-002712': 'SI-7 (1)', - 'CCI-002713': 'SI-7 (2)', - 'CCI-002714': 'SI-7 (5)', - 'CCI-002715': 'SI-7 (5)', - 'CCI-002716': 'SI-7 (6)', - 'CCI-002717': 'SI-7 (6)', - 'CCI-002718': 'SI-7 (6)', - 'CCI-002719': 'SI-7 (7)', - 'CCI-002720': 'SI-7 (7)', - 'CCI-002721': 'SI-7 (8)', - 'CCI-002722': 'SI-7 (8)', - 'CCI-002723': 'SI-7 (8)', - 'CCI-002724': 'SI-7 (8)', - 'CCI-002725': 'SI-7 (9)', - 'CCI-002726': 'SI-7 (9)', - 'CCI-002727': 'SI-7 (10)', - 'CCI-002728': 'SI-7 (10)', - 'CCI-002729': 'SI-7 (10)', - 'CCI-002730': 'SI-7 (11)', - 'CCI-002731': 'SI-7 (11)', - 'CCI-002732': 'SI-7 (12)', - 'CCI-002733': 'SI-7 (12)', - 'CCI-002734': 'SI-7 (13)', - 'CCI-002735': 'SI-7 (13)', - 'CCI-002736': 'SI-7 (13)', - 'CCI-002737': 'SI-7 (14) (a)', - 'CCI-002738': 'SI-7 (14) (b)', - 'CCI-002739': 'SI-7 (15)', - 'CCI-002740': 'SI-7 (15)', - 'CCI-002741': 'SI-8 a', - 'CCI-002742': 'SI-8 a', - 'CCI-002743': 'SI-8 (3)', - 'CCI-002744': 'SI-10', - 'CCI-002745': 'SI-10 (1) (a)', - 'CCI-002746': 'SI-10 (1) (a)', - 'CCI-002747': 'SI-10 (1) (b)', - 'CCI-002748': 'SI-10 (1) (b)', - 'CCI-002749': 'SI-10 (1) (c)', - 'CCI-002750': 'SI-10 (2)', - 'CCI-002751': 'SI-10 (2)', - 'CCI-002752': 'SI-10 (2)', - 'CCI-002753': 'SI-10 (2)', - 'CCI-002754': 'SI-10 (3)', - 'CCI-002755': 'SI-10 (4)', - 'CCI-002756': 'SI-10 (5)', - 'CCI-002757': 'SI-10 (5)', - 'CCI-002758': 'SI-10 (5)', - 'CCI-002759': 'SI-11 b', - 'CCI-002760': 'SI-13 a', - 'CCI-002761': 'SI-13 a', - 'CCI-002762': 'SI-13 b', - 'CCI-002763': 'SI-13 b', - 'CCI-002764': 'SI-14', - 'CCI-002765': 'SI-14', - 'CCI-002766': 'SI-14', - 'CCI-002767': 'SI-14', - 'CCI-002768': 'SI-14 (1)', - 'CCI-002769': 'SI-14 (1)', - 'CCI-002770': 'SI-15', - 'CCI-002771': 'SI-15', - 'CCI-002772': 'SI-15', - 'CCI-002773': 'SI-17', - 'CCI-002774': 'SI-17', - 'CCI-002775': 'SI-17', - 'CCI-002776': 'IR-1 a 1 (a)', - 'CCI-002777': 'IR-1 a 2', - 'CCI-002778': 'IR-2 a 1', - 'CCI-002779': 'IR-2 a 2', - 'CCI-002780': 'IR-3 (2)', - 'CCI-002781': 'IR-4 (2)', - 'CCI-002782': 'IR-4 (6)', - 'CCI-002783': 'IR-4 (7)', - 'CCI-002784': 'IR-4 (7)', - 'CCI-002785': 'IR-4 (8)', - 'CCI-002786': 'IR-4 (8)', - 'CCI-002787': 'IR-4 (8)', - 'CCI-002788': 'IR-4 (9)', - 'CCI-002789': 'IR-4 (9)', - 'CCI-002790': 'IR-4 (10)', - 'CCI-002791': 'IR-6 b', - 'CCI-002792': 'IR-6 (2)', - 'CCI-002793': 'IR-6 (3)', - 'CCI-002794': 'IR-8 a', - 'CCI-002795': 'IR-8 a 1', - 'CCI-002796': 'IR-8 a 2', - 'CCI-002797': 'IR-8 a 3', - 'CCI-002798': 'IR-8 a 4', - 'CCI-002799': 'IR-8 a 5', - 'CCI-002800': 'IR-8 a 6', - 'CCI-002801': 'IR-8 a 7', - 'CCI-002802': 'IR-8 a 9', - 'CCI-002803': 'IR-8 d', - 'CCI-002804': 'IR-8 e', - 'CCI-002805': 'IR-9 b', - 'CCI-002806': 'IR-9 c', - 'CCI-002807': 'IR-9 c', - 'CCI-002808': 'IR-9 d', - 'CCI-002809': 'IR-9 e', - 'CCI-002810': 'IR-9 f', - 'CCI-002811': 'IR-9 g', - 'CCI-002812': 'IR-9 g', - 'CCI-002813': 'IR-9 (1)', - 'CCI-002814': 'IR-9 (1)', - 'CCI-002815': 'IR-9 (1)', - 'CCI-002816': 'IR-9 (2)', - 'CCI-002817': 'IR-9 (2)', - 'CCI-002818': 'IR-9 (3)', - 'CCI-002819': 'IR-9 (3)', - 'CCI-002820': 'IR-9 (4)', - 'CCI-002821': 'IR-9 (4)', - 'CCI-002822': 'IR-10', - 'CCI-002823': 'SI-16', - 'CCI-002824': 'SI-16', - 'CCI-002825': 'CP-1 a 1 (a)', - 'CCI-002826': 'CP-1 a 2', - 'CCI-002827': 'CP-2 (7)', - 'CCI-002828': 'CP-2 (8)', - 'CCI-002829': 'CP-2 (8)', - 'CCI-002830': 'CP-2 a 7', - 'CCI-002831': 'CP-2 f', - 'CCI-002832': 'CP-2 h', - 'CCI-002833': 'CP-3 a 1', - 'CCI-002834': 'CP-3 a 2', - 'CCI-002835': 'CP-4 (2) (b)', - 'CCI-002836': 'CP-6 b', - 'CCI-002837': 'CP-7 (6)', - 'CCI-002838': 'CP-7 (6)', - 'CCI-002839': 'CP-7 a', - 'CCI-002840': 'CP-8', - 'CCI-002841': 'CP-8', - 'CCI-002842': 'CP-8 (4) (b)', - 'CCI-002843': 'CP-8 (4) (c)', - 'CCI-002844': 'CP-8 (4) (c)', - 'CCI-002845': 'CP-8 (4) (c)', - 'CCI-002846': 'CP-8 (4) (c)', - 'CCI-002847': 'CP-8 (5)', - 'CCI-002848': 'CP-8 (5)', - 'CCI-002849': 'CP-9 (3)', - 'CCI-002850': 'CP-9 (3)', - 'CCI-002851': 'CP-9 (7)', - 'CCI-002852': 'CP-9 (7)', - 'CCI-002853': 'CP-11', - 'CCI-002854': 'CP-11', - 'CCI-002855': 'CP-12', - 'CCI-002856': 'CP-12', - 'CCI-002857': 'CP-12', - 'CCI-002858': 'CP-13', - 'CCI-002859': 'CP-13', - 'CCI-002860': 'CP-13', - 'CCI-002861': 'MA-1 a 1 (a)', - 'CCI-002862': 'MA-1 a 2', - 'CCI-002863': 'MA-2 (2) (a)', - 'CCI-002864': 'MA-2 (2) (b)', - 'CCI-002865': 'MA-2 (2) (b)', - 'CCI-002866': 'MA-2 a', - 'CCI-002867': 'MA-2 a', - 'CCI-002868': 'MA-2 a', - 'CCI-002869': 'MA-2 a', - 'CCI-002870': 'MA-2 a', - 'CCI-002871': 'MA-2 a', - 'CCI-002872': 'MA-2 a', - 'CCI-002873': 'MA-2 a', - 'CCI-002874': 'MA-2 c', - 'CCI-002875': 'MA-2 f', - 'CCI-002876': 'MA-2 f', - 'CCI-002877': 'MA-3 (3) (a)', - 'CCI-002878': 'MA-3 (3) (b)', - 'CCI-002879': 'MA-3 (3) (c)', - 'CCI-002880': 'MA-3 (3) (c)', - 'CCI-002881': 'MA-3 (3) (d)', - 'CCI-002882': 'MA-3 (3) (d)', - 'CCI-002883': 'MA-3 (4)', - 'CCI-002884': 'MA-4 (1) (a)', - 'CCI-002885': 'MA-4 (1) (a)', - 'CCI-002886': 'MA-4 (1) (b)', - 'CCI-002887': 'MA-4 (4) (a)', - 'CCI-002888': 'MA-4 (5) (a)', - 'CCI-002889': 'MA-4 (5) (b)', - 'CCI-002890': 'MA-4 (6)', - 'CCI-002891': 'MA-4 (7)', - 'CCI-002892': 'MA-5 (1) (b)', - 'CCI-002893': 'MA-5 (5)', - 'CCI-002894': 'MA-5 b', - 'CCI-002895': 'MA-5 c', - 'CCI-002896': 'MA-6', - 'CCI-002897': 'MA-6', - 'CCI-002898': 'MA-6 (1)', - 'CCI-002899': 'MA-6 (1)', - 'CCI-002900': 'MA-6 (1)', - 'CCI-002901': 'MA-6 (2)', - 'CCI-002902': 'MA-6 (2)', - 'CCI-002903': 'MA-6 (2)', - 'CCI-002904': 'MA-6 (3)', - 'CCI-002905': 'MA-2 (2) (a)', - 'CCI-002906': 'RA-5 (5)', - 'CCI-002907': 'AU-5 (4)', - 'CCI-002908': 'PE-1 a 1', - 'CCI-002909': 'PE-1 a 2', - 'CCI-002910': 'PE-2 a', - 'CCI-002911': 'PE-2 a', - 'CCI-002912': 'PE-2 (2)', - 'CCI-002913': 'PE-2 (3)', - 'CCI-002914': 'PE-2 (3)', - 'CCI-002915': 'PE-3 a', - 'CCI-002916': 'PE-3 a 2', - 'CCI-002917': 'PE-3 b', - 'CCI-002918': 'PE-3 b', - 'CCI-002919': 'PE-3 c', - 'CCI-002920': 'PE-3 c', - 'CCI-002921': 'PE-3 d', - 'CCI-002922': 'PE-3 d', - 'CCI-002923': 'PE-3 d', - 'CCI-002924': 'PE-3 d', - 'CCI-002925': 'PE-3 f', - 'CCI-002926': 'PE-3 (1)', - 'CCI-002927': 'PE-3 (2)', - 'CCI-002928': 'PE-3 (5)', - 'CCI-002929': 'PE-3 (5)', - 'CCI-002930': 'PE-4', - 'CCI-002931': 'PE-4', - 'CCI-002932': 'PE-5 (1) (a)', - 'CCI-002933': 'PE-5 (1) (a)', - 'CCI-002934': 'PE-5 (1) (b)', - 'CCI-002935': 'PE-5 (2) (a)', - 'CCI-002936': 'PE-5 (2) (b)', - 'CCI-002937': 'PE-5 (3)', - 'CCI-002938': 'PE-5 (3)', - 'CCI-002939': 'PE-6 a', - 'CCI-002940': 'PE-6 b', - 'CCI-002941': 'PE-6 b', - 'CCI-002942': 'PE-6 (2)', - 'CCI-002943': 'PE-6 (2)', - 'CCI-002944': 'PE-6 (2)', - 'CCI-002945': 'PE-6 (2)', - 'CCI-002946': 'PE-6 (3) (a)', - 'CCI-002947': 'PE-6 (3) (a)', - 'CCI-002948': 'PE-6 (3) (c)', - 'CCI-002949': 'PE-6 (3) (c)', - 'CCI-002950': 'PE-6 (4)', - 'CCI-002951': 'PE-6 (4)', - 'CCI-002952': 'PE-8 a', - 'CCI-002953': 'PE-9 (1)', - 'CCI-002954': 'PE-9 (1)', - 'CCI-002955': 'PE-11', - 'CCI-002956': 'PE-11 (2) (a)', - 'CCI-002957': 'PE-11 (2) (b)', - 'CCI-002958': 'PE-11 (2) (c)', - 'CCI-002959': 'PE-12 (1)', - 'CCI-002960': 'PE-12 (1)', - 'CCI-002961': 'PE-13 (1)', - 'CCI-002962': 'PE-13 (1)', - 'CCI-002963': 'PE-13 (1)', - 'CCI-002964': 'PE-13 (1)', - 'CCI-002965': 'PE-13 (2) (a)', - 'CCI-002966': 'PE-13 (2) (a)', - 'CCI-002967': 'PE-13 (2) (a)', - 'CCI-002968': 'PE-13 (4)', - 'CCI-002969': 'PE-13 (4)', - 'CCI-002970': 'PE-13 (4)', - 'CCI-002971': 'PE-13 (4)', - 'CCI-002972': 'PE-15 (1)', - 'CCI-002973': 'PE-15 (1)', - 'CCI-002974': 'PE-16 a', - 'CCI-002975': 'PE-17 b', - 'CCI-002976': 'PE-18', - 'CCI-002977': 'PE-18 (1)', - 'CCI-002978': 'PE-18 (1)', - 'CCI-002979': 'PE-20', - 'CCI-002980': 'PE-20', - 'CCI-002981': 'PE-20', - 'CCI-002982': 'PE-20', - 'CCI-002983': 'PE-20 b', - 'CCI-002984': 'PM-1 a 3', - 'CCI-002985': 'PM-1 a 1', - 'CCI-002986': 'PM-1 a 2', - 'CCI-002987': 'PM-1 a 3', - 'CCI-002988': 'PM-1 a 4', - 'CCI-002989': 'PM-1 c', - 'CCI-002990': 'PM-1 c', - 'CCI-002991': 'PM-4 a 1', - 'CCI-002992': 'PM-4 a 3', - 'CCI-002993': 'PM-4 b', - 'CCI-002994': 'PM-9 c', - 'CCI-002995': 'PM-9 c', - 'CCI-002996': 'PM-12', - 'CCI-002997': 'PM-13', - 'CCI-002998': 'PM-14 a 1', - 'CCI-002999': 'PM-14 a 1', - 'CCI-003000': 'PM-14 a 1', - 'CCI-003001': 'PM-14 a 1', - 'CCI-003002': 'PM-14 a 1', - 'CCI-003003': 'PM-14 a 1', - 'CCI-003004': 'PM-14 a 2', - 'CCI-003005': 'PM-14 a 2', - 'CCI-003006': 'PM-14 a 2', - 'CCI-003007': 'PM-14 b', - 'CCI-003008': 'PM-14 b', - 'CCI-003009': 'PM-14 b', - 'CCI-003010': 'PM-15 a', - 'CCI-003011': 'PM-15 b', - 'CCI-003012': 'PM-15 c', - 'CCI-003013': 'PM-16', - 'CCI-003014': 'AC-3 (3)', - 'CCI-003015': 'AC-3 (3) (c)', - 'CCI-003016': 'PS-4 f', - 'CCI-003017': 'PS-1 a 1', - 'CCI-003018': 'PS-1 a 2', - 'CCI-003019': 'PS-3 (3) (a)', - 'CCI-003020': 'PS-3 (3) (b)', - 'CCI-003021': 'PS-3 (3) (b)', - 'CCI-003022': 'PS-4 a', - 'CCI-003023': 'PS-4 b', - 'CCI-003024': 'PS-4 c', - 'CCI-003025': 'PS-4 f', - 'CCI-003026': 'PS-4 f', - 'CCI-003027': 'PS-4 (1) (a)', - 'CCI-003028': 'PS-4 (1) (b)', - 'CCI-003029': 'PS-4 (2)', - 'CCI-003030': 'PS-4 (2)', - 'CCI-003031': 'PS-5 c', - 'CCI-003032': 'PS-5 d', - 'CCI-003033': 'PS-5 d', - 'CCI-003034': 'PS-5 d', - 'CCI-003035': 'PS-6 a', - 'CCI-003036': 'PS-6 c 2', - 'CCI-003037': 'PS-6 c 2', - 'CCI-003038': 'PS-6 (3) (a)', - 'CCI-003039': 'PS-6 (3) (b)', - 'CCI-003040': 'PS-7 b', - 'CCI-003041': 'PS-7 d', - 'CCI-003042': 'PS-7 d', - 'CCI-003043': 'PS-7 d', - 'CCI-003044': 'PS-8 b', - 'CCI-003045': 'PS-8 b', - 'CCI-003046': 'PS-8 b', - 'CCI-003047': 'PL-1 a 1 (a)', - 'CCI-003048': 'PL-1 a 2', - 'CCI-003049': 'PL-2 a', - 'CCI-003050': 'PL-2 a 1', - 'CCI-003051': 'PL-2 a 2', - 'CCI-003052': 'PL-2 a 3', - 'CCI-003053': 'PL-2 a 6', - 'CCI-003054': 'PL-2 a 9', - 'CCI-003055': 'PL-2 a 10', - 'CCI-003056': 'PL-2 a 11', - 'CCI-003057': 'PL-2 a 12', - 'CCI-003058': 'PL-2 b', - 'CCI-003059': 'PL-2 b', - 'CCI-003060': 'PL-2 b', - 'CCI-003061': 'PL-2 b', - 'CCI-003062': 'PL-2 b', - 'CCI-003063': 'PL-2 e', - 'CCI-003064': 'PL-2 e', - 'CCI-003065': 'PL-2 (3)', - 'CCI-003066': 'PL-2 (3)', - 'CCI-003067': 'PL-2 (3)', - 'CCI-003068': 'PL-4 c', - 'CCI-003069': 'PL-4 c', - 'CCI-003070': 'PL-4 d', - 'CCI-003071': 'PL-7 a', - 'CCI-003072': 'PL-8 a', - 'CCI-003073': 'PL-8 a 1', - 'CCI-003074': 'PL-8 a 3', - 'CCI-003075': 'PL-8 a 4', - 'CCI-003076': 'PL-8 b', - 'CCI-003077': 'PL-8 b', - 'CCI-003078': 'PL-8 c', - 'CCI-003079': 'PL-8 c', - 'CCI-003080': 'PL-8 c', - 'CCI-003081': 'PL-8 (1) (a)', - 'CCI-003082': 'PL-8 (1) (a)', - 'CCI-003083': 'PL-8 (1) (a)', - 'CCI-003084': 'PL-8 (1) (a)', - 'CCI-003085': 'PL-8 (1) (a)', - 'CCI-003086': 'PL-8 (1) (a)', - 'CCI-003087': 'PL-8 (1) (b)', - 'CCI-003088': 'PL-8 (2)', - 'CCI-003089': 'SA-1 a 1 (a)', - 'CCI-003090': 'SA-1 a 2', - 'CCI-003091': 'SA-2 a', - 'CCI-003092': 'SA-3 a', - 'CCI-003093': 'SA-3 d', - 'CCI-003094': 'SA-4 a', - 'CCI-003095': 'SA-4 b', - 'CCI-003096': 'SA-4 c', - 'CCI-003097': 'SA-4 e', - 'CCI-003098': 'SA-4 f', - 'CCI-003099': 'SA-4 g', - 'CCI-003100': 'SA-4 i', - 'CCI-003101': 'SA-4 (2)', - 'CCI-003102': 'SA-4 (2)', - 'CCI-003103': 'SA-4 (2)', - 'CCI-003104': 'SA-4 (2)', - 'CCI-003105': 'SA-4 (2)', - 'CCI-003106': 'SA-4 (2)', - 'CCI-003107': 'SA-4 (3)', - 'CCI-003108': 'SA-4 (3)', - 'CCI-003109': 'SA-4 (5) (a)', - 'CCI-003110': 'SA-4 (5) (a)', - 'CCI-003111': 'SA-4 (5) (b)', - 'CCI-003112': 'SA-4 (8)', - 'CCI-003113': 'SA-4 (8)', - 'CCI-003114': 'SA-4 (9)', - 'CCI-003115': 'SA-4 (9)', - 'CCI-003116': 'SA-4 (10)', - 'CCI-003117': 'PL-9', - 'CCI-003118': 'PL-9', - 'CCI-003119': 'RA-6', - 'CCI-003120': 'RA-6', - 'CCI-003121': 'RA-6', - 'CCI-003122': 'RA-6', - 'CCI-003123': 'MA-4 (6)', - 'CCI-003124': 'SA-5 a 1', - 'CCI-003125': 'SA-5 a 1', - 'CCI-003126': 'SA-5 a 1', - 'CCI-003127': 'SA-5 a 2', - 'CCI-003128': 'SA-5 a 3', - 'CCI-003129': 'SA-5 b 1', - 'CCI-003130': 'SA-5 b 2', - 'CCI-003131': 'SA-5 b 3', - 'CCI-003132': 'SA-5 c', - 'CCI-003133': 'SA-5 c', - 'CCI-003134': 'SA-5 d', - 'CCI-003135': 'SA-5 d', - 'CCI-003136': 'SA-5 d', - 'CCI-003137': 'SA-9 a', - 'CCI-003138': 'SA-9 c', - 'CCI-003139': 'SA-9 c', - 'CCI-003140': 'SA-9 (1) (a)', - 'CCI-003141': 'SA-9 (1) (b)', - 'CCI-003142': 'SA-9 (1) (b)', - 'CCI-003143': 'SA-9 (2)', - 'CCI-003144': 'SA-9 (2)', - 'CCI-003145': 'SA-9 (3)', - 'CCI-003146': 'SA-9 (3)', - 'CCI-003147': 'SA-9 (3)', - 'CCI-003148': 'SA-9 (3)', - 'CCI-003149': 'SA-9 (4)', - 'CCI-003150': 'SA-9 (4)', - 'CCI-003151': 'SA-9 (4)', - 'CCI-003152': 'SA-9 (5)', - 'CCI-003153': 'SA-9 (5)', - 'CCI-003154': 'SA-9 (5)', - 'CCI-003155': 'SA-10 a', - 'CCI-003156': 'SA-10 b', - 'CCI-003157': 'SA-10 b', - 'CCI-003158': 'SA-10 b', - 'CCI-003159': 'SA-10 b', - 'CCI-003160': 'SA-10 d', - 'CCI-003161': 'SA-10 e', - 'CCI-003162': 'SA-10 e', - 'CCI-003163': 'SA-10 e', - 'CCI-003164': 'SA-10 e', - 'CCI-003165': 'SA-10 (3)', - 'CCI-003166': 'SA-10 (4)', - 'CCI-003167': 'SA-10 (4)', - 'CCI-003168': 'SA-10 (4)', - 'CCI-003169': 'SA-10 (5)', - 'CCI-003170': 'SA-10 (6)', - 'CCI-003171': 'SA-11 a', - 'CCI-003172': 'SA-11 a', - 'CCI-003173': 'SA-11 b', - 'CCI-003174': 'SA-11 b', - 'CCI-003175': 'SA-11 c', - 'CCI-003176': 'SA-11 c', - 'CCI-003177': 'SA-11 d', - 'CCI-003178': 'SA-11 e', - 'CCI-003179': 'SA-11 (1)', - 'CCI-003180': 'SA-11 (1)', - 'CCI-003181': 'SA-11 (2)', - 'CCI-003182': 'SA-11 (2)', - 'CCI-003183': 'SA-11 (3) (a)', - 'CCI-003184': 'SA-11 (3) (a)', - 'CCI-003185': 'SA-11 (3) (a)', - 'CCI-003186': 'SA-11 (3) (b)', - 'CCI-003187': 'SA-11 (4)', - 'CCI-003188': 'SA-11 (4)', - 'CCI-003189': 'SA-11 (4)', - 'CCI-003190': 'SA-11 (5)', - 'CCI-003191': 'SA-11 (5) (a)', - 'CCI-003192': 'SA-11 (5) (b)', - 'CCI-003193': 'SA-11 (6)', - 'CCI-003194': 'SA-11 (7)', - 'CCI-003195': 'SA-11 (7)', - 'CCI-003196': 'SA-11 (8)', - 'CCI-003197': 'SA-11 (8)', - 'CCI-003198': 'SA-12 (1)', - 'CCI-003199': 'SA-12 (1)', - 'CCI-003200': 'SA-12 (2)', - 'CCI-003201': 'SA-12 (5)', - 'CCI-003202': 'SA-12 (5)', - 'CCI-003203': 'SA-12 (7)', - 'CCI-003204': 'SA-12 (7)', - 'CCI-003205': 'SA-12 (8)', - 'CCI-003206': 'SA-12 (9)', - 'CCI-003207': 'SA-12 (1)', - 'CCI-003208': 'SA-12 (1)', - 'CCI-003209': 'SA-12 (1)', - 'CCI-003210': 'SA-12 (9)', - 'CCI-003211': 'SA-12 (9)', - 'CCI-003212': 'SA-12 (10)', - 'CCI-003213': 'SA-12 (10)', - 'CCI-003214': 'SA-12 (11)', - 'CCI-003215': 'SA-12 (11)', - 'CCI-003216': 'SA-12 (12)', - 'CCI-003217': 'SA-12 (12)', - 'CCI-003218': 'SA-12 (13)', - 'CCI-003219': 'SA-12 (13)', - 'CCI-003220': 'SA-12 (13)', - 'CCI-003221': 'SA-12 (14)', - 'CCI-003222': 'SA-12 (14)', - 'CCI-003223': 'SA-12 (14)', - 'CCI-003224': 'SA-12 (15)', - 'CCI-003225': 'SA-13 a', - 'CCI-003226': 'SA-13 a', - 'CCI-003227': 'SA-13 b', - 'CCI-003228': 'SA-13 b', - 'CCI-003229': 'SA-14', - 'CCI-003230': 'SA-14', - 'CCI-003231': 'SA-14', - 'CCI-003232': 'SA-14', - 'CCI-003233': 'SA-15 a', - 'CCI-003234': 'SA-15 a 1', - 'CCI-003235': 'SA-15 a 2', - 'CCI-003236': 'SA-15 a 2', - 'CCI-003237': 'SA-15 a 3', - 'CCI-003238': 'SA-15 a 4', - 'CCI-003239': 'SA-15 a 4', - 'CCI-003240': 'SA-15 a 4', - 'CCI-003241': 'SA-15 b', - 'CCI-003242': 'SA-15 b', - 'CCI-003243': 'SA-15 b', - 'CCI-003244': 'SA-15 b', - 'CCI-003245': 'SA-15 b', - 'CCI-003246': 'SA-15 b', - 'CCI-003247': 'SA-15 (1) (a)', - 'CCI-003248': 'SA-15 (1) (b)', - 'CCI-003249': 'SA-15 (1) (b)', - 'CCI-003250': 'SA-15 (1) (b)', - 'CCI-003251': 'SA-15 (2)', - 'CCI-003252': 'SA-15 (2)', - 'CCI-003253': 'SA-15 (3)', - 'CCI-003254': 'SA-15 (3) (b)', - 'CCI-003255': 'SA-15 (3) (a)', - 'CCI-003256': 'SA-15 (4)', - 'CCI-003257': 'SA-15 (4)', - 'CCI-003258': 'SA-15 (4)', - 'CCI-003259': 'SA-15 (4)', - 'CCI-003260': 'SA-15 (4) (a)', - 'CCI-003261': 'SA-15 (4) (a)', - 'CCI-003262': 'SA-15 (4) (a)', - 'CCI-003263': 'SA-15 (4) (a)', - 'CCI-003264': 'SA-15 (4) (b)', - 'CCI-003265': 'SA-15 (4) (b)', - 'CCI-003266': 'SA-15 (4) (b)', - 'CCI-003267': 'SA-15 (4) (b)', - 'CCI-003268': 'SA-15 (4) (c)', - 'CCI-003269': 'SA-15 (4) (c)', - 'CCI-003270': 'SA-15 (4) (c)', - 'CCI-003271': 'SA-15 (4) (c)', - 'CCI-003272': 'SA-15 (5)', - 'CCI-003273': 'SA-15 (5)', - 'CCI-003274': 'SA-15 (6)', - 'CCI-003275': 'SA-15 (7) (a)', - 'CCI-003276': 'SA-15 (7) (a)', - 'CCI-003277': 'SA-15 (7) (b)', - 'CCI-003278': 'SA-15 (7) (c)', - 'CCI-003279': 'SA-15 (7) (d)', - 'CCI-003280': 'SA-15 (7) (d)', - 'CCI-003281': 'SA-15 (8)', - 'CCI-003282': 'SA-15 (8)', - 'CCI-003283': 'SA-15 (9)', - 'CCI-003284': 'SA-15 (9)', - 'CCI-003285': 'SA-15 (9)', - 'CCI-003286': 'SA-15 (9)', - 'CCI-003287': 'SA-15 (9)', - 'CCI-003288': 'SA-15 (9)', - 'CCI-003289': 'SA-15 (10)', - 'CCI-003290': 'SA-15 (11)', - 'CCI-003291': 'SA-16', - 'CCI-003292': 'SA-16', - 'CCI-003293': 'SA-17', - 'CCI-003294': 'SA-17 a', - 'CCI-003295': 'SA-17 b', - 'CCI-003296': 'SA-17 b', - 'CCI-003297': 'SA-17 c', - 'CCI-003298': 'SA-17 (1) (a)', - 'CCI-003299': 'SA-17 (1) (a)', - 'CCI-003300': 'SA-17 (1) (b)', - 'CCI-003301': 'SA-17 (2) (a)', - 'CCI-003302': 'SA-17 (2) (a)', - 'CCI-003303': 'SA-17 (2) (a)', - 'CCI-003304': 'SA-17 (2) (a)', - 'CCI-003305': 'SA-17 (2) (b)', - 'CCI-003306': 'SA-17 (2) (b)', - 'CCI-003307': 'SA-17 (2) (b)', - 'CCI-003308': 'SA-17 (3) (a)', - 'CCI-003309': 'SA-17 (3) (a)', - 'CCI-003310': 'SA-17 (3) (a)', - 'CCI-003311': 'SA-17 (3) (b)', - 'CCI-003312': 'SA-17 (3) (c)', - 'CCI-003313': 'SA-17 (3) (c)', - 'CCI-003314': 'SA-17 (3) (c)', - 'CCI-003315': 'SA-17 (3) (d)', - 'CCI-003316': 'SA-17 (3) (d)', - 'CCI-003317': 'SA-17 (3) (d)', - 'CCI-003318': 'SA-17 (3) (e)', - 'CCI-003319': 'SA-17 (3) (e)', - 'CCI-003320': 'SA-17 (3) (e)', - 'CCI-003321': 'SA-17 (4) (a)', - 'CCI-003322': 'SA-17 (4) (a)', - 'CCI-003323': 'SA-17 (4) (a)', - 'CCI-003324': 'SA-17 (4) (b)', - 'CCI-003325': 'SA-17 (4) (c)', - 'CCI-003326': 'SA-17 (4) (c)', - 'CCI-003327': 'SA-17 (4) (c)', - 'CCI-003328': 'SA-17 (4) (d)', - 'CCI-003329': 'SA-17 (4) (d)', - 'CCI-003330': 'SA-17 (4) (d)', - 'CCI-003331': 'SA-17 (4) (e)', - 'CCI-003332': 'SA-17 (4) (e)', - 'CCI-003333': 'SA-17 (4) (e)', - 'CCI-003334': 'SA-17 (5) (a)', - 'CCI-003335': 'SA-17 (5) (a)', - 'CCI-003336': 'SA-17 (5) (a)', - 'CCI-003337': 'SA-17 (5) (b)', - 'CCI-003338': 'SA-17 (5) (b)', - 'CCI-003339': 'SA-17 (5) (b)', - 'CCI-003340': 'SA-17 (6)', - 'CCI-003341': 'SA-17 (6)', - 'CCI-003342': 'SA-17 (6)', - 'CCI-003343': 'SA-17 (7)', - 'CCI-003344': 'SA-17 (7)', - 'CCI-003345': 'SA-17 (7)', - 'CCI-003346': 'SA-18', - 'CCI-003347': 'SA-18 (1)', - 'CCI-003348': 'SA-18 (1)', - 'CCI-003349': 'SA-18 (1)', - 'CCI-003350': 'SA-18 (1)', - 'CCI-003351': 'SA-18 (1)', - 'CCI-003352': 'SA-18 (2)', - 'CCI-003353': 'SA-18 (2)', - 'CCI-003354': 'SA-18 (2)', - 'CCI-003355': 'SA-18 (2)', - 'CCI-003356': 'SA-19 a', - 'CCI-003357': 'SA-19 a', - 'CCI-003358': 'SA-19 a', - 'CCI-003359': 'SA-19 a', - 'CCI-003360': 'SA-19 a', - 'CCI-003361': 'SA-19 a', - 'CCI-003362': 'SA-19 a', - 'CCI-003363': 'SA-19 a', - 'CCI-003364': 'SA-19 b', - 'CCI-003365': 'SA-19 b', - 'CCI-003366': 'SA-19 b', - 'CCI-003367': 'SA-19 (1)', - 'CCI-003368': 'SA-19 (1)', - 'CCI-003369': 'SA-19 (2)', - 'CCI-003370': 'SA-19 (2)', - 'CCI-003371': 'SA-19 (2)', - 'CCI-003372': 'SA-22 b', - 'CCI-003373': 'SA-22 b', - 'CCI-003374': 'SA-22 b', - 'CCI-003375': 'SA-22 b', - 'CCI-003376': 'SA-22 a', - 'CCI-003377': 'SA-21 (1)', - 'CCI-003378': 'SA-21 (1)', - 'CCI-003379': 'SA-21 (1)', - 'CCI-003380': 'SA-21 (1)', - 'CCI-003381': 'SA-21 b', - 'CCI-003382': 'SA-21 b', - 'CCI-003383': 'SA-21 a', - 'CCI-003384': 'SA-21', - 'CCI-003385': 'SA-21 a', - 'CCI-003386': 'SA-20', - 'CCI-003387': 'SA-20', - 'CCI-003388': 'SA-19 (4)', - 'CCI-003389': 'SA-19 (4)', - 'CCI-003390': 'SA-19 (3)', - 'CCI-003391': 'SA-19 (3)', - 'CCI-003392': 'AP-1', - 'CCI-003393': 'AP-1', - 'CCI-003394': 'AP-1', - 'CCI-003395': 'AP-1', - 'CCI-003396': 'AP-2', - 'CCI-003397': 'AR-1 a', - 'CCI-003398': 'AP-2', - 'CCI-003399': 'AP-2', - 'CCI-003400': 'AP-2', - 'CCI-003401': 'AR-1 b', - 'CCI-003402': 'AR-1 c', - 'CCI-003403': 'AR-1 c', - 'CCI-003404': 'AR-1 c', - 'CCI-003405': 'AR-1 c', - 'CCI-003406': 'AR-1 d', - 'CCI-003407': 'AR-1 e', - 'CCI-003408': 'AR-1 e', - 'CCI-003409': 'AR-1 e', - 'CCI-003410': 'AR-1 e', - 'CCI-003411': 'AR-1 e', - 'CCI-003412': 'AR-1 e', - 'CCI-003413': 'AR-1 f', - 'CCI-003414': 'AR-1 f', - 'CCI-003415': 'AR-1 f', - 'CCI-003416': 'AR-1 f', - 'CCI-003417': 'AR-2 a', - 'CCI-003418': 'AR-2 a', - 'CCI-003419': 'AR-2 a', - 'CCI-003420': 'AR-2 a', - 'CCI-003421': 'AR-2 a', - 'CCI-003422': 'AR-2 a', - 'CCI-003423': 'AR-2 a', - 'CCI-003424': 'AR-2 a', - 'CCI-003425': 'AR-2 b', - 'CCI-003426': 'AR-3 a', - 'CCI-003427': 'AR-3 a', - 'CCI-003428': 'AR-3 a', - 'CCI-003429': 'AR-3 a', - 'CCI-003430': 'AR-3 a', - 'CCI-003431': 'AR-3 a', - 'CCI-003432': 'AR-3 b', - 'CCI-003433': 'AR-3 b', - 'CCI-003434': 'AR-4', - 'CCI-003435': 'AR-4', - 'CCI-003436': 'AR-4', - 'CCI-003437': 'AR-4', - 'CCI-003438': 'AR-4', - 'CCI-003439': 'AR-4', - 'CCI-003440': 'AR-5 a', - 'CCI-003441': 'AR-5 a', - 'CCI-003442': 'AR-5 a', - 'CCI-003443': 'AR-5 b', - 'CCI-003444': 'AR-5 b', - 'CCI-003445': 'AR-5 b', - 'CCI-003446': 'AR-5 b', - 'CCI-003447': 'AR-5 c', - 'CCI-003448': 'AR-5 c', - 'CCI-003449': 'AR-6', - 'CCI-003450': 'AR-6', - 'CCI-003451': 'AR-6', - 'CCI-003452': 'AR-6', - 'CCI-003453': 'AR-6', - 'CCI-003454': 'AR-6', - 'CCI-003455': 'AR-7', - 'CCI-003456': 'AR-8 a (1)', - 'CCI-003457': 'AR-8 a (1)', - 'CCI-003458': 'AR-8 a (1)', - 'CCI-003459': 'AR-8 a (1)', - 'CCI-003460': 'AR-8 a (2)', - 'CCI-003461': 'AR-8 b', - 'CCI-003462': 'AR-8 c', - 'CCI-003463': 'DI-1 a', - 'CCI-003464': 'DI-1 a', - 'CCI-003465': 'DI-1 a', - 'CCI-003466': 'DI-1 a', - 'CCI-003467': 'DI-1 b', - 'CCI-003468': 'DI-1 c', - 'CCI-003469': 'DI-1 c', - 'CCI-003470': 'DI-1 d', - 'CCI-003471': 'DI-1 d', - 'CCI-003472': 'DI-1 d', - 'CCI-003473': 'DI-1 d', - 'CCI-003474': 'DI-1 d', - 'CCI-003475': 'DI-1 d', - 'CCI-003476': 'DI-1 d', - 'CCI-003477': 'DI-1 d', - 'CCI-003478': 'DI-1 (1)', - 'CCI-003479': 'DI-1 (2)', - 'CCI-003480': 'DI-1 (2)', - 'CCI-003481': 'DI-2 a', - 'CCI-003482': 'DI-2 b', - 'CCI-003483': 'DI-2 b', - 'CCI-003484': 'DI-2 b', - 'CCI-003485': 'DI-2 (1)', - 'CCI-003486': 'DM-1 a', - 'CCI-003487': 'DM-1 b', - 'CCI-003488': 'DM-1 b', - 'CCI-003489': 'DM-1 c', - 'CCI-003490': 'DM-1 c', - 'CCI-003491': 'DM-1 c', - 'CCI-003492': 'DM-1 c', - 'CCI-003493': 'DM-1 c', - 'CCI-003494': 'DM-1 c', - 'CCI-003495': 'DM-1 (1)', - 'CCI-003496': 'DM-1 (1)', - 'CCI-003497': 'DM-2 a', - 'CCI-003498': 'DM-2 a', - 'CCI-003499': 'DM-2 b', - 'CCI-003500': 'DM-2 b', - 'CCI-003501': 'DM-2 c', - 'CCI-003502': 'DM-2 c', - 'CCI-003503': 'DM-2 (1)', - 'CCI-003504': 'DM-2 (1)', - 'CCI-003505': 'DM-2 (1)', - 'CCI-003506': 'DM-2 (1)', - 'CCI-003507': 'DM-3 a', - 'CCI-003508': 'DM-3 a', - 'CCI-003509': 'DM-3 a', - 'CCI-003510': 'DM-3 a', - 'CCI-003511': 'DM-3 a', - 'CCI-003512': 'DM-3 a', - 'CCI-003513': 'DM-3 b', - 'CCI-003514': 'DM-3 b', - 'CCI-003515': 'DM-3 b', - 'CCI-003516': 'DM-3 (1)', - 'CCI-003517': 'DM-3 (1)', - 'CCI-003518': 'DM-3 (1)', - 'CCI-003519': 'IP-1 a', - 'CCI-003520': 'IP-1 a', - 'CCI-003521': 'IP-1 a', - 'CCI-003522': 'IP-1 a', - 'CCI-003523': 'IP-1 b', - 'CCI-003524': 'IP-1 b', - 'CCI-003525': 'IP-1 b', - 'CCI-003526': 'IP-1 b', - 'CCI-003527': 'IP-1 c', - 'CCI-003528': 'IP-1 d', - 'CCI-003529': 'IP-1 d', - 'CCI-003530': 'IP-1 (1)', - 'CCI-003531': 'IP-2 a', - 'CCI-003532': 'IP-2 b', - 'CCI-003533': 'IP-2 b', - 'CCI-003534': 'IP-2 c', - 'CCI-003535': 'IP-2 d', - 'CCI-003536': 'IP-2 d', - 'CCI-003537': 'IP-3 a', - 'CCI-003538': 'IP-3 b', - 'CCI-003539': 'IP-3 b', - 'CCI-003540': 'IP-4', - 'CCI-003541': 'IP-4', - 'CCI-003542': 'IP-4 (1)', - 'CCI-003543': 'IP-4 (1)', - 'CCI-003544': 'SE-1 a', - 'CCI-003545': 'SE-1 a', - 'CCI-003546': 'SE-1 a', - 'CCI-003547': 'SE-1 a', - 'CCI-003548': 'SE-1 a', - 'CCI-003549': 'SE-1 a', - 'CCI-003550': 'SE-1 a', - 'CCI-003551': 'SE-1 b', - 'CCI-003552': 'SE-1 b', - 'CCI-003553': 'SE-2 a', - 'CCI-003554': 'SE-2 a', - 'CCI-003555': 'SE-2 b', - 'CCI-003556': 'TR-1 a', - 'CCI-003557': 'TR-1 a', - 'CCI-003558': 'TR-1 a', - 'CCI-003559': 'TR-1 a', - 'CCI-003560': 'TR-1 a', - 'CCI-003561': 'TR-1 a', - 'CCI-003562': 'TR-1 a', - 'CCI-003563': 'TR-1 a', - 'CCI-003564': 'TR-1 a', - 'CCI-003565': 'TR-1 a', - 'CCI-003566': 'TR-1 a', - 'CCI-003567': 'TR-1 a', - 'CCI-003568': 'TR-1 b', - 'CCI-003569': 'TR-1 b', - 'CCI-003570': 'TR-1 b', - 'CCI-003571': 'TR-1 b', - 'CCI-003572': 'TR-1 b', - 'CCI-003573': 'TR-1 b', - 'CCI-003574': 'TR-1 b', - 'CCI-003575': 'TR-1 b', - 'CCI-003576': 'TR-1 b', - 'CCI-003577': 'TR-1 b', - 'CCI-003578': 'TR-1 c', - 'CCI-003579': 'TR-1 c', - 'CCI-003580': 'TR-1 (1)', - 'CCI-003581': 'TR-2 a', - 'CCI-003582': 'TR-2 b', - 'CCI-003583': 'TR-2 c', - 'CCI-003584': 'TR-2 (1)', - 'CCI-003585': 'TR-3 a', - 'CCI-003586': 'TR-3 a', - 'CCI-003587': 'TR-3 b', - 'CCI-003588': 'UL-1', - 'CCI-003589': 'UL-2 a', - 'CCI-003590': 'UL-2 b', - 'CCI-003591': 'UL-2 b', - 'CCI-003592': 'UL-2 c', - 'CCI-003593': 'UL-2 c', - 'CCI-003594': 'UL-2 c', - 'CCI-003595': 'UL-2 c', - 'CCI-003596': 'UL-2 d', - 'CCI-003597': 'UL-2 d', - 'CCI-003598': 'TR-1 b', - 'CCI-003599': 'SC-37', - 'CCI-003601': 'AC-1 a 1 (b)', - 'CCI-003602': 'AC-1 a 1 (a)', - 'CCI-003603': 'AC-1 a 1 (b)', - 'CCI-003604': 'AC-1 a 2', - 'CCI-003605': 'AC-1 b', - 'CCI-003606': 'AC-1 b', - 'CCI-003607': 'AC-1 b', - 'CCI-003608': 'AC-1 c 1', - 'CCI-003609': 'AC-1 c 1', - 'CCI-003610': 'AC-1 c 2', - 'CCI-003611': 'AC-1 c 2', - 'CCI-003612': 'AC-2 a', - 'CCI-003613': 'AC-2 c', - 'CCI-003614': 'AC-2 c', - 'CCI-003615': 'AC-2 c', - 'CCI-003616': 'AC-2 d 3', - 'CCI-003617': 'AC-2 f', - 'CCI-003618': 'AC-2 f', - 'CCI-003619': 'AC-2 f', - 'CCI-003620': 'AC-2 f', - 'CCI-003621': 'AC-2 f', - 'CCI-003622': 'AC-2 f', - 'CCI-003623': 'AC-2 h', - 'CCI-003624': 'AC-2 h', - 'CCI-003625': 'AC-2 i 3', - 'CCI-003626': 'AC-2 l', - 'CCI-003627': 'AC-2 (3) (a)', - 'CCI-003628': 'AC-2 (3) (b)', - 'CCI-003629': 'AC-2 (3) (c)', - 'CCI-003630': 'AC-2 (7) (c)', - 'CCI-003631': 'AC-2 (8)', - 'CCI-003632': 'AC-2 (8)', - 'CCI-003633': 'AC-2 (8)', - 'CCI-003634': 'AC-2 (8)', - 'CCI-003635': 'AC-2 (8)', - 'CCI-003636': 'AC-2 (8)', - 'CCI-003637': 'AC-2 (13)', - 'CCI-003638': 'AC-3 (4) (a)', - 'CCI-003639': 'AC-3 (4) (b)', - 'CCI-003640': 'AC-3 (4) (c)', - 'CCI-003641': 'AC-3 (4) (d)', - 'CCI-003642': 'AC-3 (4) (e)', - 'CCI-003643': 'AC-3 (10)', - 'CCI-003644': 'AC-3 (11)', - 'CCI-003645': 'AC-3 (11)', - 'CCI-003646': 'AC-3 (12) (a)', - 'CCI-003647': 'AC-3 (12) (a)', - 'CCI-003648': 'AC-3 (12) (b)', - 'CCI-003649': 'AC-3 (12) (c)', - 'CCI-003650': 'AC-3 (13)', - 'CCI-003651': 'AC-3 (13)', - 'CCI-003652': 'AC-3 (13)', - 'CCI-003653': 'AC-3 (13)', - 'CCI-003654': 'AC-3 (14)', - 'CCI-003655': 'AC-3 (14)', - 'CCI-003656': 'AC-3 (14)', - 'CCI-003657': 'AC-3 (15) (a)', - 'CCI-003658': 'AC-3 (15) (a)', - 'CCI-003659': 'AC-3 (15) (b)', - 'CCI-003660': 'AC-3 (15) (b)', - 'CCI-003661': 'AC-4 (1)', - 'CCI-003662': 'AC-4 (4)', - 'CCI-003663': 'AC-4 (8) (a)', - 'CCI-003664': 'AC-4 (8) (b)', - 'CCI-003665': 'AC-4 (8) (b)', - 'CCI-003666': 'AC-4 (19)', - 'CCI-003667': 'AC-4 (23)', - 'CCI-003668': 'AC-4 (23)', - 'CCI-003669': 'AC-4 (24)', - 'CCI-003670': 'AC-4 (24)', - 'CCI-003671': 'AC-4 (25)', - 'CCI-003672': 'AC-4 (25)', - 'CCI-003673': 'AC-4 (26)', - 'CCI-003674': 'AC-4 (27)', - 'CCI-003675': 'AC-4 (28)', - 'CCI-003676': 'AC-4 (29) (a)', - 'CCI-003677': 'AC-4 (29) (b)', - 'CCI-003678': 'AC-4 (30)', - 'CCI-003679': 'AC-4 (31)', - 'CCI-003680': 'AC-4 (32) (a)', - 'CCI-003681': 'AC-4 (32) (b)', - 'CCI-003682': 'AC-4 (32) (c)', - 'CCI-003683': 'AC-4 (32) (d)', - 'CCI-003684': 'AC-5 a', - 'CCI-003685': 'AC-6 (1) (a)', - 'CCI-003686': 'AC-6 (1) (b)', - 'CCI-003687': 'AC-7 (3)', - 'CCI-003688': 'AC-7 (3)', - 'CCI-003689': 'AC-7 (4) (a)', - 'CCI-003690': 'AC-7 (4) (a)', - 'CCI-003691': 'AC-7 (4) (b)', - 'CCI-003692': 'AC-7 (4) (b)', - 'CCI-003693': 'AC-12 (3)', - 'CCI-003694': 'AC-12 (3)', - 'CCI-003695': 'AC-14 a', - 'CCI-003696': 'AC-16 a', - 'CCI-003697': 'AC-16 a', - 'CCI-003698': 'AC-16 a', - 'CCI-003699': 'AC-16 a', - 'CCI-003700': 'AC-16 a', - 'CCI-003701': 'AC-16 a', - 'CCI-003702': 'AC-16 b', - 'CCI-003703': 'AC-16 b', - 'CCI-003704': 'AC-16 c', - 'CCI-003705': 'AC-16 c', - 'CCI-003706': 'AC-16 d', - 'CCI-003707': 'AC-16 e', - 'CCI-003708': 'AC-16 f', - 'CCI-003709': 'AC-16 f', - 'CCI-003710': 'AC-16 f', - 'CCI-003711': 'AC-16 f', - 'CCI-003712': 'AC-16 (1)', - 'CCI-003713': 'AC-16 (1)', - 'CCI-003714': 'AC-16 (1)', - 'CCI-003715': 'AC-16 (2)', - 'CCI-003716': 'AC-16 (2)', - 'CCI-003717': 'AC-16 (3)', - 'CCI-003718': 'AC-16 (3)', - 'CCI-003719': 'AC-16 (3)', - 'CCI-003720': 'AC-16 (3)', - 'CCI-003721': 'AC-16 (3)', - 'CCI-003722': 'AC-16 (4)', - 'CCI-003723': 'AC-16 (4)', - 'CCI-003724': 'AC-16 (4)', - 'CCI-003725': 'AC-16 (4)', - 'CCI-003726': 'AC-16 (4)', - 'CCI-003727': 'AC-16 (5)', - 'CCI-003728': 'AC-16 (5)', - 'CCI-003729': 'AC-16 (5)', - 'CCI-003730': 'AC-16 (6)', - 'CCI-003731': 'AC-16 (6)', - 'CCI-003732': 'AC-16 (6)', - 'CCI-003733': 'AC-16 (6)', - 'CCI-003734': 'AC-16 (6)', - 'CCI-003735': 'AC-16 (6)', - 'CCI-003736': 'AC-16 (6)', - 'CCI-003737': 'AC-16 (6)', - 'CCI-003738': 'AC-16 (7)', - 'CCI-003739': 'AC-16 (8)', - 'CCI-003740': 'AC-16 (8)', - 'CCI-003741': 'AC-16 (8)', - 'CCI-003742': 'AC-16 (9)', - 'CCI-003743': 'AC-16 (10)', - 'CCI-003744': 'AC-16 (10)', - 'CCI-003745': 'AC-16 (10)', - 'CCI-003746': 'AC-16 (10)', - 'CCI-003747': 'AC-17 (10)', - 'CCI-003748': 'AC-17 (10)', - 'CCI-003749': 'AC-17 (10)', - 'CCI-003750': 'AC-20 a 1', - 'CCI-003751': 'AC-20 a 1', - 'CCI-003752': 'AC-20 a 2', - 'CCI-003753': 'AC-20 a 2', - 'CCI-003754': 'AC-20 b', - 'CCI-003755': 'AC-20 b', - 'CCI-003756': 'AC-20 (1) (a)', - 'CCI-003757': 'AC-20 (1) (a)', - 'CCI-003758': 'AC-20 (2)', - 'CCI-003759': 'AC-20 (5)', - 'CCI-003760': 'AC-24 (2)', - 'CCI-003761': 'AT-1 a 1 (b)', - 'CCI-003762': 'AT-1 b', - 'CCI-003763': 'AT-1 b', - 'CCI-003764': 'AT-1 b', - 'CCI-003765': 'AT-1 b', - 'CCI-003766': 'AT-2 a 2', - 'CCI-003767': 'AT-2 b', - 'CCI-003768': 'AT-2 b', - 'CCI-003769': 'AT-2 b', - 'CCI-003770': 'AT-2 c', - 'CCI-003771': 'AT-2 c', - 'CCI-003772': 'AT-2 c', - 'CCI-003773': 'AT-2 c', - 'CCI-003774': 'AT-2 d', - 'CCI-003775': 'AT-2 (3)', - 'CCI-003776': 'AT-2 (3)', - 'CCI-003777': 'AT-2 (4)', - 'CCI-003778': 'AT-2 (4)', - 'CCI-003779': 'AT-2 (5)', - 'CCI-003780': 'AT-2 (6) (a)', - 'CCI-003781': 'AT-2 (6) (b)', - 'CCI-003782': 'AT-3 a', - 'CCI-003783': 'AT-3 a 1', - 'CCI-003784': 'AT-3 a 2', - 'CCI-003785': 'AT-3 b', - 'CCI-003786': 'AT-3 b', - 'CCI-003787': 'AT-3 b', - 'CCI-003788': 'AT-3 b', - 'CCI-003789': 'AT-3 c', - 'CCI-003790': 'AT-3 (3)', - 'CCI-003791': 'AT-3 (5)', - 'CCI-003792': 'AT-3 (5)', - 'CCI-003793': 'AT-3 (5)', - 'CCI-003794': 'AT-4 a', - 'CCI-003795': 'AT-4 a', - 'CCI-003796': 'AT-6', - 'CCI-003797': 'AT-6', - 'CCI-003798': 'AT-6', - 'CCI-003799': 'AU-1 a 1 (b)', - 'CCI-003800': 'AU-1 b', - 'CCI-003801': 'AU-1 b', - 'CCI-003802': 'AU-1 b', - 'CCI-003803': 'AU-1 b', - 'CCI-003804': 'AU-1 b', - 'CCI-003805': 'AU-1 b', - 'CCI-003806': 'AU-1 c 1', - 'CCI-003807': 'AU-1 c 1', - 'CCI-003808': 'AU-1 c 2', - 'CCI-003809': 'AU-1 c 2', - 'CCI-003810': 'AU-2 e', - 'CCI-003811': 'AU-2 e', - 'CCI-003812': 'AU-3 (3)', - 'CCI-003813': 'AU-3 (3)', - 'CCI-003814': 'AU-5 a', - 'CCI-003815': 'AU-5 (5)', - 'CCI-003816': 'AU-5 (5)', - 'CCI-003817': 'AU-6 a', - 'CCI-003818': 'AU-6 c', - 'CCI-003819': 'AU-6 c', - 'CCI-003820': 'AU-6 (1)', - 'CCI-003821': 'AU-6 (4)', - 'CCI-003822': 'AU-7 a', - 'CCI-003823': 'AU-7 a', - 'CCI-003824': 'AU-7 a', - 'CCI-003825': 'AU-7 a', - 'CCI-003826': 'AU-7 a', - 'CCI-003827': 'AU-7 a', - 'CCI-003828': 'AU-7 b', - 'CCI-003829': 'AU-7 b', - 'CCI-003830': 'AU-7 (1)', - 'CCI-003831': 'AU-9 b', - 'CCI-003832': 'AU-9 b', - 'CCI-003833': 'AU-9 (7)', - 'CCI-003834': 'AU-12 (3)', - 'CCI-003835': 'AU-12 (4)', - 'CCI-003836': 'AU-12 (4)', - 'CCI-003837': 'AU-13 b 1', - 'CCI-003838': 'AU-13 b 1', - 'CCI-003839': 'AU-13 b 2', - 'CCI-003840': 'AU-13 b 2', - 'CCI-003841': 'AU-13 (1)', - 'CCI-003842': 'AU-13 (1)', - 'CCI-003843': 'AU-13 (3)', - 'CCI-003844': 'AU-14 a', - 'CCI-003845': 'AU-14 a', - 'CCI-003846': 'AU-14 a', - 'CCI-003847': 'AU-14 b', - 'CCI-003848': 'AU-14 (3)', - 'CCI-003849': 'CA-1 a 1 (b)', - 'CCI-003850': 'CA-1 a 2', - 'CCI-003851': 'CA-1 b', - 'CCI-003852': 'CA-1 b', - 'CCI-003853': 'CA-1 b', - 'CCI-003854': 'CA-1 b', - 'CCI-003855': 'CA-1 c 1', - 'CCI-003856': 'CA-1 c 1', - 'CCI-003857': 'CA-1 c 2', - 'CCI-003858': 'CA-1 c 2', - 'CCI-003859': 'CA-2 a', - 'CCI-003860': 'CA-2 c', - 'CCI-003861': 'CA-2 d', - 'CCI-003862': 'CA-3 a', - 'CCI-003863': 'CA-3 b', - 'CCI-003864': 'CA-3 (6)', - 'CCI-003865': 'CA-3 (7) (a)', - 'CCI-003866': 'CA-3 (7) (b)', - 'CCI-003867': 'CA-5 (1)', - 'CCI-003868': 'CA-6 b', - 'CCI-003869': 'CA-6 c 1', - 'CCI-003870': 'CA-6 d', - 'CCI-003871': 'CA-6 (1)', - 'CCI-003872': 'CA-6 (2)', - 'CCI-003873': 'CA-7', - 'CCI-003874': 'CA-7 a', - 'CCI-003875': 'CA-7 b', - 'CCI-003876': 'CA-7 b', - 'CCI-003877': 'CA-7 b', - 'CCI-003878': 'CA-7 c', - 'CCI-003879': 'CA-7 g', - 'CCI-003880': 'CA-7 g', - 'CCI-003881': 'CA-7 (4) (a)', - 'CCI-003882': 'CA-7 (4) (b)', - 'CCI-003883': 'CA-7 (4) (c)', - 'CCI-003884': 'CA-7 (5)', - 'CCI-003885': 'CA-7 (5)', - 'CCI-003886': 'CA-7 (5)', - 'CCI-003887': 'CA-7 (6)', - 'CCI-003888': 'CA-7 (6)', - 'CCI-003889': 'CA-8 (3)', - 'CCI-003890': 'CA-8 (3)', - 'CCI-003891': 'CA-9 (b)', - 'CCI-003892': 'CA-9 (c)', - 'CCI-003893': 'CA-9 (c)', - 'CCI-003894': 'CA-9 (d)', - 'CCI-003895': 'CA-9 (d)', - 'CCI-003896': 'CA-9 (1)', - 'CCI-003897': 'CM-1 a 1 (b)', - 'CCI-003898': 'CM-1 b', - 'CCI-003899': 'CM-1 b', - 'CCI-003900': 'CM-1 b', - 'CCI-003901': 'CM-1 b', - 'CCI-003902': 'CM-1 b', - 'CCI-003903': 'CM-1 b', - 'CCI-003904': 'CM-1 c 1', - 'CCI-003905': 'CM-1 c 1', - 'CCI-003906': 'CM-1 c 2', - 'CCI-003907': 'CM-1 c 2', - 'CCI-003908': 'CM-1 c 2', - 'CCI-003909': 'CM-2 a', - 'CCI-003910': 'CM-2 b 3', - 'CCI-003911': 'CM-2 (2)', - 'CCI-003912': 'CM-3 b', - 'CCI-003913': 'CM-3 (1) (a)', - 'CCI-003914': 'CM-3 (1) (b)', - 'CCI-003915': 'CM-3 (1) (c)', - 'CCI-003916': 'CM-3 (1) (d)', - 'CCI-003917': 'CM-3 (1) (e)', - 'CCI-003918': 'CM-3 (1) (f)', - 'CCI-003919': 'CM-3 (3)', - 'CCI-003920': 'CM-3 (3)', - 'CCI-003921': 'CM-3 (4)', - 'CCI-003922': 'CM-3 (4)', - 'CCI-003923': 'CM-3 (4)', - 'CCI-003924': 'CM-3 (4)', - 'CCI-003925': 'CM-3 (7)', - 'CCI-003926': 'CM-3 (7)', - 'CCI-003927': 'CM-3 (7)', - 'CCI-003928': 'CM-3 (8)', - 'CCI-003929': 'CM-3 (8)', - 'CCI-003930': 'CM-4', - 'CCI-003931': 'CM-4 (1)', - 'CCI-003932': 'CM-4 (2)', - 'CCI-003933': 'CM-4 (2)', - 'CCI-003934': 'CM-4 (2)', - 'CCI-003935': 'CM-5', - 'CCI-003936': 'CM-5', - 'CCI-003937': 'CM-5 (1) (a)', - 'CCI-003938': 'CM-5 (1) (b)', - 'CCI-003939': 'CM-5 (5) (b)', - 'CCI-003940': 'CM-5 (5) (b)', - 'CCI-003941': 'CM-6 a', - 'CCI-003942': 'CM-6 a', - 'CCI-003943': 'CM-6 d', - 'CCI-003944': 'CM-6 d', - 'CCI-003945': 'CM-6 d', - 'CCI-003946': 'CM-6 d', - 'CCI-003947': 'CM-6 (1)', - 'CCI-003948': 'CM-7 a', - 'CCI-003949': 'CM-7 (6)', - 'CCI-003950': 'CM-7 (6)', - 'CCI-003951': 'CM-7 (7) (a)', - 'CCI-003952': 'CM-7 (7) (a)', - 'CCI-003953': 'CM-7 (7) (b)', - 'CCI-003954': 'CM-7 (7) (b)', - 'CCI-003955': 'CM-7 (8) (a)', - 'CCI-003956': 'CM-7 (8) (b)', - 'CCI-003957': 'CM-7 (9) (a)', - 'CCI-003958': 'CM-7 (9) (a)', - 'CCI-003959': 'CM-7 (9) (b)', - 'CCI-003960': 'CM-7 (9) (c)', - 'CCI-003961': 'CM-7 (9) (c)', - 'CCI-003962': 'CM-8 a 1', - 'CCI-003963': 'CM-8 a 2', - 'CCI-003964': 'CM-8 a 3', - 'CCI-003965': 'CM-8 a 4', - 'CCI-003966': 'CM-8 a 4', - 'CCI-003967': 'CM-8 a 5', - 'CCI-003968': 'CM-8 (2)', - 'CCI-003969': 'CM-8 (3) (a)', - 'CCI-003970': 'CM-8 (8)', - 'CCI-003971': 'CM-9 a', - 'CCI-003972': 'CM-9 a', - 'CCI-003973': 'CM-9 b', - 'CCI-003974': 'CM-9 b', - 'CCI-003975': 'CM-9 c', - 'CCI-003976': 'CM-9 c', - 'CCI-003977': 'CM-9 d', - 'CCI-003978': 'CM-9 d', - 'CCI-003979': 'CM-9 d', - 'CCI-003980': 'CM-11 (2)', - 'CCI-003981': 'CM-11 (3)', - 'CCI-003982': 'CM-12 a', - 'CCI-003983': 'CM-12 a', - 'CCI-003984': 'CM-12 a', - 'CCI-003985': 'CM-12 b', - 'CCI-003986': 'CM-12 b', - 'CCI-003987': 'CM-12 c', - 'CCI-003988': 'CM-12 (1)', - 'CCI-003989': 'CM-12 (1)', - 'CCI-003990': 'CM-12 (1)', - 'CCI-003991': 'CM-13', - 'CCI-003992': 'CM-14', - 'CCI-003993': 'CM-14', - 'CCI-003994': 'CP-1 a 1 (b)', - 'CCI-003995': 'CP-1 a 1 (b)', - 'CCI-003996': 'CP-1 b', - 'CCI-003997': 'CP-1 b', - 'CCI-003998': 'CP-1 b', - 'CCI-003999': 'CP-1 b', - 'CCI-004000': 'CP-1 b', - 'CCI-004001': 'CP-1 b', - 'CCI-004002': 'CP-1 c 1', - 'CCI-004003': 'CP-1 c 1', - 'CCI-004004': 'CP-1 c 2', - 'CCI-004005': 'CP-1 c 2', - 'CCI-004006': 'CP-2 a 4', - 'CCI-004007': 'CP-2 a 4', - 'CCI-004008': 'CP-2 a 6', - 'CCI-004009': 'CP-2 g', - 'CCI-004010': 'CP-3 b', - 'CCI-004011': 'CP-3 b', - 'CCI-004012': 'CP-3 b', - 'CCI-004013': 'CP-3 b', - 'CCI-004014': 'CP-4 (3)', - 'CCI-004015': 'CP-4 (5)', - 'CCI-004016': 'CP-4 (5)', - 'CCI-004017': 'CP-4 (5)', - 'CCI-004018': 'CP-6 a', - 'CCI-004019': 'CP-8 (1) (b)', - 'CCI-004020': 'CP-9 (a)', - 'CCI-004021': 'CP-9 (c)', - 'CCI-004022': 'CP-9 (d)', - 'CCI-004023': 'CP-9 (d)', - 'CCI-004024': 'CP-9 (d)', - 'CCI-004025': 'CP-9 (8)', - 'CCI-004026': 'CP-9 (8)', - 'CCI-004027': 'CP-9 (8)', - 'CCI-004028': 'CP-10', - 'CCI-004029': 'CP-10', - 'CCI-004030': 'CP-10 (6)', - 'CCI-004031': 'IA-1 a 1', - 'CCI-004032': 'IA-1 a 1 (a)', - 'CCI-004033': 'IA-1 a 1 (b)', - 'CCI-004034': 'IA-1 a 2', - 'CCI-004035': 'IA-1 b', - 'CCI-004036': 'IA-1 b', - 'CCI-004037': 'IA-1 b', - 'CCI-004038': 'IA-1 b', - 'CCI-004039': 'IA-1 b', - 'CCI-004040': 'IA-1 b', - 'CCI-004041': 'IA-1 c 1', - 'CCI-004042': 'IA-1 c 1', - 'CCI-004043': 'IA-1 c 2', - 'CCI-004044': 'IA-1 c 2', - 'CCI-004045': 'IA-2 (5)', - 'CCI-004046': 'IA-2 (6) (a)', - 'CCI-004047': 'IA-2 (6) (b)', - 'CCI-004048': 'IA-2 (6) (b)', - 'CCI-004049': 'IA-4 (5)', - 'CCI-004050': 'IA-4 (8)', - 'CCI-004051': 'IA-4 (9)', - 'CCI-004052': 'IA-4 (9)', - 'CCI-004053': 'IA-5 d', - 'CCI-004054': 'IA-5 d', - 'CCI-004055': 'IA-5 e', - 'CCI-004056': 'IA-5 f', - 'CCI-004057': 'IA-5 (1) (a)', - 'CCI-004058': 'IA-5 (1) (a)', - 'CCI-004059': 'IA-5 (1) (a)', - 'CCI-004060': 'IA-5 (1) (a)', - 'CCI-004061': 'IA-5 (1) (b)', - 'CCI-004062': 'IA-5 (1) (d)', - 'CCI-004063': 'IA-5 (1) (e)', - 'CCI-004064': 'IA-5 (1) (f)', - 'CCI-004065': 'IA-5 (1) (g)', - 'CCI-004066': 'IA-5 (1) (h)', - 'CCI-004067': 'IA-5 (1) (h)', - 'CCI-004068': 'IA-5 (2) (b) (2)', - 'CCI-004069': 'IA-5 (7)', - 'CCI-004070': 'IA-5 (9)', - 'CCI-004071': 'IA-5 (9)', - 'CCI-004072': 'IA-5 (10)', - 'CCI-004073': 'IA-5 (15)', - 'CCI-004074': 'IA-5 (16)', - 'CCI-004075': 'IA-5 (16)', - 'CCI-004076': 'IA-5 (16)', - 'CCI-004077': 'IA-5 (16)', - 'CCI-004078': 'IA-5 (17)', - 'CCI-004079': 'IA-5 (18) (a)', - 'CCI-004080': 'IA-5 (18) (a)', - 'CCI-004081': 'IA-5 (18) (b)', - 'CCI-004082': 'IA-5 (18) (b)', - 'CCI-004083': 'IA-8 (2) (a)', - 'CCI-004084': 'IA-8 (2) (b)', - 'CCI-004085': 'IA-8 (4)', - 'CCI-004086': 'IA-8 (4)', - 'CCI-004087': 'IA-8 (5)', - 'CCI-004088': 'IA-8 (6)', - 'CCI-004089': 'IA-8 (6)', - 'CCI-004090': 'IA-8 (6)', - 'CCI-004091': 'IA-8 (6)', - 'CCI-004092': 'IA-12 a', - 'CCI-004093': 'IA-12 a', - 'CCI-004094': 'IA-12 b', - 'CCI-004095': 'IA-12 c', - 'CCI-004096': 'IA-12 c', - 'CCI-004097': 'IA-12 c', - 'CCI-004098': 'IA-12 (1)', - 'CCI-004099': 'IA-12 (2)', - 'CCI-004100': 'IA-12 (3)', - 'CCI-004101': 'IA-12 (3)', - 'CCI-004102': 'IA-12 (3)', - 'CCI-004103': 'IA-12 (3)', - 'CCI-004104': 'IA-12 (4)', - 'CCI-004105': 'IA-12 (4)', - 'CCI-004106': 'IA-12 (5)', - 'CCI-004107': 'IA-12 (6)', - 'CCI-004108': 'IA-12 (6)', - 'CCI-004109': 'IR-1 a 1 (b)', - 'CCI-004110': 'IR-1 b', - 'CCI-004111': 'IR-1 b', - 'CCI-004112': 'IR-1 b', - 'CCI-004113': 'IR-1 c 1', - 'CCI-004114': 'IR-1 c 1', - 'CCI-004115': 'IR-1 c 2', - 'CCI-004116': 'IR-1 c 2', - 'CCI-004117': 'IR-2 (2)', - 'CCI-004118': 'IR-2 (3)', - 'CCI-004119': 'IR-3 (1)', - 'CCI-004120': 'IR-3 (3) (a)', - 'CCI-004121': 'IR-3 (3) (a)', - 'CCI-004122': 'IR-3 (3) (b)', - 'CCI-004123': 'IR-3 (3) (b)', - 'CCI-004124': 'IR-3 (3) (c)', - 'CCI-004125': 'IR-3 (3) (c)', - 'CCI-004126': 'IR-3 (3) (c)', - 'CCI-004127': 'IR-3 (3) (c)', - 'CCI-004128': 'IR-3 (3) (c)', - 'CCI-004129': 'IR-3 (3) (c)', - 'CCI-004130': 'IR-4 c', - 'CCI-004131': 'IR-4 c', - 'CCI-004132': 'IR-4 c', - 'CCI-004133': 'IR-4 d', - 'CCI-004134': 'IR-4 d', - 'CCI-004135': 'IR-4 d', - 'CCI-004136': 'IR-4 d', - 'CCI-004137': 'IR-4 (1)', - 'CCI-004138': 'IR-4 (2)', - 'CCI-004139': 'IR-4 (3)', - 'CCI-004140': 'IR-4 (3)', - 'CCI-004141': 'IR-4 (7)', - 'CCI-004142': 'IR-4 (7)', - 'CCI-004143': 'IR-4 (11)', - 'CCI-004144': 'IR-4 (11)', - 'CCI-004145': 'IR-4 (12)', - 'CCI-004146': 'IR-4 (13)', - 'CCI-004147': 'IR-4 (13)', - 'CCI-004148': 'IR-4 (14)', - 'CCI-004149': 'IR-4 (15) (a)', - 'CCI-004150': 'IR-4 (15) (b)', - 'CCI-004151': 'IR-5 (1)', - 'CCI-004152': 'IR-5 (1)', - 'CCI-004153': 'IR-5 (1)', - 'CCI-004154': 'IR-5 (1)', - 'CCI-004155': 'IR-6 (1)', - 'CCI-004156': 'IR-6 (3)', - 'CCI-004157': 'IR-8 a 8', - 'CCI-004158': 'IR-8 a 9', - 'CCI-004159': 'IR-8 a 10', - 'CCI-004160': 'IR-8 (1) (a)', - 'CCI-004161': 'IR-8 (1) (b)', - 'CCI-004162': 'IR-8 (1) (c)', - 'CCI-004163': 'IR-9 a', - 'CCI-004164': 'IR-9 a', - 'CCI-004165': 'MA-1 a 1 (b)', - 'CCI-004166': 'MA-1 b', - 'CCI-004167': 'MA-1 b', - 'CCI-004168': 'MA-1 b', - 'CCI-004169': 'MA-1 b', - 'CCI-004170': 'MA-1 c 1', - 'CCI-004171': 'MA-1 c 1', - 'CCI-004172': 'MA-1 c 2', - 'CCI-004173': 'MA-1 c 2', - 'CCI-004174': 'MA-2 a', - 'CCI-004175': 'MA-2 a', - 'CCI-004176': 'MA-2 a', - 'CCI-004177': 'MA-2 b', - 'CCI-004178': 'MA-2 b', - 'CCI-004179': 'MA-2 b', - 'CCI-004180': 'MA-2 b', - 'CCI-004181': 'MA-2 d', - 'CCI-004182': 'MA-2 (2) (a)', - 'CCI-004183': 'MA-2 (2) (a)', - 'CCI-004184': 'MA-2 (2) (a)', - 'CCI-004185': 'MA-2 (2) (b)', - 'CCI-004186': 'MA-3 b', - 'CCI-004187': 'MA-3 b', - 'CCI-004188': 'MA-3 (5)', - 'CCI-004189': 'MA-3 (6)', - 'CCI-004190': 'MA-4 e', - 'CCI-004191': 'MA-4 e', - 'CCI-004192': 'MA-4 (4) (b) (2)', - 'CCI-004193': 'MA-4 (6)', - 'CCI-004194': 'MA-5 (1) (b)', - 'CCI-004195': 'MA-5 (1) (b)', - 'CCI-004196': 'MA-5 (1) (b)', - 'CCI-004197': 'MA-6 (3)', - 'CCI-004198': 'MA-7', - 'CCI-004199': 'MA-7', - 'CCI-004200': 'MA-7', - 'CCI-004201': 'MP-1 a 1 (b)', - 'CCI-004202': 'MP-1 b', - 'CCI-004203': 'MP-1 b', - 'CCI-004204': 'MP-1 b', - 'CCI-004205': 'MP-1 b', - 'CCI-004206': 'MP-1 b', - 'CCI-004207': 'MP-1 c 1', - 'CCI-004208': 'MP-1 c 1', - 'CCI-004209': 'MP-1 c 2', - 'CCI-004210': 'MP-1 c 2', - 'CCI-004211': 'MP-4 a', - 'CCI-004212': 'MP-4 a', - 'CCI-004213': 'MP-4 b', - 'CCI-004214': 'MP-4 b', - 'CCI-004215': 'MP-4 b', - 'CCI-004216': 'MP-4 (2)', - 'CCI-004217': 'MP-5 a', - 'CCI-004218': 'MP-5 a', - 'CCI-004219': 'MP-6 (2)', - 'CCI-004220': 'MP-6 (2)', - 'CCI-004221': 'MP-8 a', - 'CCI-004222': 'MP-8 a', - 'CCI-004223': 'MP-8 b', - 'CCI-004224': 'MP-8 b', - 'CCI-004225': 'MP-8 c', - 'CCI-004226': 'MP-8 c', - 'CCI-004227': 'MP-8 (2)', - 'CCI-004228': 'MP-8 (2)', - 'CCI-004229': 'PE-1 a 1 (b)', - 'CCI-004230': 'PE-1 b', - 'CCI-004231': 'PE-1 b', - 'CCI-004232': 'PE-1 b', - 'CCI-004233': 'PE-1 b', - 'CCI-004234': 'PE-1 b', - 'CCI-004235': 'PE-1 b', - 'CCI-004236': 'PE-1 c 1', - 'CCI-004237': 'PE-1 c 1', - 'CCI-004238': 'PE-1 c 2', - 'CCI-004239': 'PE-1 c 2', - 'CCI-004240': 'PE-3 a', - 'CCI-004241': 'PE-3 a', - 'CCI-004242': 'PE-3 a 2', - 'CCI-004243': 'PE-3 a 2', - 'CCI-004244': 'PE-3 (7)', - 'CCI-004245': 'PE-3 (8)', - 'CCI-004246': 'PE-3 (8)', - 'CCI-004247': 'PE-5 (2)', - 'CCI-004248': 'PE-6 (2)', - 'CCI-004249': 'PE-6 (3) (b)', - 'CCI-004250': 'PE-6 (3) (b)', - 'CCI-004251': 'PE-8 c', - 'CCI-004252': 'PE-8 c', - 'CCI-004253': 'PE-8 (1)', - 'CCI-004254': 'PE-8 (3)', - 'CCI-004255': 'PE-8 (3)', - 'CCI-004256': 'PE-10 a', - 'CCI-004257': 'PE-14 (1)', - 'CCI-004258': 'PE-14 (2)', - 'CCI-004259': 'PE-15 (1)', - 'CCI-004260': 'PE-15 (1)', - 'CCI-004261': 'PE-15 (1)', - 'CCI-004262': 'PE-17 a', - 'CCI-004263': 'PE-17 d', - 'CCI-004264': 'PE-19 (1)', - 'CCI-004265': 'PE-19 (1)', - 'CCI-004266': 'PE-21', - 'CCI-004267': 'PE-21', - 'CCI-004268': 'PE-21', - 'CCI-004269': 'PE-22', - 'CCI-004270': 'PE-22', - 'CCI-004271': 'PE-23 a', - 'CCI-004272': 'PE-23 b', - 'CCI-004273': 'PL-1 a 1 (b)', - 'CCI-004274': 'PL-1 b', - 'CCI-004275': 'PL-1 b', - 'CCI-004276': 'PL-1 c 1', - 'CCI-004277': 'PL-1 c 2', - 'CCI-004278': 'PL-2 a 4', - 'CCI-004279': 'PL-2 a 5', - 'CCI-004280': 'PL-2 a 7', - 'CCI-004281': 'PL-2 a 8', - 'CCI-004282': 'PL-2 a 13', - 'CCI-004283': 'PL-2 a 14', - 'CCI-004284': 'PL-4 a', - 'CCI-004285': 'PL-4 a', - 'CCI-004286': 'PL-4 a', - 'CCI-004287': 'PL-4 a', - 'CCI-004288': 'PL-4 a', - 'CCI-004289': 'PL-4 d', - 'CCI-004290': 'PL-4 (1) (c)', - 'CCI-004291': 'PL-7 a', - 'CCI-004292': 'PL-8 a', - 'CCI-004293': 'PL-8 a 1', - 'CCI-004294': 'PL-8 a 2', - 'CCI-004295': 'PL-8 a 2', - 'CCI-004296': 'PL-8 a 3', - 'CCI-004297': 'PL-8 a 4', - 'CCI-004298': 'PL-8 c', - 'CCI-004299': 'PL-8 c', - 'CCI-004300': 'PL-8 c', - 'CCI-004301': 'PL-8 (1) (a)', - 'CCI-004302': 'PL-8 (1) (a)', - 'CCI-004303': 'PL-8 (1) (a)', - 'CCI-004304': 'PL-8 (1) (a)', - 'CCI-004305': 'PL-8 (1) (a)', - 'CCI-004306': 'PL-8 (1) (a)', - 'CCI-004307': 'PL-8 (1) (b)', - 'CCI-004308': 'PL-8 (2)', - 'CCI-004309': 'PL-8 (2)', - 'CCI-004310': 'PL-10', - 'CCI-004311': 'PL-11', - 'CCI-004312': 'PM-1 b', - 'CCI-004313': 'PM-1 b', - 'CCI-004314': 'PM-3 a', - 'CCI-004315': 'PM-3 a', - 'CCI-004316': 'PM-3 b', - 'CCI-004317': 'PM-3 b', - 'CCI-004318': 'PM-3 c', - 'CCI-004319': 'PM-4 a 1', - 'CCI-004320': 'PM-4 a 1', - 'CCI-004321': 'PM-4 a 1', - 'CCI-004322': 'PM-4 a 1', - 'CCI-004323': 'PM-4 a 2', - 'CCI-004324': 'PM-4 a 2', - 'CCI-004325': 'PM-4 a 3', - 'CCI-004326': 'PM-4 a 3', - 'CCI-004327': 'PM-4 a 3', - 'CCI-004328': 'PM-5', - 'CCI-004329': 'PM-5', - 'CCI-004330': 'PM-5', - 'CCI-004331': 'PM-5 (1)', - 'CCI-004332': 'PM-5 (1)', - 'CCI-004333': 'PM-5 (1)', - 'CCI-004334': 'PM-5 (1)', - 'CCI-004335': 'PM-6', - 'CCI-004336': 'PM-6', - 'CCI-004337': 'PM-6', - 'CCI-004338': 'PM-7', - 'CCI-004339': 'PM-7', - 'CCI-004340': 'PM-7', - 'CCI-004341': 'PM-7 (1)', - 'CCI-004342': 'PM-7 (1)', - 'CCI-004343': 'PM-8', - 'CCI-004344': 'PM-8', - 'CCI-004345': 'PM-9 a 2', - 'CCI-004346': 'PM-10 a', - 'CCI-004347': 'PM-10 a', - 'CCI-004348': 'PM-11 a', - 'CCI-004349': 'PM-11 b', - 'CCI-004350': 'PM-11 c', - 'CCI-004351': 'PM-11 c', - 'CCI-004352': 'PM-13', - 'CCI-004353': 'PM-14 a 1', - 'CCI-004354': 'PM-14 a 1', - 'CCI-004355': 'PM-14 a 1', - 'CCI-004356': 'PM-14 a 1', - 'CCI-004357': 'PM-14 a 1', - 'CCI-004358': 'PM-14 a 1', - 'CCI-004359': 'PM-14 a 2', - 'CCI-004360': 'PM-14 a 2', - 'CCI-004361': 'PM-14 a 2', - 'CCI-004362': 'PM-15 a', - 'CCI-004363': 'PM-15 b', - 'CCI-004364': 'PM-15 c', - 'CCI-004365': 'PM-16 (1)', - 'CCI-004366': 'PM-17 a', - 'CCI-004367': 'PM-17 a', - 'CCI-004368': 'PM-17 b', - 'CCI-004369': 'PM-17 b', - 'CCI-004370': 'PM-17 b', - 'CCI-004371': 'PM-17 b', - 'CCI-004372': 'PM-18 a', - 'CCI-004373': 'PM-18 a', - 'CCI-004374': 'PM-18 a 1', - 'CCI-004375': 'PM-18 a 1', - 'CCI-004376': 'PM-18 a 2', - 'CCI-004377': 'PM-18 a 2', - 'CCI-004378': 'PM-18 a 2', - 'CCI-004379': 'PM-18 a 2', - 'CCI-004380': 'PM-18 a 3', - 'CCI-004381': 'PM-18 a 3', - 'CCI-004382': 'PM-18 a 4', - 'CCI-004383': 'PM-18 a 4', - 'CCI-004384': 'PM-18 a 5', - 'CCI-004385': 'PM-18 a 5', - 'CCI-004386': 'PM-18 a 6', - 'CCI-004387': 'PM-18 a 6', - 'CCI-004388': 'PM-18 a 6', - 'CCI-004389': 'PM-18 b', - 'CCI-004390': 'PM-19', - 'CCI-004391': 'PM-19', - 'CCI-004392': 'PM-19', - 'CCI-004393': 'PM-19', - 'CCI-004394': 'PM-20', - 'CCI-004395': 'PM-20 a', - 'CCI-004396': 'PM-20 a', - 'CCI-004397': 'PM-20 b', - 'CCI-004398': 'PM-20 c', - 'CCI-004399': 'PM-20 (1) (a)', - 'CCI-004400': 'PM-20 (1) (a)', - 'CCI-004401': 'PM-20 (1) (b)', - 'CCI-004402': 'PM-20 (1) (c)', - 'CCI-004403': 'PM-20 (1) (c)', - 'CCI-004404': 'PM-21 a', - 'CCI-004405': 'PM-21 a', - 'CCI-004406': 'PM-21 a 1', - 'CCI-004407': 'PM-21 a 1', - 'CCI-004408': 'PM-21 a 2', - 'CCI-004409': 'PM-21 a 2', - 'CCI-004410': 'PM-21 b', - 'CCI-004411': 'PM-21 c', - 'CCI-004412': 'PM-22 a', - 'CCI-004413': 'PM-22 a', - 'CCI-004414': 'PM-22 b', - 'CCI-004415': 'PM-22 b', - 'CCI-004416': 'PM-22 c', - 'CCI-004417': 'PM-22 c', - 'CCI-004418': 'PM-22 d', - 'CCI-004419': 'PM-22 d', - 'CCI-004420': 'PM-23', - 'CCI-004421': 'PM-23', - 'CCI-004422': 'PM-23', - 'CCI-004423': 'PM-24 a', - 'CCI-004424': 'PM-24 b', - 'CCI-004425': 'PM-25 a', - 'CCI-004426': 'PM-25 a', - 'CCI-004427': 'PM-25 a', - 'CCI-004428': 'PM-25 a', - 'CCI-004429': 'PM-25 b', - 'CCI-004430': 'PM-25 c', - 'CCI-004431': 'PM-25 d', - 'CCI-004432': 'PM-25 d', - 'CCI-004433': 'PM-25 d', - 'CCI-004434': 'PM-25 d', - 'CCI-004435': 'PM-26', - 'CCI-004436': 'PM-26', - 'CCI-004437': 'PM-26 a', - 'CCI-004438': 'PM-26 a', - 'CCI-004439': 'PM-26 b', - 'CCI-004440': 'PM-26 c', - 'CCI-004441': 'PM-26 c', - 'CCI-004442': 'PM-26 d', - 'CCI-004443': 'PM-26 d', - 'CCI-004444': 'PM-26 e', - 'CCI-004445': 'PM-26 e', - 'CCI-004446': 'PM-27', - 'CCI-004447': 'PM-27', - 'CCI-004448': 'PM-27 a 1', - 'CCI-004449': 'PM-27 a 2', - 'CCI-004450': 'PM-27 a 2', - 'CCI-004451': 'PM-27 a 2', - 'CCI-004452': 'PM-27 b', - 'CCI-004453': 'PM-27 b', - 'CCI-004454': 'PM-28 a 1', - 'CCI-004455': 'PM-28 a 2', - 'CCI-004456': 'PM-28 a 3', - 'CCI-004457': 'PM-28 a 4', - 'CCI-004458': 'PM-28 b', - 'CCI-004459': 'PM-28 b', - 'CCI-004460': 'PM-28 c', - 'CCI-004461': 'PM-28 c', - 'CCI-004462': 'PM-29 a', - 'CCI-004463': 'PM-29 a', - 'CCI-004464': 'PM-29 b', - 'CCI-004465': 'PM-29 b', - 'CCI-004466': 'PM-30 a', - 'CCI-004467': 'PM-30 a', - 'CCI-004468': 'PM-30 a', - 'CCI-004469': 'PM-30 a', - 'CCI-004470': 'PM-30 b', - 'CCI-004471': 'PM-30 c', - 'CCI-004472': 'PM-30 c', - 'CCI-004473': 'PM-31 a', - 'CCI-004474': 'PM-31 a', - 'CCI-004475': 'PM-31 a', - 'CCI-004476': 'PM-31 b', - 'CCI-004477': 'PM-31 b', - 'CCI-004478': 'PM-31 b', - 'CCI-004479': 'PM-31 b', - 'CCI-004480': 'PM-31 b', - 'CCI-004481': 'PM-31 b', - 'CCI-004482': 'PM-31 c', - 'CCI-004483': 'PM-31 c', - 'CCI-004484': 'PM-31 d', - 'CCI-004485': 'PM-31 d', - 'CCI-004486': 'PM-31 e', - 'CCI-004487': 'PM-31 e', - 'CCI-004488': 'PM-31 f', - 'CCI-004489': 'PM-31 f', - 'CCI-004490': 'PM-31 f', - 'CCI-004491': 'PM-31 f', - 'CCI-004492': 'PM-31 f', - 'CCI-004493': 'PM-31 f', - 'CCI-004494': 'PM-31 f', - 'CCI-004495': 'PM-31 f', - 'CCI-004496': 'PM-32', - 'CCI-004497': 'PM-32', - 'CCI-004498': 'PS-1 a 1 (b)', - 'CCI-004499': 'PS-1 b', - 'CCI-004500': 'PS-1 b', - 'CCI-004501': 'PS-1 b', - 'CCI-004502': 'PS-1 b', - 'CCI-004503': 'PS-1 b', - 'CCI-004504': 'PS-1 b', - 'CCI-004505': 'PS-1 c 1', - 'CCI-004506': 'PS-1 c 1', - 'CCI-004507': 'PS-1 c 2', - 'CCI-004508': 'PS-1 c 2', - 'CCI-004509': 'PS-3 (4)', - 'CCI-004510': 'PS-3 (4)', - 'CCI-004511': 'PS-3 (4)', - 'CCI-004512': 'PS-4 (2)', - 'CCI-004513': 'PS-6 c 1', - 'CCI-004514': 'PS-6 c 1', - 'CCI-004515': 'PS-6 c 2', - 'CCI-004516': 'PS-6 c 2', - 'CCI-004517': 'PS-6 c 2', - 'CCI-004518': 'PS-6 c 2', - 'CCI-004519': 'PS-7 b', - 'CCI-004520': 'PS-7 b', - 'CCI-004521': 'PS-8 a', - 'CCI-004522': 'PS-8 a', - 'CCI-004523': 'PS-9', - 'CCI-004524': 'PS-9', - 'CCI-004525': 'PT-1 a 1 (a)', - 'CCI-004526': 'PT-1 a', - 'CCI-004527': 'PT-1 a', - 'CCI-004528': 'PT-1 a 1 (b)', - 'CCI-004529': 'PT-1 a 2', - 'CCI-004530': 'PT-1 b', - 'CCI-004531': 'PT-1 b', - 'CCI-004532': 'PT-1 b', - 'CCI-004533': 'PT-1 c 1', - 'CCI-004534': 'PT-1 c 1', - 'CCI-004535': 'PT-1 c 1', - 'CCI-004536': 'PT-1 c 2', - 'CCI-004537': 'PT-1 c 2', - 'CCI-004538': 'PT-1 c 2', - 'CCI-004539': 'PT-2 a', - 'CCI-004540': 'PT-2 a', - 'CCI-004541': 'PT-2 a', - 'CCI-004542': 'PT-2 b', - 'CCI-004543': 'PT-2 b', - 'CCI-004544': 'PT-2 (1)', - 'CCI-004545': 'PT-2 (1)', - 'CCI-004546': 'PT-2 (1)', - 'CCI-004547': 'PT-2 (2)', - 'CCI-004548': 'PT-2 (2)', - 'CCI-004549': 'PT-3 a', - 'CCI-004550': 'PT-3 a', - 'CCI-004551': 'PT-3 b', - 'CCI-004552': 'PT-3 c', - 'CCI-004553': 'PT-3 c', - 'CCI-004554': 'PT-3 d', - 'CCI-004555': 'PT-3 d', - 'CCI-004556': 'PT-3 d', - 'CCI-004557': 'PT-3 d', - 'CCI-004558': 'PT-3 (1)', - 'CCI-004559': 'PT-3 (1)', - 'CCI-004560': 'PT-3 (2)', - 'CCI-004561': 'PT-4', - 'CCI-004562': 'PT-4', - 'CCI-004563': 'PT-4 (1)', - 'CCI-004564': 'PT-4 (1)', - 'CCI-004565': 'PT-4 (2)', - 'CCI-004566': 'PT-4 (2)', - 'CCI-004567': 'PT-4 (2)', - 'CCI-004568': 'PT-4 (2)', - 'CCI-004569': 'PT-4 (3)', - 'CCI-004570': 'PT-4 (3)', - 'CCI-004571': 'PT-5 a', - 'CCI-004572': 'PT-5 a', - 'CCI-004573': 'PT-5 b', - 'CCI-004574': 'PT-5 c', - 'CCI-004575': 'PT-5 d', - 'CCI-004576': 'PT-5 e', - 'CCI-004577': 'PT-5 e', - 'CCI-004578': 'PT-5 (1)', - 'CCI-004579': 'PT-5 (1)', - 'CCI-004580': 'PT-5 (2)', - 'CCI-004581': 'PT-6 a', - 'CCI-004582': 'PT-6 a', - 'CCI-004583': 'PT-6 b', - 'CCI-004584': 'PT-6 c', - 'CCI-004585': 'PT-6 (1)', - 'CCI-004586': 'PT-6 (1)', - 'CCI-004587': 'PT-6 (1)', - 'CCI-004588': 'PT-6 (2)', - 'CCI-004589': 'PT-6 (2)', - 'CCI-004590': 'PT-6 (2)', - 'CCI-004591': 'PT-6 (2)', - 'CCI-004592': 'PT-7', - 'CCI-004593': 'PT-7', - 'CCI-004594': 'PT-7 (1) (a)', - 'CCI-004595': 'PT-7 (1) (b)', - 'CCI-004596': 'PT-7 (1) (c)', - 'CCI-004597': 'PT-7 (2)', - 'CCI-004598': 'PT-8 a', - 'CCI-004599': 'PT-8 b', - 'CCI-004600': 'PT-8 c', - 'CCI-004601': 'PT-8 d', - 'CCI-004602': 'PT-8 e', - 'CCI-004603': 'RA-1 a 1 (b)', - 'CCI-004604': 'RA-1 a 1 (b)', - 'CCI-004605': 'RA-1 b', - 'CCI-004606': 'RA-1 b', - 'CCI-004607': 'RA-1 b', - 'CCI-004608': 'RA-1 b', - 'CCI-004609': 'RA-1 b', - 'CCI-004610': 'RA-1 c 1', - 'CCI-004611': 'RA-1 c 1', - 'CCI-004612': 'RA-1 c 2', - 'CCI-004613': 'RA-1 c 2', - 'CCI-004614': 'RA-2 a', - 'CCI-004615': 'RA-2 a', - 'CCI-004616': 'RA-2 a', - 'CCI-004617': 'RA-2 (1)', - 'CCI-004618': 'RA-3 a 1', - 'CCI-004619': 'RA-3 a 1', - 'CCI-004620': 'RA-3 a 3', - 'CCI-004621': 'RA-3 b', - 'CCI-004622': 'RA-3 b', - 'CCI-004623': 'RA-3 b', - 'CCI-004624': 'RA-3 (1) (a)', - 'CCI-004625': 'RA-3 (1) (a)', - 'CCI-004626': 'RA-3 (1) (b)', - 'CCI-004627': 'RA-3 (1) (b)', - 'CCI-004628': 'RA-3 (2)', - 'CCI-004629': 'RA-3 (3)', - 'CCI-004630': 'RA-3 (3)', - 'CCI-004631': 'RA-3 (4)', - 'CCI-004632': 'RA-3 (4)', - 'CCI-004633': 'RA-3 (4)', - 'CCI-004634': 'RA-5 b 2', - 'CCI-004635': 'RA-5 b 3', - 'CCI-004636': 'RA-5 f', - 'CCI-004637': 'RA-5 (6)', - 'CCI-004638': 'RA-5 (8)', - 'CCI-004639': 'RA-5 (8)', - 'CCI-004640': 'RA-5 (11)', - 'CCI-004641': 'RA-7', - 'CCI-004642': 'RA-7', - 'CCI-004643': 'RA-7', - 'CCI-004644': 'RA-7', - 'CCI-004645': 'RA-8 a', - 'CCI-004646': 'RA-8 b 1', - 'CCI-004647': 'RA-8 b 2', - 'CCI-004648': 'RA-9', - 'CCI-004649': 'RA-9', - 'CCI-004650': 'RA-9', - 'CCI-004651': 'RA-10 a 1', - 'CCI-004652': 'RA-10 a 2', - 'CCI-004653': 'RA-10 b', - 'CCI-004654': 'RA-10 b', - 'CCI-004655': 'SA-1 a 1 (b)', - 'CCI-004656': 'SA-1 b', - 'CCI-004657': 'SA-1 b', - 'CCI-004658': 'SA-1 b', - 'CCI-004659': 'SA-1 b', - 'CCI-004660': 'SA-1 b', - 'CCI-004661': 'SA-1 b', - 'CCI-004662': 'SA-1 c 1', - 'CCI-004663': 'SA-1 c 1', - 'CCI-004664': 'SA-1 c 2', - 'CCI-004665': 'SA-1 c 2', - 'CCI-004666': 'SA-2 a', - 'CCI-004667': 'SA-2 c', - 'CCI-004668': 'SA-2 c', - 'CCI-004669': 'SA-3 a', - 'CCI-004670': 'SA-3 a', - 'CCI-004671': 'SA-3 a', - 'CCI-004672': 'SA-3 a', - 'CCI-004673': 'SA-3 a', - 'CCI-004674': 'SA-3 a', - 'CCI-004675': 'SA-3 a', - 'CCI-004676': 'SA-3 b', - 'CCI-004677': 'SA-3 c', - 'CCI-004678': 'SA-3 d', - 'CCI-004679': 'SA-3 (1)', - 'CCI-004680': 'SA-3 (2) (a)', - 'CCI-004681': 'SA-3 (2) (a)', - 'CCI-004682': 'SA-3 (2) (a)', - 'CCI-004683': 'SA-3 (2) (b)', - 'CCI-004684': 'SA-3 (3)', - 'CCI-004685': 'SA-3 (3)', - 'CCI-004686': 'SA-4', - 'CCI-004687': 'SA-4 a', - 'CCI-004688': 'SA-4 c', - 'CCI-004689': 'SA-4 d', - 'CCI-004690': 'SA-4 d', - 'CCI-004691': 'SA-4 e', - 'CCI-004692': 'SA-4 f', - 'CCI-004693': 'SA-4 f', - 'CCI-004694': 'SA-4 h', - 'CCI-004695': 'SA-4 h', - 'CCI-004696': 'SA-4 h', - 'CCI-004697': 'SA-4 (3) (a)', - 'CCI-004698': 'SA-4 (3) (a)', - 'CCI-004699': 'SA-4 (3) (b)', - 'CCI-004700': 'SA-4 (3) (b)', - 'CCI-004701': 'SA-4 (3) (c)', - 'CCI-004702': 'SA-4 (3) (c)', - 'CCI-004703': 'SA-4 (11)', - 'CCI-004704': 'SA-4 (11)', - 'CCI-004705': 'SA-4 (12) (a)', - 'CCI-004706': 'SA-4 (12) (b)', - 'CCI-004707': 'SA-4 (12) (b)', - 'CCI-004708': 'SA-5 a 2', - 'CCI-004709': 'SA-5 b 1', - 'CCI-004710': 'SA-5 b 2', - 'CCI-004711': 'SA-5 b 3', - 'CCI-004712': 'SA-8', - 'CCI-004713': 'SA-8', - 'CCI-004714': 'SA-8', - 'CCI-004715': 'SA-8', - 'CCI-004716': 'SA-8', - 'CCI-004717': 'SA-8 (1)', - 'CCI-004718': 'SA-8 (2)', - 'CCI-004719': 'SA-8 (2)', - 'CCI-004720': 'SA-8 (3)', - 'CCI-004721': 'SA-8 (3)', - 'CCI-004722': 'SA-8 (4)', - 'CCI-004723': 'SA-8 (4)', - 'CCI-004724': 'SA-8 (5)', - 'CCI-004725': 'SA-8 (5)', - 'CCI-004726': 'SA-8 (6)', - 'CCI-004727': 'SA-8 (6)', - 'CCI-004728': 'SA-8 (7)', - 'CCI-004729': 'SA-8 (7)', - 'CCI-004730': 'SA-8 (8)', - 'CCI-004731': 'SA-8 (8)', - 'CCI-004732': 'SA-8 (9)', - 'CCI-004733': 'SA-8 (9)', - 'CCI-004734': 'SA-8 (10)', - 'CCI-004735': 'SA-8 (10)', - 'CCI-004736': 'SA-8 (11)', - 'CCI-004737': 'SA-8 (11)', - 'CCI-004738': 'SA-8 (12)', - 'CCI-004739': 'SA-8 (12)', - 'CCI-004740': 'SA-8 (13)', - 'CCI-004741': 'SA-8 (13)', - 'CCI-004742': 'SA-8 (14)', - 'CCI-004743': 'SA-8 (14)', - 'CCI-004744': 'SA-8 (15)', - 'CCI-004745': 'SA-8 (15)', - 'CCI-004746': 'SA-8 (16)', - 'CCI-004747': 'SA-8 (16)', - 'CCI-004748': 'SA-8 (17)', - 'CCI-004749': 'SA-8 (17)', - 'CCI-004750': 'SA-8 (18)', - 'CCI-004751': 'SA-8 (18)', - 'CCI-004752': 'SA-8 (19)', - 'CCI-004753': 'SA-8 (19)', - 'CCI-004754': 'SA-8 (20)', - 'CCI-004755': 'SA-8 (20)', - 'CCI-004756': 'SA-8 (21)', - 'CCI-004757': 'SA-8 (21)', - 'CCI-004758': 'SA-8 (22)', - 'CCI-004759': 'SA-8 (22)', - 'CCI-004760': 'SA-8 (23)', - 'CCI-004761': 'SA-8 (23)', - 'CCI-004762': 'SA-8 (24)', - 'CCI-004763': 'SA-8 (24)', - 'CCI-004764': 'SA-8 (25)', - 'CCI-004765': 'SA-8 (25)', - 'CCI-004766': 'SA-8 (26)', - 'CCI-004767': 'SA-8 (26)', - 'CCI-004768': 'SA-8 (27)', - 'CCI-004769': 'SA-8 (27)', - 'CCI-004770': 'SA-8 (28)', - 'CCI-004771': 'SA-8 (28)', - 'CCI-004772': 'SA-8 (29)', - 'CCI-004773': 'SA-8 (29)', - 'CCI-004774': 'SA-8 (30)', - 'CCI-004775': 'SA-8 (30)', - 'CCI-004776': 'SA-8 (31)', - 'CCI-004777': 'SA-8 (31)', - 'CCI-004778': 'SA-8 (32)', - 'CCI-004779': 'SA-8 (32)', - 'CCI-004780': 'SA-8 (33)', - 'CCI-004781': 'SA-8 (33)', - 'CCI-004782': 'SA-9 a', - 'CCI-004783': 'SA-9 a', - 'CCI-004784': 'SA-9 a', - 'CCI-004785': 'SA-9 b', - 'CCI-004786': 'SA-9 b', - 'CCI-004787': 'SA-9 (3)', - 'CCI-004788': 'SA-9 (3)', - 'CCI-004789': 'SA-9 (3)', - 'CCI-004790': 'SA-9 (3)', - 'CCI-004791': 'SA-9 (6)', - 'CCI-004792': 'SA-9 (7)', - 'CCI-004793': 'SA-9 (8)', - 'CCI-004794': 'SA-10 d', - 'CCI-004795': 'SA-10 (7)', - 'CCI-004796': 'SA-10 (7)', - 'CCI-004797': 'SA-10 (7)', - 'CCI-004798': 'SA-11 a', - 'CCI-004799': 'SA-11 a', - 'CCI-004800': 'SA-11 b', - 'CCI-004801': 'SA-11 (2) (a)', - 'CCI-004802': 'SA-11 (2) (a)', - 'CCI-004803': 'SA-11 (2) (b)', - 'CCI-004804': 'SA-11 (2) (b)', - 'CCI-004805': 'SA-11 (2) (c)', - 'CCI-004806': 'SA-11 (2) (c)', - 'CCI-004807': 'SA-11 (2) (d)', - 'CCI-004808': 'SA-11 (2) (d)', - 'CCI-004809': 'SA-11 (3) (a)', - 'CCI-004810': 'SA-11 (3) (a)', - 'CCI-004811': 'SA-11 (3) (a)', - 'CCI-004812': 'SA-11 (5) (a)', - 'CCI-004813': 'SA-11 (5) (b)', - 'CCI-004814': 'SA-11 (9)', - 'CCI-004815': 'SA-11 (9)', - 'CCI-004816': 'SA-15 a 1', - 'CCI-004817': 'SA-15 b', - 'CCI-004818': 'SA-15 b', - 'CCI-004819': 'SA-15 b', - 'CCI-004820': 'SA-15 b', - 'CCI-004821': 'SA-15 b', - 'CCI-004822': 'SA-15 b', - 'CCI-004823': 'SA-15 (2)', - 'CCI-004824': 'SA-15 (2)', - 'CCI-004825': 'SA-15 (3) (a)', - 'CCI-004826': 'SA-15 (3) (b)', - 'CCI-004827': 'SA-15 (7) (a)', - 'CCI-004828': 'SA-15 (7) (b)', - 'CCI-004829': 'SA-15 (7) (c)', - 'CCI-004830': 'SA-15 (7) (d)', - 'CCI-004831': 'SA-15 (10)', - 'CCI-004832': 'SA-15 (10)', - 'CCI-004833': 'SA-15 (11)', - 'CCI-004834': 'SA-15 (12)', - 'CCI-004835': 'SA-16', - 'CCI-004836': 'SA-16', - 'CCI-004837': 'SA-17', - 'CCI-004838': 'SA-17 a', - 'CCI-004839': 'SA-17 b', - 'CCI-004840': 'SA-17 b', - 'CCI-004841': 'SA-17 c', - 'CCI-004842': 'SA-17 (1) (a)', - 'CCI-004843': 'SA-17 (1) (a)', - 'CCI-004844': 'SA-17 (1) (b)', - 'CCI-004845': 'SA-17 (8)', - 'CCI-004846': 'SA-17 (8)', - 'CCI-004847': 'SA-17 (8)', - 'CCI-004848': 'SA-17 (9)', - 'CCI-004849': 'SA-17 (9)', - 'CCI-004850': 'SA-23', - 'CCI-004851': 'SA-23', - 'CCI-004852': 'SC-1 a 1 (a)', - 'CCI-004853': 'SC-1 a 1 (b)', - 'CCI-004854': 'SC-1 a 2', - 'CCI-004855': 'SC-1 b', - 'CCI-004856': 'SC-1 b', - 'CCI-004857': 'SC-1 b', - 'CCI-004858': 'SC-1 b', - 'CCI-004859': 'SC-1 b', - 'CCI-004860': 'SC-1 b', - 'CCI-004861': 'SC-1 c 1', - 'CCI-004862': 'SC-1 c 1', - 'CCI-004863': 'SC-1 c 2', - 'CCI-004864': 'SC-1 c 2', - 'CCI-004865': 'SC-2 (2)', - 'CCI-004866': 'SC-5 b', - 'CCI-004867': 'SC-5 b', - 'CCI-004868': 'SC-7 c', - 'CCI-004869': 'SC-7 (4) (f)', - 'CCI-004870': 'SC-7 (4) (g)', - 'CCI-004871': 'SC-7 (4) (h)', - 'CCI-004872': 'SC-7 (5)', - 'CCI-004873': 'SC-7 (7)', - 'CCI-004874': 'SC-7 (10) (b)', - 'CCI-004875': 'SC-7 (10) (b)', - 'CCI-004876': 'SC-7 (24) (a)', - 'CCI-004877': 'SC-7 (24) (a)', - 'CCI-004878': 'SC-7 (24) (b)', - 'CCI-004879': 'SC-7 (24) (c)', - 'CCI-004880': 'SC-7 (24) (d)', - 'CCI-004881': 'SC-7 (25)', - 'CCI-004882': 'SC-7 (25)', - 'CCI-004883': 'SC-7 (25)', - 'CCI-004884': 'SC-7 (26)', - 'CCI-004885': 'SC-7 (26)', - 'CCI-004886': 'SC-7 (27)', - 'CCI-004887': 'SC-7 (27)', - 'CCI-004888': 'SC-7 (27)', - 'CCI-004889': 'SC-7 (28)', - 'CCI-004890': 'SC-7 (28)', - 'CCI-004891': 'SC-7 (29)', - 'CCI-004892': 'SC-7 (29)', - 'CCI-004893': 'SC-8 (5)', - 'CCI-004894': 'SC-8 (5)', - 'CCI-004895': 'SC-11 b', - 'CCI-004896': 'SC-11 (1) (b)', - 'CCI-004897': 'SC-11 (1) (b)', - 'CCI-004898': 'SC-12 (3)', - 'CCI-004899': 'SC-12 (6)', - 'CCI-004900': 'SC-13 a', - 'CCI-004901': 'SC-16', - 'CCI-004902': 'SC-16', - 'CCI-004903': 'SC-16', - 'CCI-004904': 'SC-16 (1)', - 'CCI-004905': 'SC-16 (2)', - 'CCI-004906': 'SC-16 (3)', - 'CCI-004907': 'SC-16 (3)', - 'CCI-004908': 'SC-16 (3)', - 'CCI-004909': 'SC-17 b', - 'CCI-004910': 'SC-28 (3)', - 'CCI-004911': 'SC-28 (3)', - 'CCI-004912': 'SC-32 (1)', - 'CCI-004913': 'SC-36 (1) (b)', - 'CCI-004914': 'SC-36 (1) (b)', - 'CCI-004915': 'SC-36 (2)', - 'CCI-004916': 'SC-36 (2)', - 'CCI-004917': 'SC-42 (4)', - 'CCI-004918': 'SC-42 (4)', - 'CCI-004919': 'SC-42 (4)', - 'CCI-004920': 'SC-42 (5)', - 'CCI-004921': 'SC-42 (5)', - 'CCI-004922': 'SC-45', - 'CCI-004923': 'SC-45 (1) (a)', - 'CCI-004924': 'SC-45 (1) (a)', - 'CCI-004925': 'SC-45 (1) (a)', - 'CCI-004926': 'SC-45 (1) (b)', - 'CCI-004927': 'SC-45 (1) (b)', - 'CCI-004928': 'SC-45 (2) (a)', - 'CCI-004929': 'SC-45 (2) (b)', - 'CCI-004930': 'SC-46', - 'CCI-004931': 'SC-47', - 'CCI-004932': 'SC-48', - 'CCI-004933': 'SC-48', - 'CCI-004934': 'SC-48', - 'CCI-004935': 'SC-48', - 'CCI-004936': 'SC-48 (1)', - 'CCI-004937': 'SC-48 (1)', - 'CCI-004938': 'SC-48 (1)', - 'CCI-004939': 'SC-48 (1)', - 'CCI-004940': 'SC-49', - 'CCI-004941': 'SC-49', - 'CCI-004942': 'SC-50', - 'CCI-004943': 'SC-50', - 'CCI-004944': 'SI-1 a 1 (b)', - 'CCI-004945': 'SI-1 b', - 'CCI-004946': 'SI-1 b', - 'CCI-004947': 'SI-1 b', - 'CCI-004948': 'SI-1 b', - 'CCI-004949': 'SI-1 b', - 'CCI-004950': 'SI-1 b', - 'CCI-004951': 'SI-1 c 1', - 'CCI-004952': 'SI-1 c 1', - 'CCI-004953': 'SI-1 c 2', - 'CCI-004954': 'SI-1 c 2', - 'CCI-004955': 'SI-2 (2)', - 'CCI-004956': 'SI-2 (2)', - 'CCI-004957': 'SI-2 (2)', - 'CCI-004958': 'SI-2 (2)', - 'CCI-004959': 'SI-2 (2)', - 'CCI-004960': 'SI-2 (2)', - 'CCI-004961': 'SI-2 (4)', - 'CCI-004962': 'SI-2 (4)', - 'CCI-004963': 'SI-3 a', - 'CCI-004964': 'SI-3 b', - 'CCI-004965': 'SI-3 b', - 'CCI-004966': 'SI-3 c 2', - 'CCI-004967': 'SI-4 d', - 'CCI-004968': 'SI-4 (2)', - 'CCI-004969': 'SI-4 (3)', - 'CCI-004970': 'SI-4 (3)', - 'CCI-004971': 'SI-4 (4) (a)', - 'CCI-004972': 'SI-4 (4) (a)', - 'CCI-004973': 'SI-4 (4) (b)', - 'CCI-004974': 'SI-4 (4) (b)', - 'CCI-004975': 'SI-4 (9)', - 'CCI-004976': 'SI-4 (9)', - 'CCI-004977': 'SI-4 (10)', - 'CCI-004978': 'SI-4 (10)', - 'CCI-004979': 'SI-4 (10)', - 'CCI-004980': 'SI-4 (12)', - 'CCI-004981': 'SI-4 (16)', - 'CCI-004982': 'SI-4 (25)', - 'CCI-004983': 'SI-5 (1)', - 'CCI-004984': 'SI-6 a', - 'CCI-004985': 'SI-6 a', - 'CCI-004986': 'SI-6 b', - 'CCI-004987': 'SI-6 b', - 'CCI-004988': 'SI-6 b', - 'CCI-004989': 'SI-6 c', - 'CCI-004990': 'SI-6 c', - 'CCI-004991': 'SI-6 d', - 'CCI-004992': 'SI-6 d', - 'CCI-004993': 'SI-6 (2)', - 'CCI-004994': 'SI-6 (3)', - 'CCI-004995': 'SI-6 (3)', - 'CCI-004996': 'SI-7 b', - 'CCI-004997': 'SI-7 b', - 'CCI-004998': 'SI-7 (17)', - 'CCI-004999': 'SI-7 (17)', - 'CCI-005000': 'SI-8 b', - 'CCI-005001': 'SI-8 b', - 'CCI-005002': 'SI-8 (2)', - 'CCI-005003': 'SI-10 (6)', - 'CCI-005004': 'SI-12 (1)', - 'CCI-005005': 'SI-12 (1)', - 'CCI-005006': 'SI-12 (2)', - 'CCI-005007': 'SI-12 (2)', - 'CCI-005008': 'SI-12 (3)', - 'CCI-005009': 'SI-13 (3)', - 'CCI-005010': 'SI-13 (4) (b)', - 'CCI-005011': 'SI-14 (2) (a)', - 'CCI-005012': 'SI-14 (2) (a)', - 'CCI-005013': 'SI-14 (2) (a)', - 'CCI-005014': 'SI-14 (2) (a)', - 'CCI-005015': 'SI-14 (2) (b)', - 'CCI-005016': 'SI-14 (3)', - 'CCI-005017': 'SI-14 (3)', - 'CCI-005018': 'SI-18 a', - 'CCI-005019': 'SI-18 a', - 'CCI-005020': 'SI-18 b 1', - 'CCI-005021': 'SI-18 (1)', - 'CCI-005022': 'SI-18 (1)', - 'CCI-005023': 'SI-18 (2)', - 'CCI-005024': 'SI-18 (3)', - 'CCI-005025': 'SI-18 (4)', - 'CCI-005026': 'SI-18 (5)', - 'CCI-005027': 'SI-18 (5)', - 'CCI-005028': 'SI-18 (5)', - 'CCI-005029': 'SI-19 a', - 'CCI-005030': 'SI-19 a', - 'CCI-005031': 'SI-19 b', - 'CCI-005032': 'SI-19 b', - 'CCI-005033': 'SI-19 (1)', - 'CCI-005034': 'SI-19 (2)', - 'CCI-005035': 'SI-19 (3)', - 'CCI-005036': 'SI-19 (4)', - 'CCI-005037': 'SI-19 (5)', - 'CCI-005038': 'SI-19 (6)', - 'CCI-005039': 'SI-19 (7)', - 'CCI-005040': 'SI-19 (8)', - 'CCI-005041': 'SI-20', - 'CCI-005042': 'SI-20', - 'CCI-005043': 'SI-21', - 'CCI-005044': 'SI-21', - 'CCI-005045': 'SI-21', - 'CCI-005046': 'SI-22 a', - 'CCI-005047': 'SI-22 a', - 'CCI-005048': 'SI-22 b', - 'CCI-005049': 'SI-22 b', - 'CCI-005050': 'SI-23 a', - 'CCI-005051': 'SI-23 a', - 'CCI-005052': 'SI-23 a', - 'CCI-005053': 'SI-23 b', - 'CCI-005054': 'SI-23 b', - 'CCI-005055': 'SI-23 b', - 'CCI-005056': 'SR-1 a 1', - 'CCI-005057': 'SR-1 a 1 (a)', - 'CCI-005058': 'SR-1 a 1 (b)', - 'CCI-005059': 'SR-1 a 2', - 'CCI-005060': 'SR-1 b', - 'CCI-005061': 'SR-1 b', - 'CCI-005062': 'SR-1 b', - 'CCI-005063': 'SR-1 b', - 'CCI-005064': 'SR-1 c 1', - 'CCI-005065': 'SR-1 c 1', - 'CCI-005066': 'SR-1 c 1', - 'CCI-005067': 'SR-1 c 1', - 'CCI-005068': 'SR-1 c 2', - 'CCI-005069': 'SR-1 c 2', - 'CCI-005070': 'SR-1 c 2', - 'CCI-005071': 'SR-1 c 2', - 'CCI-005072': 'SR-2 a', - 'CCI-005073': 'SR-2 a', - 'CCI-005074': 'SR-2 b', - 'CCI-005075': 'SR-2 b', - 'CCI-005076': 'SR-2 c', - 'CCI-005077': 'SR-2 (1)', - 'CCI-005078': 'SR-2 (1)', - 'CCI-005079': 'SR-2 (1)', - 'CCI-005080': 'SR-3 a', - 'CCI-005081': 'SR-3 a', - 'CCI-005082': 'SR-3 a', - 'CCI-005083': 'SR-3 a', - 'CCI-005084': 'SR-3 a', - 'CCI-005085': 'SR-3 a', - 'CCI-005086': 'SR-3 b', - 'CCI-005087': 'SR-3 b', - 'CCI-005088': 'SR-3 b', - 'CCI-005089': 'SR-3 c', - 'CCI-005090': 'SR-3 c', - 'CCI-005091': 'SR-3 (1)', - 'CCI-005092': 'SR-3 (1)', - 'CCI-005093': 'SR-3 (2)', - 'CCI-005094': 'SR-3 (2)', - 'CCI-005095': 'SR-3 (3)', - 'CCI-005096': 'SR-4', - 'CCI-005097': 'SR-4', - 'CCI-005098': 'SR-4', - 'CCI-005099': 'SR-4', - 'CCI-005100': 'SR-4 (1)', - 'CCI-005101': 'SR-4 (1)', - 'CCI-005102': 'SR-4 (2)', - 'CCI-005103': 'SR-4 (2)', - 'CCI-005104': 'SR-4 (3)', - 'CCI-005105': 'SR-4 (3)', - 'CCI-005106': 'SR-4 (3)', - 'CCI-005107': 'SR-4 (3)', - 'CCI-005108': 'SR-4 (4)', - 'CCI-005109': 'SR-4 (4)', - 'CCI-005110': 'SR-4 (4)', - 'CCI-005111': 'SR-4 (4)', - 'CCI-005112': 'SR-5', - 'CCI-005113': 'SR-5', - 'CCI-005114': 'SR-5 (1)', - 'CCI-005115': 'SR-5 (1)', - 'CCI-005116': 'SR-5 (1)', - 'CCI-005117': 'SR-5 (2)', - 'CCI-005118': 'SR-6', - 'CCI-005119': 'SR-6', - 'CCI-005120': 'SR-6 (1)', - 'CCI-005121': 'SR-6 (1)', - 'CCI-005122': 'SR-7', - 'CCI-005123': 'SR-7', - 'CCI-005124': 'SR-8', - 'CCI-005125': 'SR-8', - 'CCI-005126': 'SR-9', - 'CCI-005127': 'SR-9 (1)', - 'CCI-005128': 'SR-10', - 'CCI-005129': 'SR-10', - 'CCI-005130': 'SR-10', - 'CCI-005131': 'SR-10', - 'CCI-005132': 'SR-11 a', - 'CCI-005133': 'SR-11 a', - 'CCI-005134': 'SR-11 b', - 'CCI-005135': 'SR-11 b', - 'CCI-005136': 'SR-11 b', - 'CCI-005137': 'SR-11 (1)', - 'CCI-005138': 'SR-11 (1)', - 'CCI-005139': 'SR-11 (2)', - 'CCI-005140': 'SR-11 (2)', - 'CCI-005141': 'SR-11 (2)', - 'CCI-005142': 'SR-11 (3)', - 'CCI-005143': 'SR-11 (3)', - 'CCI-005144': 'SR-12', - 'CCI-005145': 'SR-12', - 'CCI-005146': 'SR-12', - 'CCI-005147': 'AT-2 a 1', - 'CCI-005149': 'AU-16 (3)', - 'CCI-005150': 'PM-30 (1)' -}; +import cciToNistData from './U_CCI_List.nist.json'; +import cciToDefinitionData from './U_CCI_List.defs.json'; -export const CCI_TO_DEFINITION: Record = { - 'CCI-000001': - 'The organization develops an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000002': - 'Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.', - 'CCI-000003': - 'Review and update the current access control policy on an organization-defined frequency.', - 'CCI-000004': - 'The organization develops procedures to facilitate the implementation of the access control policy and associated access controls.', - 'CCI-000005': - 'Disseminate procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls to the organization-defined personnel or roles.', - 'CCI-000006': - 'Review and update the current access control procedures on an organization-defined frequency.', - 'CCI-000007': - 'The organization manages information system accounts by identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary).', - 'CCI-000008': 'The organization establishes conditions for group membership.', - 'CCI-000009': - 'The organization manages information system accounts by identifying authorized users of the information system and specifying access privileges.', - 'CCI-000010': - 'Require approvals by organization-defined personnel or roles for requests to create accounts.', - 'CCI-000011': - 'Create, enable, modify, disable, and remove system accounts in accordance with organization-defined procedures.', - 'CCI-000012': - 'Review accounts for compliance with account management requirements per organization-defined frequency.', - 'CCI-000013': - 'The organization manages information system accounts by notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes.', - 'CCI-000014': - 'The organization manages information system accounts by granting access to the system based on a valid access authorization; intended system usage; and other attributes as required by the organization or associated missions/business functions.', - 'CCI-000015': - 'Support the management of system accounts using organization-defined automated mechanisms.', - 'CCI-000016': - 'Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account.', - 'CCI-000017': - 'Disable accounts when the accounts have been inactive for the organization-defined time-period.', - 'CCI-000018': 'Automatically audit account creation actions.', - 'CCI-000019': - 'Require that users log out in accordance with the organization-defined time-period of expected inactivity or description of when to log out.', - 'CCI-000020': - 'The information system dynamically manages user privileges and associated access authorizations.', - 'CCI-000021': - 'Enforce dual authorization for organization-defined privileged commands and/or other organization-defined actions.', - 'CCI-000022': - 'The information system enforces one or more organization-defined nondiscretionary access control policies over an organization-defined set of users and resources.', - 'CCI-000023': - 'The organization develops an organization-wide information security program plan that provides sufficient information about the program management controls and common controls (including specification of parameters for any assignment and selection operations either explicitly or by reference) to enable an implementation that is unambiguously compliant with the intent of the plan, and a determination of the risk to be incurred if the plan is implemented as intended.', - 'CCI-000024': - 'Prevent access to organization-defined security-relevant information except during secure, non-operable system states.', - 'CCI-000025': - 'The information system enforces information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions.', - 'CCI-000026': - 'Use protected processing domains to enforce organization-defined information flow control policies as a basis for flow control decisions.', - 'CCI-000027': - 'Enforce organization-defined information flow control policies.', - 'CCI-000028': - 'Prevent encrypted information from bypassing organization-defined flow control mechanisms by employing organization-defined procedures or methods.', - 'CCI-000029': - 'Enforce organization-defined limitations on embedding data types within other data types.', - 'CCI-000030': - 'Enforce information flow control based on organization-defined metadata.', - 'CCI-000031': - 'Enforce one-way information flows using hardware-based flow control mechanisms.', - 'CCI-000032': - 'Enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.', - 'CCI-000033': - 'The information system enforces the use of human review for organization-defined security policy filters when the system is not capable of making an information flow control decision.', - 'CCI-000034': - 'Provide the capability for privileged administrators to enable and disable organization-defined security or privacy filters under organization-defined conditions.', - 'CCI-000035': - 'Provide the capability for privileged administrators to configure the organization-defined security or privacy policy filters to support different security or privacy policies.', - 'CCI-000036': - 'The organization separates organization-defined duties of individuals.', - 'CCI-000037': - 'The organization implements separation of duties through assigned information system access authorizations.', - 'CCI-000038': - 'The organization explicitly authorizes access to organization-defined security functions and security-relevant information.', - 'CCI-000039': - 'Require that users of system accounts, or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts or roles, when accessing nonsecurity functions.', - 'CCI-000040': - 'The organization audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions.', - 'CCI-000041': - 'Authorize network access to organization-defined privileged commands only for organization-defined compelling operational needs.', - 'CCI-000042': - 'Document the rationale for authorized network access to organization-defined privileged commands in the security plan for the system.', - 'CCI-000043': - 'Defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period.', - 'CCI-000044': - 'Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.', - 'CCI-000045': - 'The organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period.', - 'CCI-000046': - 'The organization selects either a lock out mode for the organization-defined time period or delays the next login prompt for the organization-defined delay period for information system responses to consecutive invalid access attempts.', - 'CCI-000047': - 'The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccessful attempts is exceeded, automatically locks the account/node for an organization-defined time period or locks the account/node until released by an Administrator IAW organizational policy.', - 'CCI-000048': - 'Display an organization-defined system use notification message or banner to users before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines.', - 'CCI-000049': - 'The organization defines a system use notification message or banner displayed before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) use of the system indicates consent to monitoring and recording.', - 'CCI-000050': - 'Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.', - 'CCI-000051': - 'The organization approves the information system use notification message before its use.', - 'CCI-000052': - 'Notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access).', - 'CCI-000053': - 'Notify the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.', - 'CCI-000054': - 'Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.', - 'CCI-000055': - 'Defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type.', - 'CCI-000056': - 'Retain the device lock until the user reestablishes access using established identification and authentication procedures.', - 'CCI-000057': - 'Prevent further access to the system by initiating a device lock after organization-defined time period of inactivity; and/or requiring the user to initiate a device lock before leaving the system unattended.', - 'CCI-000058': - 'The information system provides the capability for users to directly initiate session lock mechanisms.', - 'CCI-000059': - 'Defines the time-period of inactivity after which the system initiates a device lock.', - 'CCI-000060': - 'Conceal, via the device lock, information previously visible on the display with a publicly viewable image.', - 'CCI-000061': - 'Identify organization-defined user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.', - 'CCI-000062': - 'The organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission/business objectives.', - 'CCI-000063': - 'The organization defines allowed methods of remote access to the information system.', - 'CCI-000064': - 'The organization establishes usage restrictions and implementation guidance for each allowed remote access method.', - 'CCI-000065': - 'Authorize remote access to the system prior to allowing such connections.', - 'CCI-000066': - 'The organization enforces requirements for remote connections to the information system.', - 'CCI-000067': 'Employ automated mechanisms to monitor remote access methods.', - 'CCI-000068': - 'Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.', - 'CCI-000069': - 'Route all remote accesses through authorized and managed network access control points.', - 'CCI-000070': - 'Authorize the execution of privileged commands via remote access only in a format that provides assessable evidence for organization-defined needs.', - 'CCI-000071': - 'The organization monitors for unauthorized remote connections to the information system on an organization-defined frequency.', - 'CCI-000072': - 'Protect information about remote access mechanisms from unauthorized use and disclosure.', - 'CCI-000073': - 'Develop an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.', - 'CCI-000074': - 'Develop an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.', - 'CCI-000075': - 'Review and update the organization-wide information security program plan on an organization-defined frequency.', - 'CCI-000076': - 'Defines the frequency with which to review and update the organization-wide information security program plan.', - 'CCI-000077': - 'The organization updates the plan to address organizational changes and problems identified during plan implementation or security control assessments.', - 'CCI-000078': - 'Appoint a Senior Information Security Officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.', - 'CCI-000079': - 'The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information employ organization-defined additional security measures.', - 'CCI-000080': - 'Include the resources needed to implement the information security programs in capital planning and investment requests and document all exceptions to this requirement.', - 'CCI-000081': - 'The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required.', - 'CCI-000082': - 'The organization establishes usage restrictions for organization-controlled mobile devices.', - 'CCI-000083': - 'Establish implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas.', - 'CCI-000084': - 'Authorize connection of mobile devices to organizational systems.', - 'CCI-000085': - 'The organization monitors for unauthorized connections of mobile devices to organizational information systems.', - 'CCI-000086': - 'The organization enforces requirements for the connection of mobile devices to organizational information systems.', - 'CCI-000087': - 'The organization disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction.', - 'CCI-000088': - 'The organization issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.', - 'CCI-000089': - 'The organization applies organization-defined inspection and preventative measures to mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.', - 'CCI-000090': - 'The organization restricts the use of writable, removable media in organizational information systems.', - 'CCI-000091': - 'The organization prohibits the use of personally-owned, removable media in organizational information systems.', - 'CCI-000092': - 'The organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner.', - 'CCI-000093': - 'Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from the external systems.', - 'CCI-000094': - 'The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process organization-controlled information using the external information systems.', - 'CCI-000095': - "The organization prohibits authorized individuals from using an external information system to access the information system except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.", - 'CCI-000096': - 'The organization prohibits authorized individuals from using an external information system to access the information system or to process, store, or transmit organization-controlled information except in situations where the organization has approved information system connection or processing agreements with the organizational entity hosting the external information system.', - 'CCI-000097': - 'Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using organization-defined restrictions.', - 'CCI-000098': - "Enable authorized users to determine whether access authorizations assigned to the sharing partner match the information's access and use restrictions for organization-defined information sharing circumstances where user discretion is required.", - 'CCI-000099': - 'Employ organization-defined automated mechanisms to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.', - 'CCI-000100': - 'Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000101': - 'Disseminate an organization level, mission/business process-level, or system-level awareness and training policy to organization-defined personnel or roles.', - 'CCI-000102': - 'Review and update the current security awareness and training policy in accordance with organization-defined frequency.', - 'CCI-000103': - 'Develop and document procedures to facilitate the implementation of the awareness and training policy and associated awareness and training controls.', - 'CCI-000104': - 'Disseminate organization-level; mission/business process-level; or system-level awareness and training procedures to organization-defined personnel or roles.', - 'CCI-000105': - 'Review and update the current security awareness and training procedures in accordance with an organization-defined frequency.', - 'CCI-000106': - 'Provide basic security literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users.', - 'CCI-000107': - 'Provide practical exercises in literacy training that simulate events and incidents.', - 'CCI-000108': - 'Provide role-based security training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.', - 'CCI-000109': - 'Provide role-based security training to personnel with organization-defined roles and responsibilities when required by system changes.', - 'CCI-000110': - 'The organization provides refresher role-based security training to personnel with assigned security roles and responsibilities in accordance with organization-defined frequency.', - 'CCI-000111': - 'The organization defines a frequency for providing refresher role-based security training.', - 'CCI-000112': - 'Provide basic security awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events.', - 'CCI-000113': - 'Document individual security training activities, including security awareness training and specific system security training.', - 'CCI-000114': - 'Monitor individual information security training activities, including security awareness training and specific security training.', - 'CCI-000115': - 'The organization establishes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.', - 'CCI-000116': - 'The organization institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.', - 'CCI-000117': - 'Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000118': - 'The organization disseminates a formal, documented, audit and accountability policy to elements within the organization having associated audit and accountability roles and responsibilities.', - 'CCI-000119': - 'Review and update the current audit and accountability policy on an organization-defined frequency.', - 'CCI-000120': - 'Develop and document procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.', - 'CCI-000121': - 'The organization disseminates formal, documented, procedures to elements within the organization having associated audit and accountability roles and responsibilities.', - 'CCI-000122': - 'Review and update the current audit and accountability procedures on an organization-defined frequency.', - 'CCI-000123': - 'Identify the organization-defined event types that the system is capable of logging in support of the audit function.', - 'CCI-000124': - 'Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.', - 'CCI-000125': - 'Provide a rationale for why the event types selected for logging are deemed to be adequate for support after-the-fact investigations of incidents.', - 'CCI-000126': - 'Specify the organization-defined event types (subset of the event types defined in AU-2a) along with the frequency of (or situation requiring logging for each identified event type.', - 'CCI-000127': - 'The organization reviews and updates the list of organization-defined audited events on an organization-defined frequency.', - 'CCI-000128': - 'The organization includes execution of privileged functions in the list of events to be audited by the information system.', - 'CCI-000129': - 'The organization defines in the auditable events that the information system must be capable of auditing based on a risk assessment and mission/business needs.', - 'CCI-000130': - 'Ensure that audit records contain information that establishes what type of event occurred.', - 'CCI-000131': - 'Ensure that audit records containing information that establishes when the event occurred.', - 'CCI-000132': - 'Ensure that audit records containing information that establishes where the event occurred.', - 'CCI-000133': - 'Ensure that audit records containing information that establishes the source of the event.', - 'CCI-000134': - 'Ensure that audit records containing information that establishes the outcome of the event.', - 'CCI-000135': - 'Generate audit records containing the organization-defined additional information that is to be included in the audit records.', - 'CCI-000136': - 'The organization centrally manages the content of audit records generated by organization-defined information system components.', - 'CCI-000137': 'The organization allocates audit record storage capacity.', - 'CCI-000138': - 'The organization configures auditing to reduce the likelihood of storage capacity being exceeded.', - 'CCI-000139': - 'Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.', - 'CCI-000140': - 'Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.', - 'CCI-000141': - 'Make available for expenditure, the planned information security resources.', - 'CCI-000142': - 'Implement a process to ensure that plans of action and milestones for the information security program and the associated organizational systems are maintained.', - 'CCI-000143': - 'The information system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.', - 'CCI-000144': - 'The information system provides a real-time alert when organization-defined audit failure events occur.', - 'CCI-000145': - 'Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity by delaying or rejecting network traffic above those organization-defined thresholds.', - 'CCI-000146': - 'The organization defines the percentage of maximum audit record storage capacity that when exceeded, a warning is provided.', - 'CCI-000147': - 'Defines the audit logging failure events requiring real-time alerts.', - 'CCI-000148': - 'Review and analyze system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusual activity.', - 'CCI-000149': - 'Report any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity.', - 'CCI-000150': - 'The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to organizational operations, organizational assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.', - 'CCI-000151': - 'Defines the frequency for the review and analysis of system audit records for organization-defined inappropriate or unusual activity.', - 'CCI-000152': - 'The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.', - 'CCI-000153': - 'Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.', - 'CCI-000154': - 'Provide the capability to centrally review and analyze audit records from multiple components within the system.', - 'CCI-000155': - 'The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to further enhance the ability to identify inappropriate or unusual activity.', - 'CCI-000156': - 'The information system provides an audit reduction capability.', - 'CCI-000157': - 'The information system provides a report generation capability.', - 'CCI-000158': - 'Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.', - 'CCI-000159': - 'Use internal system clocks to generate time stamps for audit records.', - 'CCI-000160': - 'The information system synchronizes internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.', - 'CCI-000161': - 'The organization defines the frequency for the synchronization of internal information system clocks.', - 'CCI-000162': 'Protect audit information from unauthorized access.', - 'CCI-000163': 'Protect audit information from unauthorized modification.', - 'CCI-000164': 'Protect audit information from unauthorized deletion.', - 'CCI-000165': 'Write audit records to hardware-enforced, write-once media.', - 'CCI-000166': - 'Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.', - 'CCI-000167': - 'Retain audit records for an organization-defined time period to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.', - 'CCI-000168': - 'Defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after-the-fact investigations of incidents and meet regulatory and organizational information retention requirements.', - 'CCI-000169': - 'Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defined information system components.', - 'CCI-000170': - 'Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.', - 'CCI-000171': - 'Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.', - 'CCI-000172': - 'Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.', - 'CCI-000173': - 'Defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.', - 'CCI-000174': - 'Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.', - 'CCI-000175': - 'The organization manages information system authenticators for users and devices by verifying, as part of the initial authenticator distribution, the identity of the individual and/or device receiving the authenticator.', - 'CCI-000176': - 'Manage system authenticators by establishing initial authenticator content for authenticators issued by the organization.', - 'CCI-000177': - 'The organization manages information system authenticators for users and devices by establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators.', - 'CCI-000178': - 'The organization manages information system authenticators for users and devices by changing default content of authenticators upon information system installation.', - 'CCI-000179': - 'The organization manages information system authenticators by establishing minimum lifetime restrictions for authenticators.', - 'CCI-000180': - 'The organization manages information system authenticators by establishing maximum lifetime restrictions for authenticators.', - 'CCI-000181': - 'The organization manages information system authenticators by establishing reuse conditions for authenticators.', - 'CCI-000182': - 'Manage system authenticators by changing or refreshing authenticators in accordance with the organization-defined time period by authenticator type or when organization-defined events occur.', - 'CCI-000183': - 'Manage system authenticators by protecting authenticator content from unauthorized disclosure.', - 'CCI-000184': - 'Manage system authenticators by requiring individuals to take, and having devices implement, specific security controls to protect authenticators.', - 'CCI-000185': - 'For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.', - 'CCI-000186': - 'For public key-based authentication, enforce authorized access to the corresponding private key.', - 'CCI-000187': - 'For public key-based authentication, map the authenticated identity to the account of the individual or group.', - 'CCI-000188': - 'The organization requires that the registration process to receive an organizational-defined type of authenticator be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).', - 'CCI-000189': - 'The organization employs automated tools to determine if authenticators are sufficiently strong to resist attacks intended to discover or otherwise compromise the authenticators.', - 'CCI-000190': - 'The organization requires vendors/manufacturers of information system components to provide unique authenticators or change default authenticators prior to delivery.', - 'CCI-000191': - 'The organization enforces password complexity by the number of special characters used.', - 'CCI-000192': - 'The information system enforces password complexity by the minimum number of upper case characters used.', - 'CCI-000193': - 'The information system enforces password complexity by the minimum number of lower case characters used.', - 'CCI-000194': - 'The information system enforces password complexity by the minimum number of numeric characters used.', - 'CCI-000195': - 'The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.', - 'CCI-000196': - 'The information system, for password-based authentication, stores only cryptographically-protected passwords.', - 'CCI-000197': - 'For password-based authentication, transmit passwords only over cryptographically-protected channels.', - 'CCI-000198': - 'The information system enforces minimum password lifetime restrictions.', - 'CCI-000199': - 'The information system enforces maximum password lifetime restrictions.', - 'CCI-000200': - 'The information system prohibits password reuse for the organization-defined number of generations.', - 'CCI-000201': - 'Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.', - 'CCI-000202': - 'The organization ensures unencrypted static authenticators are not embedded in access scripts.', - 'CCI-000203': - 'The organization ensures unencrypted static authenticators are not stored on function keys.', - 'CCI-000204': - 'Defines the security controls required to manage the risk of compromise due to individuals having accounts on multiple systems.', - 'CCI-000205': 'The information system enforces minimum password length.', - 'CCI-000206': - 'Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.', - 'CCI-000207': - 'The organization develops and maintains an inventory of its information systems.', - 'CCI-000208': - 'The organization determines normal time-of-day and duration usage for information system accounts.', - 'CCI-000209': - 'Develop the results of information security measures of performance.', - 'CCI-000210': - 'Monitor the results of information security measures of performance.', - 'CCI-000211': - 'Report on the results of information security measures of performance.', - 'CCI-000212': - 'Develop an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.', - 'CCI-000213': - 'Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.', - 'CCI-000214': - 'The organization establishes a Discretionary Access Control (DAC) policy that limits propagation of access rights.', - 'CCI-000215': - 'The organization establishes a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.', - 'CCI-000216': - 'Address information security issues in the development and documentation of a critical infrastructure and key resources protection plan.', - 'CCI-000217': - 'Defines a time period after which inactive accounts are automatically disabled.', - 'CCI-000218': - 'The information system, when transferring information between different security domains, identifies information flows by data type specification and usage.', - 'CCI-000219': - 'When transferring information between different security domains, decompose information into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms.', - 'CCI-000221': - 'The information system enforces security policies regarding information on interconnected systems.', - 'CCI-000223': - 'The information system binds security attributes to information to facilitate information flow policy enforcement.', - 'CCI-000224': - 'The information system tracks problems associated with the security attribute binding.', - 'CCI-000225': - 'Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks.', - 'CCI-000226': - 'The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to support different security policies.', - 'CCI-000227': - 'Develop a comprehensive strategy to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems.', - 'CCI-000228': - 'Implement the risk management strategy consistently across the organization.', - 'CCI-000229': - 'The organization documents the security state of organizational information systems and the environments in which those systems operate through security authorization processes.', - 'CCI-000230': - 'The organization tracks the security state of organizational information systems and the environments in which those systems operate through security authorization processes.', - 'CCI-000231': - 'The organization reports the security state of organizational information systems and the environments in which those systems operate through security authorization processes.', - 'CCI-000232': - 'Document and provide supporting rationale in the security plan for the system, user actions not requiring identification and authentication.', - 'CCI-000233': - 'Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process.', - 'CCI-000234': - 'Integrate the authorization processes into an organization-wide risk management program.', - 'CCI-000235': - 'Define organizational mission and business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.', - 'CCI-000236': - 'Determine information protection needs arising from the defined mission and business processes.', - 'CCI-000237': - 'The organization manages information system accounts by specifically authorizing and monitoring the use of guest/anonymous accounts and temporary accounts.', - 'CCI-000238': - 'Defines the frequency to review and update the current assessment, authorization, and monitoring policy.', - 'CCI-000239': - 'Develop and document an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000240': - 'Disseminates to organization-defined personnel or roles an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy.', - 'CCI-000241': - 'Review and update the current assessment, authorization, and monitoring policy on an organization-defined frequency.', - 'CCI-000242': - 'Develop and document procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.', - 'CCI-000243': - 'Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.', - 'CCI-000244': - 'Review and update the current assessment, authorization, and monitoring procedures on an organization-defined frequency.', - 'CCI-000245': - 'The organization develops a security assessment plan for the information system and its environment of operation.', - 'CCI-000246': - 'Develop a control assessment plan that describes the scope of the assessment including controls and control enhancements under assessment.', - 'CCI-000247': - 'Develop a control assessment plan that describes the scope of the assessment including assessment procedures to be used to determine control effectiveness.', - 'CCI-000248': - 'Develop a control assessment plan that describes the scope of the assessment including assessment environment.', - 'CCI-000249': - 'The organizations security assessment plan describes the assessment team.', - 'CCI-000250': - "The organization's security assessment plan describes assessment roles and responsibilities.", - 'CCI-000251': - 'Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements.', - 'CCI-000252': - 'Defines the frequency on which the security controls in the system and its environment of operation are assessed.', - 'CCI-000253': - 'Produce a control assessment report that document the results of the assessment.', - 'CCI-000254': - 'Provide the results of the control assessment to organization-defined individuals or roles.', - 'CCI-000255': - 'Employ independent assessors or assessment teams to conduct control assessments.', - 'CCI-000256': - 'Include as part of the control assessments, announced or unannounced, on an organization-defined frequency, in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; and/or organization-defined other forms of assessment.', - 'CCI-000257': - 'The organization authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements.', - 'CCI-000258': - 'Document, as part of each exchange agreement, the interface characteristics.', - 'CCI-000259': - 'Document, as part of each exchange agreement, the security requirements, controls and responsibilities for each system, and the impact level of the information communicated.', - 'CCI-000260': - 'The organization documents, for each interconnection, the nature of the information communicated.', - 'CCI-000261': - 'The organization monitors the information system connections on an ongoing basis to verify enforcement of security requirements.', - 'CCI-000262': - 'The organization prohibits the direct connection of an organization-defined unclassified, national security system to an external network without the use of an organization-defined boundary protection device.', - 'CCI-000263': - 'The organization prohibits the direct connection of a classified, national security system to an external network without the use of organization-defined boundary protection device.', - 'CCI-000264': - 'Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.', - 'CCI-000265': - 'Defines the frequency with which to update the existing plan of action and milestones for the system.', - 'CCI-000266': - 'Update, on an organization-defined frequency, the existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.', - 'CCI-000267': - 'Ensure the accuracy of the plan of action and milestones for the system using organization-defined automated mechanisms.', - 'CCI-000268': - 'Ensure the currency of the plan of action and milestones for the system using organization-defined automated mechanisms.', - 'CCI-000269': - 'Ensure the availability of the plan of action and milestones for the system using organization-defined automated mechanisms.', - 'CCI-000270': - 'Assign a senior official as the authorizing official for the system.', - 'CCI-000271': - 'Ensure the authorizing official for the system authorizes the system to operate before commencing operations.', - 'CCI-000272': - 'Update the authorization on an organization-defined frequency.', - 'CCI-000273': - 'Defines the frequency with which to update the authorizations.', - 'CCI-000274': 'Develop a continuous monitoring strategy.', - 'CCI-000275': - 'The organization implements a continuous monitoring program that includes a configuration management process for the information system.', - 'CCI-000276': - 'The organization implements a continuous monitoring program that includes a configuration management process for the information system constituent components.', - 'CCI-000277': - 'The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the information system.', - 'CCI-000278': - 'The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the environment of operation.', - 'CCI-000279': - 'Implement ongoing control assessments in accordance with the continuous monitoring strategy.', - 'CCI-000280': - 'Implement a continuous monitoring program that includes reporting the security status to organization-defined personnel or roles on an organization-defined frequency.', - 'CCI-000281': - 'Defines the frequency with which to report the security status to organization-defined personnel or roles.', - 'CCI-000282': - 'Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.', - 'CCI-000283': - 'The organization plans announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.', - 'CCI-000284': - 'The organization schedules announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.', - 'CCI-000285': - 'The organization conducts announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.', - 'CCI-000286': - 'Defines the frequency with which to review and update the configuration management policies.', - 'CCI-000287': - 'Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000288': - 'The organization disseminates formal, documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities.', - 'CCI-000289': - 'Review and update, on an organization-defined frequency, the configuration management policy.', - 'CCI-000290': - 'Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and the associated configuration management controls.', - 'CCI-000291': - 'The organization disseminates formal, documented procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.', - 'CCI-000292': - 'Review and update, on an organization-defined frequency, the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls.', - 'CCI-000293': - 'The organization develops a current baseline configuration of the information system.', - 'CCI-000294': - 'The organization documents a baseline configuration of the information system.', - 'CCI-000295': - 'Maintain, under configuration control, a current baseline configuration of the system.', - 'CCI-000296': - 'Review and update the baseline configuration of the system on an organization-defined frequency.', - 'CCI-000297': - 'Review and update the baseline configuration of the system when required due to organization-defined circumstances.', - 'CCI-000298': - 'The organization reviews and updates the baseline configuration of the information system as an integral part of information system component installations.', - 'CCI-000299': - 'The organization reviews and updates the baseline configuration of the information system as an integral part of information system component upgrades.', - 'CCI-000300': - 'Maintain complete configuration of the system using organization-defined automated mechanisms.', - 'CCI-000301': - 'Maintain current configuration of the system using organization-defined automated mechanisms.', - 'CCI-000302': - 'Maintain accurate configuration of the system using organization-defined automated mechanisms.', - 'CCI-000303': - 'Maintain available configuration of the system using organization-defined automated mechanisms.', - 'CCI-000304': - 'Retain organization-defined number of previous versions of baseline configurations of the system to support rollback.', - 'CCI-000305': - 'The organization develops a list of software programs not authorized to execute on the information system.', - 'CCI-000306': - 'The organization maintains the list of software programs not authorized to execute on the information system.', - 'CCI-000307': - 'The organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system.', - 'CCI-000308': - 'The organization develops the list of software programs authorized to execute on the information system.', - 'CCI-000309': - 'The organization maintains the list of software programs authorized to execute on the information system.', - 'CCI-000310': - 'The organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system.', - 'CCI-000311': - 'Maintain a baseline configuration for system development environments that is managed separately from the operational baseline configuration.', - 'CCI-000312': - 'Maintain a baseline configuration for system test environments that is managed separately from the operational baseline configuration.', - 'CCI-000313': - 'Determine and document the types of changes to the system that are configuration-controlled.', - 'CCI-000314': - 'Approve or disapprove configuration-controlled changes to the system, with explicit consideration for security impact analyses.', - 'CCI-000315': - 'The organization documents approved configuration-controlled changes to the system.', - 'CCI-000316': - 'Retain records of configuration-controlled changes to the system for an organization-defined time period.', - 'CCI-000317': - 'The organization reviews records of configuration-controlled changes to the system.', - 'CCI-000318': - 'Monitor and review activities associated with configuration-controlled changes to the system.', - 'CCI-000319': - 'Coordinate and provides oversight for configuration change control activities through an organization-defined configuration change control element that convenes at the organization-defined frequency, and/or for any organization-defined configuration change conditions.', - 'CCI-000320': - 'Defines the frequency with which to convene the configuration change control element.', - 'CCI-000321': - 'Defines configuration change conditions that prompt the configuration change control element to convene.', - 'CCI-000322': - 'Use organization-defined automated mechanisms to document proposed changes to the system.', - 'CCI-000323': - 'Use organization-defined automated mechanisms to notify organization-defined approval authorities of proposed changes to the system and request change approval.', - 'CCI-000324': - 'Use organization-defined automated mechanisms to highlight proposed changes to the system that have not been approved or disapproved by an organization-defined time period.', - 'CCI-000325': - 'Use organization-defined automated mechanisms to prohibit changes to the system until designated approvals are received.', - 'CCI-000326': - 'Use organization-defined automated mechanisms to document all changes to the system.', - 'CCI-000327': - 'Tests changes to the system before finalizing the implementation of the changes.', - 'CCI-000328': - 'Validate changes to the system before finalizing the implementation of the changes.', - 'CCI-000329': - 'Document changes to the system before finalizing the implementation of the changes.', - 'CCI-000330': - 'Implement changes to the current system baseline using organization-defined automated mechanisms.', - 'CCI-000331': - 'Deploy the updated system baseline across the installed base using organization-defined automated mechanism.', - 'CCI-000332': - 'Require an organization-defined security representative to be a member of the organization-defined configuration change control element.', - 'CCI-000333': - 'Analyze changes to the system to determine potential security impacts prior to change implementation.', - 'CCI-000334': - 'The organization analyzes new software in a separate test environment before installation in an operational environment.', - 'CCI-000335': - 'After system changes, verify that the impacted controls are implemented correctly, meeting the security requirements for the system.', - 'CCI-000336': - 'After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.', - 'CCI-000337': - 'After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system.', - 'CCI-000338': - 'The organization defines physical access restrictions associated with changes to the information system.', - 'CCI-000339': - 'The organization documents physical access restrictions associated with changes to the information system.', - 'CCI-000340': - 'Approve physical access restrictions associated with changes to the system.', - 'CCI-000341': - 'Enforce physical access restrictions associated with changes to the system.', - 'CCI-000342': - 'The organization defines logical access restrictions associated with changes to the information system.', - 'CCI-000343': - 'The organization documents logical access restrictions associated with changes to the information system.', - 'CCI-000344': - 'Approve logical access restrictions associated with changes to the system.', - 'CCI-000345': - 'Enforce logical access restrictions associated with changes to the system.', - 'CCI-000346': - 'The organization employs automated mechanisms to enforce access restrictions.', - 'CCI-000347': - 'The organization employs automated mechanisms to support auditing of the enforcement actions.', - 'CCI-000348': - 'The organization defines a frequency with which to conduct reviews of information system changes.', - 'CCI-000349': - 'The organization reviews information system changes per organization-defined frequency to determine whether unauthorized changes have occurred.', - 'CCI-000350': - 'The organization reviews information system changes upon organization-defined circumstances to determine whether unauthorized changes have occurred.', - 'CCI-000351': - 'The organization defines critical software programs that the information system will prevent from being installed if such software programs are not signed with a recognized and approved certificate.', - 'CCI-000352': - 'The information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization.', - 'CCI-000353': - 'Defines system components requiring enforcement of a dual authorization for system changes.', - 'CCI-000354': - 'Enforce dual authorization for implementing changes to organization-defined system components.', - 'CCI-000355': - 'The organization limits information system developer/integrator privileges to change hardware components directly within a production environment.', - 'CCI-000356': - 'The organization limits information system developer/integrator privileges to change software components directly within a production environment.', - 'CCI-000357': - 'The organization limits information system developer/integrator privileges to change firmware components directly within a production environment.', - 'CCI-000358': - 'The organization limits information system developer/integrator privileges to change system information directly within a production environment.', - 'CCI-000359': - 'The organization defines the frequency to review information system developer/integrator privileges.', - 'CCI-000360': - 'The organization defines the frequency to reevaluate information system developer/integrator privileges.', - 'CCI-000361': - 'The organization reviews information system developer/integrator privileges per organization-defined frequency.', - 'CCI-000362': - 'The organization reevaluates information system developer/integrator privileges per organization-defined frequency.', - 'CCI-000363': - 'The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.', - 'CCI-000364': - 'The organization establishes configuration settings for information technology products employed within the information system using organization-defined security configuration checklists.', - 'CCI-000365': - 'The organization documents configuration settings for information technology products employed within the information system using organization-defined security configuration checklists that reflect the most restrictive mode consistent with operational requirements.', - 'CCI-000366': 'Implement the security configuration settings.', - 'CCI-000367': - 'Identify any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.', - 'CCI-000368': - 'Document any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.', - 'CCI-000369': - 'Approve any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.', - 'CCI-000370': - 'Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.', - 'CCI-000371': - 'Apply configuration settings for organization-defined system components using organization-defined automated mechanisms.', - 'CCI-000372': - 'Verify configuration settings for organization-defined system components using organization-defined automated mechanisms.', - 'CCI-000373': - 'The organization defines configuration settings for which unauthorized changes are responded to by automated mechanisms.', - 'CCI-000374': - 'The organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings.', - 'CCI-000375': - 'The organization incorporates detection of unauthorized, security-relevant configuration changes into the organizations incident response capability.', - 'CCI-000376': - 'The organization ensures unauthorized, security-relevant configuration changes detected are monitored.', - 'CCI-000377': - 'The organization ensures unauthorized, security-relevant configuration changes detected are corrected.', - 'CCI-000378': - 'The organization ensures unauthorized, security-relevant configuration changes detected are available for historical purposes.', - 'CCI-000379': - 'The information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance (i.e., security checklists) prior to being introduced into a production environment.', - 'CCI-000380': - 'Defines prohibited or restricted functions, system ports, protocols, software and/or services for the system.', - 'CCI-000381': - 'Configure the system to provide only organization-defined mission essential capabilities.', - 'CCI-000382': - 'Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.', - 'CCI-000383': - 'The organization defines the frequency of information system reviews to identify and eliminate unnecessary functions, ports, protocols and/or services.', - 'CCI-000384': - 'Review the system per organization-defined frequency to identify unnecessary and nonsecure functions, ports, protocols, software, and services.', - 'CCI-000385': - 'The organization reviews the information system per organization-defined frequency to eliminate unnecessary functions, ports, protocols, and/or services.', - 'CCI-000386': - 'The organization employs automated mechanisms to prevent program execution on the information system in accordance with the organization-defined specifications.', - 'CCI-000387': - 'Defines registration requirements for functions, ports, protocols, and services.', - 'CCI-000388': - 'Ensure compliance with organization-defined registration requirements for functions, ports, protocols, and services.', - 'CCI-000389': - 'The organization develops an inventory of information system components that accurately reflects the current information system.', - 'CCI-000390': - 'The organization documents an inventory of information system components that accurately reflects the current information system.', - 'CCI-000391': - 'The organization maintains an inventory of information system components that accurately reflects the current information system.', - 'CCI-000392': - 'The organization develops an inventory of information system components that includes all components within the authorization boundary of the information system.', - 'CCI-000393': - 'The organization documents an inventory of information system components that includes all components within the authorization boundary of the information system.', - 'CCI-000394': - 'The organization maintains an inventory of information system components that is consistent with the authorization boundary of the information system.', - 'CCI-000395': - 'The organization develops an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.', - 'CCI-000396': - 'The organization documents an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.', - 'CCI-000397': - 'The organization maintains an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.', - 'CCI-000398': - 'Defines information deemed necessary to achieve effective system component accountability.', - 'CCI-000399': - 'The organization develops an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.', - 'CCI-000400': - 'The organization documents an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.', - 'CCI-000401': - 'The organization maintains an inventory of information system components that includes organization-defined information deemed necessary to achieve effective property accountability.', - 'CCI-000402': - 'The organization develops an inventory of information system components that is available for review by designated organizational officials.', - 'CCI-000403': - 'The organization documents an inventory of information system components that is available for review by designated organizational officials.', - 'CCI-000404': - 'The organization maintains an inventory of information system components that is available for review by designated organizational officials.', - 'CCI-000405': - 'The organization develops an inventory of information system components that is available for audit by designated organizational officials.', - 'CCI-000406': - 'The organization documents an inventory of information system components that is available for audit by designated organizational officials.', - 'CCI-000407': - 'The organization maintains an inventory of information system components that is available for audit by designated organizational officials.', - 'CCI-000408': - 'Update the inventory of system components as part of component installations.', - 'CCI-000409': - 'Update the inventory of system components as part of component removals.', - 'CCI-000410': - 'Update the inventory of system components as part of system updates.', - 'CCI-000411': - 'Maintain the currency of the inventory of system components using organization-defined automated mechanisms.', - 'CCI-000412': - 'Maintain the completeness of the inventory of system components using organization-defined automated mechanisms.', - 'CCI-000413': - 'Maintain the accuracy of the inventory of system components using organization-defined automated mechanisms.', - 'CCI-000414': - 'Maintain the availability of the inventory of system components using organization-defined automated mechanisms.', - 'CCI-000415': - 'Defines the frequency of employing automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the system.', - 'CCI-000416': - 'Detect the presence of unauthorized hardware, software, and firmware components within the system using organization-defined automated mechanisms, on an organization-defined frequency.', - 'CCI-000417': - 'The organization disables network access by unauthorized components/devices or notifies designated organizational officials.', - 'CCI-000418': - 'Include in the system component inventory information, a means for identifying by name, position, and/or role, individuals responsible and accountable for administering those components.', - 'CCI-000419': - 'The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories.', - 'CCI-000420': - 'Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.', - 'CCI-000421': - 'The organization develops a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.', - 'CCI-000422': - 'The organization documents a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.', - 'CCI-000423': - 'Implement a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes and procedures.', - 'CCI-000424': - 'The organization develops a configuration management plan for the information system that defines the configuration items for the information system.', - 'CCI-000425': - 'The organization documents a configuration management plan for the information system that defines the configuration items for the information system.', - 'CCI-000426': - 'Implement a configuration management plan for the system that defines the configuration items for the system.', - 'CCI-000427': - 'The organization develops a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.', - 'CCI-000428': - 'The organization documents a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.', - 'CCI-000429': - 'The organization implements a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.', - 'CCI-000430': - 'The organization develops a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.', - 'CCI-000431': - 'The organization documents a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.', - 'CCI-000432': - 'The organization implements a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.', - 'CCI-000433': - 'The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.', - 'CCI-000434': - 'The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.', - 'CCI-000435': - 'The organization implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.', - 'CCI-000436': - 'Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.', - 'CCI-000437': - 'Defines the frequency with which to review and update the current contingency planning policy.', - 'CCI-000438': - 'Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000439': - 'Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles.', - 'CCI-000440': - 'Review and update the current contingency planning policy in accordance with an organization-defined frequency.', - 'CCI-000441': - 'Develop and document procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls.', - 'CCI-000443': - 'Develop a contingency plan for the system that identifies essential missions.', - 'CCI-000444': - 'Develop a contingency plan for the system that identifies essential business functions.', - 'CCI-000445': - 'Develop a contingency plan for the system that identifies associated contingency requirements.', - 'CCI-000446': - 'Develop a contingency plan for the system that provides recovery objectives.', - 'CCI-000447': - 'Develop a contingency plan for the system that provides restoration priorities.', - 'CCI-000448': - 'Develop a contingency plan for the system that provides metrics.', - 'CCI-000449': - 'Develop a contingency plan for the system that addresses contingency roles, responsibilities, assigned individuals with contact information.', - 'CCI-000450': - 'The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system disruption.', - 'CCI-000451': - 'The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system disruption.', - 'CCI-000452': - 'The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system compromise.', - 'CCI-000453': - 'The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system compromise.', - 'CCI-000454': - 'The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system failure.', - 'CCI-000455': - 'The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system failure.', - 'CCI-000456': - 'Develop a contingency plan for the system that addresses eventual, full system restoration without deterioration of the controls originally planned and implemented.', - 'CCI-000457': - 'Develop a contingency plan for the system that is reviewed and approved by organization-defined personnel or roles.', - 'CCI-000458': - 'Defines the key contingency personnel (identified by name and/or by role) and organizational elements designated to receive copies of the contingency plan.', - 'CCI-000459': - 'Distributes copies of the contingency plan to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.', - 'CCI-000460': - 'Coordinate contingency planning activities with incident handling activities.', - 'CCI-000461': - 'Defines the frequency with which to review the contingency plan for the system.', - 'CCI-000462': - 'Reviews the contingency plan for the system in accordance with organization-defined frequency.', - 'CCI-000463': - 'Updates the contingency plan to address changes to the organization.', - 'CCI-000464': - 'Updates the contingency plan to address changes to the system.', - 'CCI-000465': - 'Updates the contingency plan to address changes to the environment of operation.', - 'CCI-000466': - 'Updates the contingency plan to address problems encountered during contingency plan implementation, execution, or testing.', - 'CCI-000468': - 'Communicates contingency plan changes to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.', - 'CCI-000469': - 'Coordinate contingency plan development with organizational elements responsible for related plans.', - 'CCI-000470': - 'Conduct capacity planning so that necessary capacity for information processing exists during contingency operations.', - 'CCI-000471': - 'Conduct capacity planning so that necessary capacity for telecommunications exists during contingency operations.', - 'CCI-000472': - 'Conduct capacity planning so that necessary capacity for environmental support exists during contingency operations.', - 'CCI-000473': - 'Defines the time period for planning the resumption of essential missions as a result of contingency plan activation.', - 'CCI-000474': - 'Defines the time period for planning the resumption of essential business functions as a result of contingency plan activation.', - 'CCI-000475': - 'Plan for the resumption of all or essential mission functions within the organization-defined time period of contingency plan activation.', - 'CCI-000476': - 'Plan for the resumption of all or essential business functions within the organization-defined time period of contingency plan activation.', - 'CCI-000477': - 'The organization defines the time period for planning the resumption of all missions as a result of contingency plan activation.', - 'CCI-000478': - 'The organization defines the time period for planning the resumption of all business functions as a result of contingency plan activation.', - 'CCI-000479': - 'The organization plans for the resumption of all missions within an organization-defined time period of contingency plan activation.', - 'CCI-000480': - 'The organization plans for the resumption of all business functions within an organization-defined time period of contingency plan activation.', - 'CCI-000481': - 'Plan for the continuance of all or essential missions with little or no loss of operational continuity.', - 'CCI-000482': - 'Plan for the continuance of all or essential business functions with little or no loss of operational continuity.', - 'CCI-000483': - 'Plan for the transfer of all or essential mission functions to alternate processing and/or storage sites with minimal or no loss of operational continuity.', - 'CCI-000484': - 'Plan for the transfer of all or essential business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity.', - 'CCI-000485': - 'Defines the frequency of contingency training to system users.', - 'CCI-000486': - 'Provide contingency training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility.', - 'CCI-000487': - 'Provide contingency training to system users consistent with assigned roles and responsibilities in accordance with organization-defined frequency.', - 'CCI-000488': - 'Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.', - 'CCI-000489': - 'Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment.', - 'CCI-000490': - 'Defines the frequency with which to test the contingency plan for the system.', - 'CCI-000491': - 'The organization defines the frequency to exercise the contingency plan for the information system.', - 'CCI-000492': - 'Defines the contingency plan tests to be conducted for the system.', - 'CCI-000493': - 'The organization defines contingency plan exercises to be conducted for the information system.', - 'CCI-000494': - 'Test the contingency plan for the system in accordance with organization-defined frequency using organization-defined tests to determine the effectiveness of the plan and the organizational readiness to execute the plan.', - 'CCI-000495': - 'The organization exercises the contingency plan using organization-defined exercises in accordance with organization-defined frequency.', - 'CCI-000496': 'Review the contingency plan test results.', - 'CCI-000497': - 'Initiate corrective actions, if needed, after reviewing the contingency plan test results.', - 'CCI-000498': - 'Coordinate contingency plan testing with organizational elements responsible for related plans.', - 'CCI-000499': - 'The organization coordinates contingency plan exercises with organizational elements responsible for related plans.', - 'CCI-000500': - 'Test the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources.', - 'CCI-000501': - "The organization exercises the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources and to evaluate the site's capabilities to support contingency operations.", - 'CCI-000502': - 'Test the contingency plan using organization-defined automated mechanisms.', - 'CCI-000503': - 'The organization employs automated mechanisms to more thoroughly and effectively exercise the contingency plan by providing more complete coverage of contingency issues, selecting more realistic exercise scenarios and environments, and more effectively stressing the information and supported missions.', - 'CCI-000504': - 'Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.', - 'CCI-000505': - 'Establish an alternate storage site, including necessary agreements to permit the storage of system backup information.', - 'CCI-000506': - 'The organization initiates necessary alternate storage site agreements to permit the storage and recovery of information system backup information.', - 'CCI-000507': - 'Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.', - 'CCI-000508': - 'Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.', - 'CCI-000509': - 'Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.', - 'CCI-000510': - 'Defines the time-period consistent with recovery time and recovery point objectives for essential missions/business functions to permit the transfer and resumption of organization-defined system operations at an alternate processing site when the primary processing capabilities are unavailable.', - 'CCI-000511': - 'The organization defines the time period for achieving the recovery time objectives for business functions within which processing must be resumed at the alternate processing site.', - 'CCI-000512': 'The organization establishes an alternate processing site.', - 'CCI-000513': - 'Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential mission functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.', - 'CCI-000514': - 'Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential business functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.', - 'CCI-000515': - 'Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption.', - 'CCI-000516': - 'Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.', - 'CCI-000517': - 'Identify potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.', - 'CCI-000518': - 'Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).', - 'CCI-000519': - 'Prepare the alternate processing site so that the site can serve as the operational site supporting essential missions.', - 'CCI-000520': - 'Prepare the alternate processing site so that the site can serve as the operational site supporting essential business functions.', - 'CCI-000521': - 'Provide controls at the alternate processing site that are equivalent to those at the primary site.', - 'CCI-000522': - 'Defines the time-period within which to permit the resumption of organization-defined system operations for essential mission functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.', - 'CCI-000523': - 'Defines the time-period within which to permit the resumption of organization-defined system operations for essential business functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.', - 'CCI-000524': - 'Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential mission functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.', - 'CCI-000525': - 'Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.', - 'CCI-000526': - 'Develop primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).', - 'CCI-000527': - 'Develop alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).', - 'CCI-000528': - 'The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary telecommunications services are provided by a common carrier.', - 'CCI-000529': - 'The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the alternate telecommunications services are provided by a common carrier.', - 'CCI-000530': - 'Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.', - 'CCI-000531': - 'Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.', - 'CCI-000532': - 'Require primary telecommunications service providers to have contingency plans.', - 'CCI-000533': - 'Require alternate telecommunications service providers to have contingency plans.', - 'CCI-000534': - 'Defines the frequency of conducting user-level information backups to support recovery time objectives and recovery point objectives.', - 'CCI-000535': - 'Conduct backups of user-level information contained in organization-defined system components per organization-defined frequency that is consistent with recovery time and recovery point objectives.', - 'CCI-000536': - 'Defines the frequency of conducting system-level information backups to support recovery time objectives and recovery point objectives.', - 'CCI-000537': - 'Conduct backups of system-level information contained in the system per organization-defined frequency that is consistent with recovery time and recovery point objectives.', - 'CCI-000538': - 'Defines the frequency of conducting system documentation backups, including security-related documentation, to support recovery time objectives and recovery point objectives.', - 'CCI-000539': - 'Conduct backups of system documentation, including security-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.', - 'CCI-000540': - 'The organization protects the confidentiality, integrity, and availability of backup information at storage locations.', - 'CCI-000541': - 'Defines the frequency with which to test backup information to verify media reliability and information integrity.', - 'CCI-000542': - 'Test backup information per an organization-defined frequency to verify media reliability and information integrity.', - 'CCI-000543': - 'Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.', - 'CCI-000544': - 'The organization stores backup copies of the operating system in a separate facility or in a fire-rated container that is not colocated with the operational system.', - 'CCI-000545': - 'The organization stores backup copies of critical information system software in a separate facility or in a fire-rated container that is not colocated with the operational system.', - 'CCI-000546': - 'The organization stores backup copies of the information system inventory (including hardware, software, and firmware components) in a separate facility or in a fire-rated container that is not colocated with the operational system.', - 'CCI-000547': - 'Defines the time-period and transfer rate of the system backup information to the alternate storage site consistent with the recovery time and recovery point objectives.', - 'CCI-000548': - 'Transfer system backup information to the alternate storage site in accordance with the organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives.', - 'CCI-000549': - 'Maintain a redundant secondary system that is not collocated with the primary system.', - 'CCI-000550': - 'The organization provides for the recovery and reconstitution of the information system to a known state after a disruption.', - 'CCI-000551': - 'The organization provides for the recovery and reconstitution of the information system to a known state after a compromise.', - 'CCI-000552': - 'The organization provides for the recovery and reconstitution of the information system to a known state after a failure.', - 'CCI-000553': - 'Implement transaction recovery for systems that are transaction-based.', - 'CCI-000554': - 'The organization defines in the security plan, explicitly or by reference, the circumstances that can inhibit recovery and reconstitution of the information system to a known state.', - 'CCI-000555': - 'The organization provides compensating security controls for organization-defined circumstances that can inhibit recovery and reconstitution of the information system to a known state.', - 'CCI-000556': - 'Defines restoration time periods within which to restore system components from configuration-controlled and integrity-protected information representing a known, operational state for the components.', - 'CCI-000557': - 'Provide the capability to restore information system components within organization-defined restoration time periods from configuration-controlled and integrity-protected information representing a known, operational state for the components.', - 'CCI-000558': - 'Defines the real-time or near-real-time failover capability to be provided for the system.', - 'CCI-000559': - 'Provide real-time or near-real-time organization-defined failover capability for the system.', - 'CCI-000560': 'The organization protects backup and restoration hardware.', - 'CCI-000561': 'The organization protects backup and restoration firmware.', - 'CCI-000562': 'The organization protects backup and restoration software.', - 'CCI-000563': - 'Develop and document an organization-level; mission/business process-level; and or system-level planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000564': - 'Disseminate an organization-level; mission/business process-level; and or system-level planning policy to organization-defined personnel or roles.', - 'CCI-000565': - 'The organization reviews/updates, per organization-defined frequency, a formal, documented security planning policy.', - 'CCI-000566': - 'Develop and document procedures to facilitate the implementation of the planning policy and associated planning controls.', - 'CCI-000567': - 'Disseminates planning procedures to organization-defined personnel or roles.', - 'CCI-000568': - 'Review and update the current planning procedures in accordance with organization-defined frequency.', - 'CCI-000570': - "The organization develops a security plan for the information system that is consistent with the organization's enterprise architecture; explicitly defines the authorization boundary for the system; describes the operational context of the information system in terms of mission and business processes; provides the security category and impact level of the information system, including supporting rationale; describes the operational environment for the information system; describes relationships with, or connections to, other information systems; provides an overview of the security requirements for the system; and describes the security controls in place or planned for meeting those requirements, including a rationale for the tailoring and supplemental decisions.", - 'CCI-000571': - 'Develop security and privacy plans for the system that are reviewed and approved by the authorizing official or designated representative prior to plan implementation.', - 'CCI-000572': 'Defines the frequency for reviewing the plans for the system.', - 'CCI-000573': - 'Review the plans in accordance with organization-defined frequency.', - 'CCI-000574': - 'Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments.', - 'CCI-000576': - 'The organization develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum: the purpose of the system; a description of the system architecture; the security authorization schedule; and the security categorization and associated factors considered in determining the categorization.', - 'CCI-000577': - 'Defines the frequency with which to review and update the CONOPS.', - 'CCI-000578': - 'Review and update the CONOPS in accordance with organization-defined frequency.', - 'CCI-000580': - 'The organization develops a functional architecture for the information system that identifies and maintains external interfaces.', - 'CCI-000581': - 'The organization develops a functional architecture for the information system that identifies and maintains the information being exchanged across the interfaces.', - 'CCI-000582': - 'The organization develops a functional architecture for the information system that identifies and maintains the protection mechanisms associated with each interface.', - 'CCI-000583': - 'The organization develops a functional architecture for the information system that identifies and maintains user roles.', - 'CCI-000584': - 'The organization develops a functional architecture for the information system that identifies and maintains the access privileges assigned to each role.', - 'CCI-000585': - 'The organization develops a functional architecture for the information system that identifies and maintains unique security requirements.', - 'CCI-000586': - 'The organization develops a functional architecture for the information system that identifies and maintains types of information processed by the information system.', - 'CCI-000587': - 'The organization develops a functional architecture for the information system that identifies and maintains types of information stored by the information system.', - 'CCI-000588': - 'The organization develops a functional architecture for the information system that identifies and maintains types of information transmitted by the information system.', - 'CCI-000589': - 'The organization develops a functional architecture for the information system that identifies and maintains any specific protection needs in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.', - 'CCI-000590': - 'The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information.', - 'CCI-000591': - 'The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information system services.', - 'CCI-000592': - 'Establish the rules that describe their responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system.', - 'CCI-000593': - 'Receive a documented acknowledgement from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system.', - 'CCI-000594': - 'Include in the rules of behavior, restrictions on the use of social media, social networking sites, and external sites/applications.', - 'CCI-000595': - 'Include in the rules of behavior, restrictions on posting organizational information on public websites.', - 'CCI-000596': - 'The organization includes in the rules of behavior, explicit restrictions on sharing information system account information.', - 'CCI-000597': - 'The organization conducts a privacy impact assessment on the information system in accordance with OMB policy.', - 'CCI-000598': - 'The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational operations (i.e., mission, functions, image, and reputation).', - 'CCI-000599': - 'The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational assets.', - 'CCI-000600': - 'The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational individuals.', - 'CCI-000601': - 'Defines the frequency with which to review and update the current system and services acquisition policy.', - 'CCI-000602': - 'Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000603': - 'Disseminate to organization-defined personnel or roles an organization-level; mission/business process-level; and/or system-level system and services acquisition policy.', - 'CCI-000604': - 'Review and update the current system and services acquisition policy in accordance with organization-defined frequency.', - 'CCI-000605': - 'Develop and document procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.', - 'CCI-000606': - 'Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.', - 'CCI-000607': - 'Review and update the current system and services acquisition procedures in accordance with organization-defined frequency.', - 'CCI-000608': - 'The organization includes a determination of information security requirements for the information system in mission process planning.', - 'CCI-000609': - 'The organization includes a determination of information security requirements for the information system in business process planning.', - 'CCI-000610': - 'Determine the resources required to protect the system or system service as part of the organizational capital planning and investment control process.', - 'CCI-000611': - 'Document the resources required to protect the system or system service as part of the organizational capital planning and investment control process.', - 'CCI-000612': - 'Allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process.', - 'CCI-000613': - 'Establish a discrete line item for information security in organizational programming documentation.', - 'CCI-000614': - 'Establish a discrete line item for information security in organizational budgeting documentation.', - 'CCI-000615': - 'Manage the system using an organization-defined system development life cycle that incorporates information security considerations.', - 'CCI-000616': - 'Define and document information system security roles and responsibilities throughout the system development life cycle.', - 'CCI-000617': - 'The organization documents information system security roles and responsibilities throughout the system development life cycle.', - 'CCI-000618': - 'Identify individuals having information system security roles and responsibilities.', - 'CCI-000619': - 'The organization includes security functional requirements/specifications, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.', - 'CCI-000620': - 'The organization includes security-related documentation requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.', - 'CCI-000621': - 'The organization includes developmental and evaluation-related assurance requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.', - 'CCI-000623': - 'Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.', - 'CCI-000624': - 'The organization requires in acquisition documents that vendors/contractors provide information describing the design details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.', - 'CCI-000625': - 'The organization requires in acquisition documents that vendors/contractors provide information describing the implementation details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.', - 'CCI-000626': - 'The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs state-of-the-practice software and security engineering methods.', - 'CCI-000627': - 'The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs quality control processes.', - 'CCI-000628': - 'The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development processes employ validation techniques.', - 'CCI-000629': - 'The organization ensures each information system component acquired is explicitly assigned to an information system, and that the owner of the system acknowledges this assignment.', - 'CCI-000630': - 'The organization requires in acquisition documents, that information system components are delivered in a secure, documented configuration, and that the secure configuration is the default configuration for any software reinstalls or upgrades.', - 'CCI-000631': - 'Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.', - 'CCI-000632': - 'The organization employs only commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.', - 'CCI-000633': - 'Ensure that government off-the-shelf or commercial-off-the-shelf information assurance and information assurance-enabled information technology products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.', - 'CCI-000634': - 'Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists.', - 'CCI-000635': - 'Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.', - 'CCI-000636': - 'The organization obtains administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.', - 'CCI-000637': - 'The organization protects, as required, administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.', - 'CCI-000638': - 'The organization makes available to authorized personnel administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.', - 'CCI-000639': - 'The organization obtains user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.', - 'CCI-000640': - 'The organization protects, as required, user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.', - 'CCI-000641': - 'The organization makes available to authorized personnel user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.', - 'CCI-000642': - 'Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent.', - 'CCI-000643': - 'The organization obtains vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.', - 'CCI-000644': - 'The organization protects, as required, vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system.', - 'CCI-000645': - 'The organization makes available to authorized personnel vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.', - 'CCI-000646': - 'The organization obtains vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.', - 'CCI-000647': - 'The organization obtains vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.', - 'CCI-000648': - 'The organization protects, as required, vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system.', - 'CCI-000650': - 'The organization obtains vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.', - 'CCI-000651': - 'The organization protects, as required, vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system.', - 'CCI-000653': - 'The organization obtains the source code for the information system to permit analysis and testing.', - 'CCI-000654': - 'The organization protects, as required, the source code for the information system to permit analysis and testing.', - 'CCI-000655': - 'The organization uses software and associated documentation in accordance with contract agreements and copyright laws.', - 'CCI-000656': - 'The organization employs tracking systems for software and associated documentation protected by quantity licenses to control copying and distribution.', - 'CCI-000657': - 'The organization controls the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.', - 'CCI-000658': - 'The organization documents the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.', - 'CCI-000659': - 'The organization prohibits the use of binary executable code from sources with limited or no warranty without accompanying source code.', - 'CCI-000660': - 'The organization prohibits the use of machine executable code from sources with limited or no warranty without accompanying source code.', - 'CCI-000661': - 'The organization provides exceptions to the source code requirement only when no alternative solutions are available to support compelling mission/operational requirements.', - 'CCI-000662': - 'The organization obtains express written consent of the authorizing official for exceptions to the source code requirement.', - 'CCI-000663': - 'The organization (or information system) enforces explicit rules governing the installation of software by users.', - 'CCI-000664': - 'Apply organization-defined systems security and privacy engineering principles in the specification of the system and system components.', - 'CCI-000665': - 'Apply organization-defined systems security and privacy engineering principles in the design of the system and system components.', - 'CCI-000666': - 'Apply organization-defined systems security and privacy engineering principles in the development of the system and system components.', - 'CCI-000667': - 'Apply organization-defined systems security and privacy engineering principles in the implementation of the system and system components.', - 'CCI-000668': - 'Apply organization-defined systems security and privacy engineering principles in the modification of the system and system components.', - 'CCI-000669': - 'Require that providers of external system services comply with organizational security requirements.', - 'CCI-000670': - 'The organization requires that providers of external information system services employ organization-defined security controls in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.', - 'CCI-000671': - 'The organization defines government oversight with regard to external information system services.', - 'CCI-000672': - 'The organization documents government oversight with regard to external information system services.', - 'CCI-000673': - 'The organization defines user roles and responsibilities with regard to external information system services.', - 'CCI-000674': - 'The organization documents user roles and responsibilities with regard to external information system services.', - 'CCI-000675': - 'The organization monitors security control compliance by external service providers.', - 'CCI-000676': - 'The organization conducts an organizational assessment of risk prior to the acquisition of dedicated information security services.', - 'CCI-000677': - 'The organization conducts an organizational assessment of risk prior to the outsourcing of dedicated information security services.', - 'CCI-000678': - 'The organization defines the senior organizational official designated to approve acquisition of dedicated information security services.', - 'CCI-000679': - 'The organization defines the senior organizational official designated to approve outsourcing of dedicated information security services.', - 'CCI-000680': - 'The organization ensures the acquisition of dedicated information security services is approved by an organization-designated senior organizational official.', - 'CCI-000681': - 'The organization ensures the outsourcing of dedicated information security services is approved by an organization-designated senior organizational official.', - 'CCI-000682': - 'The organization requires information system developers to perform configuration management during information system design.', - 'CCI-000683': - 'The organization requires information system developers to perform configuration management during information system development.', - 'CCI-000684': - 'The organization requires information system developers to perform configuration management during information system implementation.', - 'CCI-000685': - 'The organization requires information system developers to perform configuration management during information system operation.', - 'CCI-000686': - 'The organization requires information system integrators to perform configuration management during information system design.', - 'CCI-000687': - 'The organization requires information system integrators to perform configuration management during information system development.', - 'CCI-000688': - 'The organization requires information system integrators to perform configuration management during information system implementation.', - 'CCI-000689': - 'The organization requires information system integrators to perform configuration management during information system operation.', - 'CCI-000690': - 'The organization requires information system developers to manage and control changes to the information system during design.', - 'CCI-000691': - 'The organization requires information system integrators to manage and control changes to the information system during design.', - 'CCI-000692': - 'Require the developer of the system, system component, or system service to implement only organization-approved changes to the system, component, or service.', - 'CCI-000693': - 'The organization requires information system integrators to implement only organization-approved changes.', - 'CCI-000694': - 'Require the developer of the system, system component, or system service to document approved changes to the system, component, or service.', - 'CCI-000695': - 'The organization requires information system integrators to document approved changes to the information system.', - 'CCI-000696': - 'The organization requires that information system developers track security flaws and flaw resolution.', - 'CCI-000697': - 'The organization requires information system integrators to track security flaws and flaw resolution.', - 'CCI-000698': - 'Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.', - 'CCI-000699': - 'The organization requires information system integrators to provide an integrity check of software to facilitate organizational verification of software integrity after delivery.', - 'CCI-000700': - 'Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.', - 'CCI-000701': - 'The organization provides an alternative configuration management process with organizational personnel in the absence of a dedicated integrator configuration management team.', - 'CCI-000702': - 'The organization requires information system developers, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.', - 'CCI-000703': - 'The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.', - 'CCI-000704': - 'The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.', - 'CCI-000705': - 'The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.', - 'CCI-000706': - 'The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.', - 'CCI-000707': - 'The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.', - 'CCI-000708': - 'The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.', - 'CCI-000709': - 'The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.', - 'CCI-000710': - 'The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.', - 'CCI-000711': - 'The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.', - 'CCI-000712': - 'The organization requires information system developers to employ code analysis tools to examine software for common flaws and document the results of the analysis.', - 'CCI-000713': - 'The organization requires information system integrators to employ code analysis tools to examine software for common flaws and document the results of the analysis.', - 'CCI-000714': - 'The organization requires information system developers to perform a vulnerability analysis to document vulnerabilities.', - 'CCI-000715': - 'The organization requires information system developers to perform a vulnerability analysis to document exploitation potential.', - 'CCI-000716': - 'The organization requires information system developers to perform a vulnerability analysis to document risk mitigations.', - 'CCI-000717': - 'The organization requires information system integrators to perform a vulnerability analysis to document vulnerabilities.', - 'CCI-000718': - 'The organization requires information system integrators to perform a vulnerability analysis to document exploitation potential.', - 'CCI-000719': - 'The organization requires information system integrators perform a vulnerability analysis to document risk mitigations.', - 'CCI-000720': - 'The organization requires information system developers implement the security test and evaluation plan under the witness of an independent verification and validation agent.', - 'CCI-000721': - 'The organization requires information system integrators to implement the security test and evaluation plan under the witness of an independent verification and validation agent.', - 'CCI-000722': - 'The organization defines the security safeguards to employ to protect against supply chain threats to the information system, system component, or information system service.', - 'CCI-000723': - 'The organization protects against supply chain threats to the information system, system component, or information system service by employing organization-defined security safeguards as part of a comprehensive, defense-in-breadth information security strategy.', - 'CCI-000724': - 'The organization purchases all anticipated information system components and spares in the initial acquisition.', - 'CCI-000725': - 'The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system hardware.', - 'CCI-000726': - 'The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system software.', - 'CCI-000727': - 'The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system firmware.', - 'CCI-000728': - 'The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system services.', - 'CCI-000729': - 'The organization uses trusted shipping for information systems.', - 'CCI-000730': - 'The organization uses trusted shipping for information system components.', - 'CCI-000731': - 'The organization uses trusted shipping for information technology products.', - 'CCI-000732': - 'The organization uses trusted warehousing for information systems.', - 'CCI-000733': - 'The organization uses trusted warehousing for information system components.', - 'CCI-000734': - 'The organization uses trusted warehousing for information technology products.', - 'CCI-000735': - 'The organization employs a diverse set of suppliers for information systems.', - 'CCI-000736': - 'The organization employs a diverse set of suppliers for information system components.', - 'CCI-000737': - 'The organization employs a diverse set of suppliers for information technology products.', - 'CCI-000738': - 'The organization employs a diverse set of suppliers for information system services.', - 'CCI-000739': - 'The organization employs standard configurations for information systems.', - 'CCI-000740': - 'The organization employs standard configurations for information system components.', - 'CCI-000741': - 'The organization employs standard configurations for information technology products.', - 'CCI-000742': - 'The organization minimizes the time between purchase decisions and delivery of information systems.', - 'CCI-000743': - 'The organization minimizes the time between purchase decisions and delivery of information system components.', - 'CCI-000744': - 'The organization minimizes the time between purchase decisions and delivery of information technology products.', - 'CCI-000745': - 'The organization employs independent analysis and penetration testing against delivered information systems.', - 'CCI-000746': - 'The organization employs independent analysis and penetration testing against delivered information system components.', - 'CCI-000747': - 'The organization employs independent analysis and penetration testing against delivered information technology products.', - 'CCI-000748': - 'The organization defines level of trustworthiness for the information system.', - 'CCI-000749': - 'The organization requires that the information system meets the organization-defined level of trustworthiness.', - 'CCI-000750': - 'The organization defines the list of critical information system components that require re-implementation.', - 'CCI-000751': - 'The organization determines the organization-defined list of critical information system components that require re-implementation.', - 'CCI-000752': - 'The organization re-implements organization-defined critical information system components.', - 'CCI-000753': - 'The organization identifies information system components for which alternative sourcing is not viable.', - 'CCI-000754': - 'The organization defines measures to be employed to prevent critical security controls for information system components from being compromised.', - 'CCI-000755': - 'The organization employs organization-defined measures to ensure critical security controls for the information system components are not compromised.', - 'CCI-000756': - 'The organization develops an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000757': - 'Disseminate an organization-level; mission/business process-level; and/or system-level identification and authentication policy to organization-defined personnel.', - 'CCI-000758': - 'Review and update the current identification and authentication policy in accordance with the organization-defined frequency.', - 'CCI-000759': - 'Defines a frequency for reviewing and updating the identification and authentication policy.', - 'CCI-000760': - 'The organization develops procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.', - 'CCI-000761': - 'The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.', - 'CCI-000762': - 'Review and update the current identification and authentication procedures in accordance with the organization-defined frequency.', - 'CCI-000763': - 'Defines a frequency for reviewing and updating the identification and authentication procedures.', - 'CCI-000764': - 'Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.', - 'CCI-000765': - 'Implement multifactor authentication for access to privileged accounts.', - 'CCI-000766': - 'Implement multifactor authentication for access to non-privileged accounts.', - 'CCI-000767': - 'The information system implements multifactor authentication for local access to privileged accounts.', - 'CCI-000768': - 'The information system implements multifactor authentication for local access to non-privileged accounts.', - 'CCI-000769': - 'The organization allows the use of group authenticators only when used in conjunction with an individual/unique authenticator.', - 'CCI-000770': - 'The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.', - 'CCI-000771': - 'The information system uses multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the information system being accessed.', - 'CCI-000772': - 'The information system uses multifactor authentication for network access to non-privileged accounts where one of the factors is provided by a device separate from the information system being accessed.', - 'CCI-000773': - 'The organization defines replay-resistant authentication mechanisms to be used for network access to privileged accounts.', - 'CCI-000774': - 'The information system uses organization-defined replay-resistant authentication mechanisms for network access to privileged accounts.', - 'CCI-000775': - 'The organization defines replay-resistant authentication mechanisms to be used for network access to non-privileged accounts.', - 'CCI-000776': - 'The information system uses organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts.', - 'CCI-000777': - 'Defines devices and/or types of devices for which identification and authentication is required before establishing a connection.', - 'CCI-000778': - 'Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.', - 'CCI-000779': - 'The information system authenticates devices before establishing remote network connections using bidirectional authentication between devices that is cryptographically based.', - 'CCI-000780': - 'The information system authenticates devices before establishing wireless network connections using bidirectional authentication between devices that is cryptographically based.', - 'CCI-000781': - 'The information system authenticates devices before establishing network connections using bidirectional authentication between devices that is cryptographically based.', - 'CCI-000782': - 'The organization standardizes, with regard to dynamic address allocation, Dynamic Host Control Protocol (DHCP) lease information and the time assigned to DHCP-enabled devices.', - 'CCI-000783': 'Audit lease information when assigned to a device.', - 'CCI-000784': - 'The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a user identifier.', - 'CCI-000785': - 'The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a device identifier.', - 'CCI-000786': - 'The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies an individual.', - 'CCI-000787': - 'The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies a device.', - 'CCI-000788': - 'The organization manages information system identifiers for users and devices by assigning the user identifier to the intended party.', - 'CCI-000789': - 'The organization manages information system identifiers for users and devices by assigning the device identifier to the intended device.', - 'CCI-000790': - 'The organization defines a time period for which the reuse of user identifiers is prohibited.', - 'CCI-000791': - 'The organization defines a time period for which the reuse of device identifiers is prohibited.', - 'CCI-000792': - 'The organization manages information system identifiers for users and devices by preventing reuse of user identifiers for an organization-defined time period.', - 'CCI-000793': - 'The organization manages information system identifiers for users and devices by preventing reuse of device identifiers for an organization-defined time period.', - 'CCI-000794': - 'The organization defines a time period of inactivity after which the identifier is disabled.', - 'CCI-000795': - 'The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.', - 'CCI-000796': - 'Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.', - 'CCI-000797': - 'The organization requires that registration to receive a user ID and password include authorization by a supervisor.', - 'CCI-000798': - 'The organization requires that registration to receive a user ID and password be done in person before a designated registration authority.', - 'CCI-000799': - 'The organization requires multiple forms of certification of individual identification, such as documentary evidence or a combination of documents and biometrics, be presented to the registration authority.', - 'CCI-000800': 'Defines characteristics for identifying individual status.', - 'CCI-000801': - 'Manage individual identifiers by uniquely identifying each individual as organization-defined characteristics identifying individual status.', - 'CCI-000802': - 'The information system dynamically manages identifiers, attributes, and associated access authorizations.', - 'CCI-000803': - 'Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.', - 'CCI-000804': - 'Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.', - 'CCI-000805': - 'Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000806': - 'Disseminate an organization-level; mission/business process-level; and/or system-level incident response policy to organization-defined personnel or roles.', - 'CCI-000807': - 'Review and update the current incident response policy in accordance with organization-defined frequency.', - 'CCI-000808': - 'Defines the frequency with which to review and update the current incident response policy.', - 'CCI-000809': - 'Develop and document procedures to facilitate the implementation of incident response policy and associated incident response controls.', - 'CCI-000810': - 'Disseminate the incident response procedures to organization-defined personnel or roles.', - 'CCI-000811': - 'Review and update the current incident response procedures in accordance with organization-defined frequency.', - 'CCI-000812': - 'Defines the frequency with which to review and update the current incident response procedures.', - 'CCI-000813': - 'Provide incident response training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming an incident response role or responsibility.', - 'CCI-000814': - 'Provide incident response training in accordance with organization-defined frequency.', - 'CCI-000815': 'Defines a frequency for incident response training.', - 'CCI-000816': - 'Incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations.', - 'CCI-000817': - 'Provide an incident response training environment using organization-defined automated mechanisms.', - 'CCI-000818': - 'Test the effectiveness of the incident response capability for the system on an organization-defined frequency using organization-defined tests.', - 'CCI-000819': 'Defines a frequency for incident response tests.', - 'CCI-000820': 'Defines tests for incident response.', - 'CCI-000821': - 'Test the incident response capability using organization-defined automated mechanisms.', - 'CCI-000822': - 'Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.', - 'CCI-000823': - 'Coordinate incident handling activities with contingency planning activities.', - 'CCI-000824': - 'The organization incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises.', - 'CCI-000825': - 'Support the incident handling process using organization-defined automated mechanisms.', - 'CCI-000826': - 'Include organization-defined types of dynamic reconfiguration for organization-defined system components as part of the incident response capability.', - 'CCI-000827': - 'Identify organization-defined classes of incidents for which organization-defined actions are to be taken to ensure continuation of organizational mission and business functions.', - 'CCI-000828': - 'Identify actions to take in response to organization-defined classes of incidents to ensure continuation of organizational missions and business functions.', - 'CCI-000829': - 'Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.', - 'CCI-000830': - 'Defines security violations that, if detected, initiate a configurable capability to automatically disable the system.', - 'CCI-000831': - 'Implement a configurable capability to automatically disable the system if organization-defined security violations are detected.', - 'CCI-000832': 'Track and document incidents.', - 'CCI-000833': - 'The organization employs automated mechanisms to assist in the tracking of security incidents.', - 'CCI-000834': - 'Defines a time period for personnel to report suspected incidents to the organizational incident response capability.', - 'CCI-000835': - 'Require personnel to report suspected incidents to the organizational incident response capability within the organization-defined time period.', - 'CCI-000836': - 'Report incident information to organization-defined authorities.', - 'CCI-000837': - 'Report incidents using organization-defined automated mechanisms.', - 'CCI-000838': - 'Report system vulnerabilities associated with reported incidents to organization-defined personnel or roles.', - 'CCI-000839': - 'Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.', - 'CCI-000840': - 'The organization employs automated mechanisms to increase the availability of incident response-related information and support.', - 'CCI-000841': - 'Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability.', - 'CCI-000842': - 'Identify organizational incident response team members to the external providers.', - 'CCI-000843': - 'The organization develops an incident response plan that provides the organization with a roadmap for implementing its incident response capability; describes the structure and organization of the incident response capability; provides a high-level approach for how the incident response capability fits into the overall organization; meets the unique requirements of the organization, which relate to mission, size, structure, and functions; defines reportable incidents; provides metrics for measuring the incident response capability within the organization; and defines the resources and management support needed to effectively maintain and mature an incident response capability.', - 'CCI-000844': - 'Develop an incident response plan that is reviewed and approved by organization-defined personnel or roles on an organization-defined frequency.', - 'CCI-000845': - 'Defines incident response personnel (identified by name and/or by role) and organizational elements to whom copies of the incident response plan are distributed.', - 'CCI-000846': - 'Distributes copies of the incident response plan to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.', - 'CCI-000847': - 'The organization defines the frequency for reviewing the incident response plan.', - 'CCI-000848': - 'The organization reviews the incident response plan on an organization-defined frequency.', - 'CCI-000849': - 'Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing.', - 'CCI-000850': - 'Communicate incident response plan changes to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.', - 'CCI-000851': - 'Defines the frequency with which to review and update the current system maintenance policy.', - 'CCI-000852': - 'Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000853': - 'Disseminate an organization-level; mission/business process-level; and/or system-level maintenance policy to organization-defined personnel or roles.', - 'CCI-000854': - 'Review and update the current maintenance policy in accordance with organization-defined frequency.', - 'CCI-000855': - 'Develop and document procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls.', - 'CCI-000856': - 'Disseminate procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls to organization-defined personnel or roles.', - 'CCI-000857': - 'Review and update the current maintenance procedures in accordance with organization-defined frequency.', - 'CCI-000858': - 'The organization schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-000859': - 'The organization approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.', - 'CCI-000860': - 'Require that organization-defines personnel or roles explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement.', - 'CCI-000861': - 'Sanitize equipment to remove organization-defined information from associated media prior to removal from organizational facilities for off-site maintenance, repairs or replacement.', - 'CCI-000862': - 'Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair or replacement actions.', - 'CCI-000863': - 'The organization maintains maintenance records for the information system that include the date and time of maintenance, the name of the individual performing the maintenance, the name of escort, if necessary, a description of the maintenance performed, and a list of equipment removed or replaced (including identification numbers, if applicable).', - 'CCI-000864': - 'The organization employs automated mechanisms to schedule, conduct, and document maintenance and repairs as required.', - 'CCI-000865': 'Approve the use of system maintenance tools.', - 'CCI-000866': 'Control the use of system maintenance tools.', - 'CCI-000867': 'Monitor the use of system maintenance tools.', - 'CCI-000868': - 'The organization maintains, on an ongoing basis, information system maintenance tools.', - 'CCI-000869': - 'Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.', - 'CCI-000870': - 'Check media containing diagnostic and test programs for malicious code before the media are used in the system.', - 'CCI-000871': - 'Prevent the unauthorized removal of maintenance equipment containing organizational information by: (a) verifying that there is no organizational information contained on the equipment; (b) sanitizing or destroying the equipment; (c) retaining the equipment within the facility; or (d) obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.', - 'CCI-000872': - 'The organization employs automated mechanisms to restrict the use of maintenance tools to authorized personnel only.', - 'CCI-000873': 'Approve nonlocal maintenance and diagnostic activities.', - 'CCI-000874': 'Monitor nonlocal maintenance and diagnostic activities.', - 'CCI-000875': - 'The organization controls non-local maintenance and diagnostic activities.', - 'CCI-000876': - 'Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system.', - 'CCI-000877': - 'Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.', - 'CCI-000878': - 'Maintain records for nonlocal maintenance and diagnostic activities.', - 'CCI-000879': - 'The organization terminates sessions and network connections when nonlocal maintenance is completed.', - 'CCI-000880': - 'The organization audits non-local maintenance and diagnostic sessions.', - 'CCI-000881': - 'The organization documents, in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.', - 'CCI-000882': - 'Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced.', - 'CCI-000883': - 'Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information).', - 'CCI-000884': - 'Protect nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant.', - 'CCI-000885': - 'The organization requires that maintenance personnel notify organization-defined personnel when non-local maintenance is planned (i.e., date/time).', - 'CCI-000886': - 'Defines the personnel or roles to be notified of the date and time of planned nonlocal maintenance.', - 'CCI-000887': - 'Require the approval of each nonlocal maintenance session by organization-defined personnel or roles.', - 'CCI-000888': - 'The organization employs cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications.', - 'CCI-000889': - 'The organization employs remote disconnect verification at the termination of non-local maintenance and diagnostic sessions.', - 'CCI-000890': 'Establish a process for maintenance personnel authorization.', - 'CCI-000891': - 'Maintain a list of authorized maintenance organizations or personnel.', - 'CCI-000892': - 'The organization ensures that personnel performing maintenance on the information system have required access authorizations or designates organizational personnel with required access authorizations and technical competence deemed necessary to supervise information system maintenance.', - 'CCI-000893': - 'Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens.', - 'CCI-000894': - 'Requires maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals to be escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified.', - 'CCI-000895': - 'Require that, prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system be sanitized and all nonvolatile storage media be removed or physically disconnected from the system and secured.', - 'CCI-000896': - 'The organization requires that in the event an information system component cannot be sanitized, the procedures contained in the security plan for the system be enforced.', - 'CCI-000897': - 'Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.', - 'CCI-000898': - 'Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.', - 'CCI-000899': - 'Ensure that cleared foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments.', - 'CCI-000900': - 'Ensure that that approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.', - 'CCI-000901': - 'The organization defines a list of security-critical information system components and/or key information technology components for which it will obtain maintenance support and/or spare parts.', - 'CCI-000902': - 'The organization defines a time period for obtaining maintenance support and/or spare parts for security-critical information system components and/or key information technology components.', - 'CCI-000903': - 'Obtain maintenance support and/or spare parts for organization-defined system components within an organization-defined time period of failure.', - 'CCI-000904': - 'Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000905': - 'Disseminate a physical and environmental protection policy to organization-defined personnel or roles.', - 'CCI-000906': - 'Review and update the current physical and environmental protection policy in accordance with organization-defined frequency.', - 'CCI-000907': - 'Defines the frequency with which to review and update the physical and environmental protection policy.', - 'CCI-000908': - 'Develop and document procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls.', - 'CCI-000909': - 'Disseminate physical and environmental protection procedures to organization-defined personnel or roles.', - 'CCI-000910': - 'Review and update the current physical and environmental protection procedures in accordance with organization-defined frequency.', - 'CCI-000911': - 'Defines the frequency with which to review and update the physical and environmental protection procedures.', - 'CCI-000912': - 'Develop a list of individuals with authorized access to the facility where the system resides.', - 'CCI-000913': 'Issue authorization credentials for facility access.', - 'CCI-000914': - 'Review the access list detailing authorized facility access by individuals in accordance with organization-defined frequency.', - 'CCI-000915': - 'Defines the frequency with which to review the access list detailing authorized facility access by individuals.', - 'CCI-000916': - 'Authorize physical access to the facility where the system resides based on position or role.', - 'CCI-000917': - 'Require two forms of identification from an organization-defined list of acceptable forms of identification for visitor access to the facility where the system resides.', - 'CCI-000918': - 'The organization restricts physical access to the facility containing an information system that processes classified information to authorized personnel with appropriate clearances and access authorizations.', - 'CCI-000919': - 'The organization enforces physical access authorizations at organization-defined entry/exit points to the facility where the information system resides.', - 'CCI-000920': - 'Verify individual access authorizations before granting access to the facility.', - 'CCI-000921': - 'The organization controls ingress/egress to the facility where the information system resides using one or more organization-defined physical access control systems/devices or guards.', - 'CCI-000922': - "The organization controls access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.", - 'CCI-000923': 'Secure keys, combinations, and other physical access devices.', - 'CCI-000924': - 'Inventory organization-defined physical access devices on an organization-defined frequency.', - 'CCI-000925': - 'Defines the frequency for conducting inventories of organization-defined physical access devices.', - 'CCI-000926': - 'Change combinations and keys in accordance with organization-defined frequency and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.', - 'CCI-000927': 'Defines a frequency for changing combinations and keys.', - 'CCI-000928': - 'Enforce physical access authorizations to the system in addition to the physical access controls for the facility where the system resides at organization-defined physical spaces containing one or more components of the system.', - 'CCI-000929': - 'Perform security checks in accordance with organization-defined frequency at the physical boundary of the facility or system for unauthorized exfiltration of information or removal of system components.', - 'CCI-000930': - 'Employ guards to control every physical access point to the facility where the system resides 24 hours per day, 7 days per week.', - 'CCI-000931': - 'Use lockable physical casings to protect organization-defined system components from unauthorized physical access.', - 'CCI-000932': - 'Defines system components to be protected from unauthorized physical access using lockable physical casings.', - 'CCI-000933': - 'Employ organization-defined anti-tamper technologies to deter and/or prevent physical tampering or alteration of organization-defined hardware components within the system.', - 'CCI-000934': - 'The organization employs a penetration testing process that includes unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility on an organization-defined frequency.', - 'CCI-000935': - 'The organization defines the frequency of unannounced attempts to be included in a penetration testing process to bypass or circumvent security controls associated with physical access points to the facility.', - 'CCI-000936': - 'Control physical access to organization-defined system distribution and transmission lines within organizational facilities using organization-defined security controls.', - 'CCI-000937': - 'Control physical access to output from organization-defined output devices to prevent unauthorized individuals from obtaining the output.', - 'CCI-000938': - 'The organization monitors physical access to the information system to detect and respond to physical security incidents.', - 'CCI-000939': - 'Review physical access logs in accordance with organization-defined frequency.', - 'CCI-000940': 'Defines a frequency for reviewing physical access logs.', - 'CCI-000941': - "Coordinate results of reviews and investigations with the organization's incident response capability.", - 'CCI-000942': - 'Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.', - 'CCI-000943': - 'The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions.', - 'CCI-000944': - 'The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible.', - 'CCI-000945': - 'The organization escorts visitors and monitors visitor activity, when required.', - 'CCI-000946': - 'The organization requires two forms of identification for visitor access to the facility.', - 'CCI-000947': - 'Maintain visitor access records to the facility where the system resides for an organization-defined time period.', - 'CCI-000948': - 'Review visitor access records in accordance with organization-defined frequency.', - 'CCI-000949': - 'Defines the frequency with which to review the visitor access records for the facility where the system resides.', - 'CCI-000950': - 'Maintain and review visitor access records using organization-defined automated mechanisms.', - 'CCI-000951': - 'The organization maintains a record of all physical access, both visitor and authorized individuals.', - 'CCI-000952': - 'Protect power equipment and power cabling for the system from damage and destruction.', - 'CCI-000953': - 'The organization employs redundant and parallel power cabling paths.', - 'CCI-000954': - 'Employ automatic voltage controls for organization-defined critical system components.', - 'CCI-000955': - 'Defines critical system components that require automatic voltage controls.', - 'CCI-000956': - 'Provides the capability of shutting off power to the organization-defined system or individual system components in emergency situations.', - 'CCI-000957': - 'Place emergency shutoff switches or devices in an organization-defined location by system or system component to facilitate access for authorized personnel.', - 'CCI-000958': - 'Defines a location for emergency shutoff switches or devices by system or system component.', - 'CCI-000959': - 'Protect emergency power shutoff capability from unauthorized activation.', - 'CCI-000960': - 'The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system in the event of a primary power source loss.', - 'CCI-000961': - 'Provide an alternate power supply for the system that is activated manually or automatically and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.', - 'CCI-000962': - 'The organization provides a long-term alternate power supply for the information system that is self-contained and not reliant on external power generation.', - 'CCI-000963': - 'Employ and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.', - 'CCI-000964': - 'The organization provides emergency lighting for all areas within the facility supporting essential missions and business functions.', - 'CCI-000965': - 'Employ and maintain fire detection and suppression systems that are supported by an independent energy source.', - 'CCI-000966': - 'The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire.', - 'CCI-000967': - 'The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to the organization and emergency responders.', - 'CCI-000968': - 'Employ an automatic fire suppression capability for the system when the facility is not staffed on a continuous basis.', - 'CCI-000969': - 'The organization ensures that the facility undergoes, on an organization-defined frequency, fire marshal inspections and promptly resolves identified deficiencies.', - 'CCI-000970': - 'The organization defines a frequency for fire marshal inspections.', - 'CCI-000971': - 'Maintain temperature; humidity; pressure; radiation; and/or organization-defined environmental control levels within the facility where the system resides at organization-defined acceptable levels.', - 'CCI-000972': - 'Defines acceptable temperature, humidity, pressure, radiation, and/or organization-defined environmental control levels to be maintained within the facility where the system resides.', - 'CCI-000973': - 'Monitor environmental control levels in accordance with organization-defined frequency.', - 'CCI-000974': - 'Defines a frequency for monitoring environmental control levels.', - 'CCI-000975': - 'Employ organization-defined automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system.', - 'CCI-000976': - 'Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to organization-defined personnel or roles.', - 'CCI-000977': - 'Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible.', - 'CCI-000978': - 'Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are working properly.', - 'CCI-000979': - 'Key personnel have knowledge of the master water shutoff or isolation valves.', - 'CCI-000980': - 'The organization employs mechanisms that, without the need for manual intervention, protect the information system from water damage in the event of a water leak.', - 'CCI-000981': - 'Authorize organization-defined types of system components entering and exiting the facility.', - 'CCI-000982': - 'The organization monitors organization-defined types of information system components entering and exiting the facility.', - 'CCI-000983': - 'Control organization-defined types of system components entering and exiting the facility.', - 'CCI-000984': 'Maintain records of system components.', - 'CCI-000985': 'Employ organization-defined controls at alternate work sites.', - 'CCI-000986': - 'The organization defines management, operational, and technical information system security controls to be employed at alternate work sites.', - 'CCI-000987': - 'Assess as feasible, the effectiveness of controls at alternate work sites.', - 'CCI-000988': - 'Provide a means for employees to communicate with information security personnel in case of incidents.', - 'CCI-000989': - 'Position system components within the facility to minimize potential damage from organization-defined physical and environmental hazards.', - 'CCI-000990': - 'The organization positions information system components within the facility to minimize potential damage from environmental hazards.', - 'CCI-000991': - 'Position system components within the facility to minimize the opportunity for unauthorized access.', - 'CCI-000992': - 'The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards, and for existing facilities, considers the physical and environmental hazards in its risk mitigation strategy.', - 'CCI-000993': - 'Protect the system from information leakage due to electromagnetic signals emanations.', - 'CCI-000994': - 'The organization ensures that information system components, associated data communications, and networks are protected in accordance with national emissions and TEMPEST policies and procedures based on the security category or classification of the information.', - 'CCI-000995': - 'Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-000996': - 'Disseminates a media protection policy to organization-defined personnel or roles.', - 'CCI-000997': - 'Review and update the current media protection policy in accordance with organization-defined frequency.', - 'CCI-000998': - 'Defines a frequency for reviewing and updating the current media protection policy.', - 'CCI-000999': - 'Develop and document procedures to facilitate the implementation of the media protection policy and associated media protection controls.', - 'CCI-001000': - 'Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the media protection policy and associated media protection controls.', - 'CCI-001001': - 'Review and update the current media protection procedures in accordance with organization-defined frequency.', - 'CCI-001002': - 'Defines a frequency for reviewing and updating the current media protection procedures.', - 'CCI-001003': - 'Restrict access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.', - 'CCI-001004': - 'Defines types of digital and/or non-digital media for which the organization restricts access.', - 'CCI-001005': - 'Defines personnel or roles from which to restrict access to organization-defined types of digital and/or non-digital media.', - 'CCI-001006': - 'The organization defines security measures for restricting access to media.', - 'CCI-001007': - 'Restrict access to media storage areas using organization-defined automated mechanisms.', - 'CCI-001008': - 'Log access attempts and access granted using organization-defined automated mechanisms.', - 'CCI-001009': - 'The information system uses cryptographic mechanisms to protect and restrict access to information on portable digital media.', - 'CCI-001010': - 'Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information.', - 'CCI-001011': - 'Exempt organization-defined types of system media from marking as long as the media remain within organization-defined controlled areas.', - 'CCI-001012': - 'Defines types of system media to exempt from marking as long as the media remain within organization-defined controlled areas.', - 'CCI-001013': - 'Defines controlled areas where organization-defined types of system media are exempt from being marked.', - 'CCI-001014': - 'The organization physically controls and securely stores organization-defined types of digital and/or non-digital media within organization-defined controlled areas.', - 'CCI-001015': - 'Defines types of digital and/or non-digital media to physically control and securely store within organization-defined controlled areas.', - 'CCI-001016': - 'Defines controlled areas where organization-defined types of digital and/or non-digital media are physically controlled and securely stored.', - 'CCI-001017': - 'The organization defines security measures for securing media storage.', - 'CCI-001018': - 'The organization protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.', - 'CCI-001019': - 'The organization employs cryptographic mechanisms to protect information in storage.', - 'CCI-001020': - 'The organization protects and controls organization-defined types of information system media during transport outside of controlled areas using organization-defined security safeguards.', - 'CCI-001021': - 'Defines types of system media protected and controlled during transport outside of controlled areas.', - 'CCI-001022': - 'Defines controls to be used to protect and control organization-defined types of system media during transport outside of controlled areas.', - 'CCI-001023': - 'Maintain accountability for system media during transport outside of controlled areas.', - 'CCI-001024': - 'Restrict the activities associated with the transport of system media to authorized personnel.', - 'CCI-001025': - 'Document activities associated with the transport of system media.', - 'CCI-001026': - 'Employ an identified custodian during transport of system media outside of controlled areas.', - 'CCI-001027': - 'The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.', - 'CCI-001028': - 'Sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures.', - 'CCI-001029': - 'The organization tracks, documents, and verifies media sanitization and disposal actions.', - 'CCI-001030': - 'The organization tests sanitization equipment and procedures in accordance with the organization-defined frequency to verify that the intended sanitization is being achieved.', - 'CCI-001031': - 'Defines a frequency for testing sanitization equipment and procedures to ensure that the intended sanitization is being achieved.', - 'CCI-001032': - 'Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system in accordance with organization-defined circumstances requiring sanitization of portable storage devices.', - 'CCI-001033': - 'Defines circumstances requiring sanitization of portable storage devices prior to connecting such devices to the system.', - 'CCI-001034': - 'The organization sanitizes information system media containing Controlled Unclassified Information (CUI) or other sensitive information in accordance with applicable organizational and/or federal standards and policies.', - 'CCI-001035': - 'The organization sanitizes information system media containing classified information in accordance with NSA standards and policies.', - 'CCI-001036': - 'The organization destroys information system media that cannot be sanitized.', - 'CCI-001037': - 'Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-001038': - 'Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.', - 'CCI-001039': - 'Review and update the current risk assessment policy in accordance with organization-defined frequency.', - 'CCI-001040': - 'Defines the frequency with which to review and update the current risk assessment policy.', - 'CCI-001041': - 'Develop and document procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls.', - 'CCI-001042': - 'Disseminate risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls to organization-defined personnel or roles.', - 'CCI-001043': - 'Review and update the current risk assessment procedures in accordance with organization-defined frequency.', - 'CCI-001044': - 'Defines the frequency with which to review and update the current risk assessment procedures.', - 'CCI-001045': - 'The organization categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.', - 'CCI-001046': - 'Document the security categorization results including supporting rationale in the security plan for the system.', - 'CCI-001047': - 'Verify the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.', - 'CCI-001048': - 'Conduct a risk assessment, including determining the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information.', - 'CCI-001049': - 'Document risk assessment results in the organization-defined document.', - 'CCI-001050': - 'Review risk assessment results on an organization-defined frequency.', - 'CCI-001051': 'Defines a frequency for reviewing risk assessment results.', - 'CCI-001052': - 'Update the risk assessment on an organization-defined frequency or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.', - 'CCI-001053': 'Defines a frequency for updating the risk assessment.', - 'CCI-001054': - 'Monitor and scan for vulnerabilities in the system and hosted applications on an organization-defined frequency and/or randomly in accordance with organization-defined process.', - 'CCI-001055': - 'Defines a frequency for scanning for vulnerabilities in the system and hosted applications, and/or randomly in accordance with organization-defined process.', - 'CCI-001056': - 'Monitor and scan for vulnerabilities in the system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported.', - 'CCI-001057': - 'Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating platforms, software flaws, and improper configurations.', - 'CCI-001058': - 'Analyze vulnerability scan reports and results from vulnerability monitoring.', - 'CCI-001059': - 'Remediate legitimate vulnerabilities in organization-defined response times in accordance with an organizational assessment risk.', - 'CCI-001060': - 'Defines response times for remediating legitimate vulnerabilities in accordance with an organization assessment of risk.', - 'CCI-001061': - 'Share information obtained from the vulnerability monitoring process and control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other systems.', - 'CCI-001062': - 'The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.', - 'CCI-001063': - 'Update the system vulnerabilities scanned on an organization-defined frequency, prior to a new scan, and/or when new vulnerabilities are identified and reported.', - 'CCI-001064': - 'Defines a frequency for updating the system vulnerabilities scanned.', - 'CCI-001065': - 'The organization employs vulnerability scanning procedures that can demonstrate the breadth of coverage (i.e., information system components scanned).', - 'CCI-001066': 'Determine information about the system that is discoverable.', - 'CCI-001067': - 'Implement privileged access authorization to organization-identified system components for organization-defined vulnerability scanning activities.', - 'CCI-001068': - 'Compare the results of multiple vulnerability scans using organization-defined automated mechanisms.', - 'CCI-001069': - 'The organization employs automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization-defined frequency.', - 'CCI-001070': - 'The organization defines a frequency for employing automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials.', - 'CCI-001071': - 'Review historic audit logs to determine if a vulnerability identified in the organization-defined system has been previously exploited within an organization-defined time period.', - 'CCI-001072': - 'The organization employs an independent penetration agent or penetration team to conduct a vulnerability analysis on the information system.', - 'CCI-001073': - 'The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system based on the vulnerability analysis to determine the exploitability of identified vulnerabilities.', - 'CCI-001074': - 'The organization develops a system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-001075': - 'Disseminates to organization-defined personnel or roles the organization-level; mission/business process-level; and/or system-level system and communications protection policy.', - 'CCI-001076': - 'Review and update the current system and communications protection policy in accordance with organization-defined frequency.', - 'CCI-001077': - 'Defines the frequency for reviewing and updating the current system and communications protection policy.', - 'CCI-001078': - 'The organization develops system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.', - 'CCI-001079': - 'Disseminates to organization-defined personnel or roles the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.', - 'CCI-001080': - 'Review and update the current system and communications protection procedures in accordance with organization-defined frequency.', - 'CCI-001081': - 'Defines the frequency for reviewing and updating the current system and communications protection procedures.', - 'CCI-001082': - 'Separate user functionality, including user interface services, from system management functionality.', - 'CCI-001083': - 'Prevent the presentation of system management functionality at an interface for non-privileged users.', - 'CCI-001084': 'Isolate security functions from nonsecurity functions.', - 'CCI-001085': - 'Employ hardware separation mechanisms to implement security function isolation.', - 'CCI-001086': - 'Isolate security functions enforcing access and information flow control from both nonsecurity functions and from other security functions.', - 'CCI-001087': - 'The organization implements an information system isolation boundary to minimize the number of nonsecurity functions included within the boundary containing security functions.', - 'CCI-001088': - 'The organization implements security functions as largely independent modules that avoid unnecessary interactions between modules.', - 'CCI-001089': - 'Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.', - 'CCI-001090': - 'Prevent unauthorized and unintended information transfer via shared system resources.', - 'CCI-001091': - 'The information system does not share resources that are used to interface with systems operating at different security levels.', - 'CCI-001092': - 'The information system protects against or limits the effects of the organization-defined or referenced types of denial of service attacks.', - 'CCI-001093': - 'Defines the types of denial-of-service events for protecting against or limiting the effects of the denial-of-service events.', - 'CCI-001094': - 'Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems.', - 'CCI-001095': - 'Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service attacks.', - 'CCI-001096': - 'The information system limits the use of resources by priority.', - 'CCI-001097': - 'Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.', - 'CCI-001098': - 'Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.', - 'CCI-001099': - 'The organization physically allocates publicly accessible information system components to separate subnetworks with separate physical network interfaces.', - 'CCI-001100': - "The information system prevents public access into the organization's internal networks except as appropriately mediated by managed interfaces employing boundary protection devices.", - 'CCI-001101': - 'Limit the number of external network connections to the system.', - 'CCI-001102': - 'Implement a managed interface for each external telecommunication service.', - 'CCI-001103': - 'Establish a traffic flow policy for each managed interface for each external telecommunication service.', - 'CCI-001104': - 'The organization employs security controls as needed to protect the confidentiality and integrity of the information being transmitted.', - 'CCI-001105': - 'Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need.', - 'CCI-001106': - 'Review exceptions to the traffic flow policy on an organization-defined frequency for each external telecommunication service.', - 'CCI-001107': - 'Defines a frequency for the review of exceptions to the traffic flow policy for each external telecommunication service.', - 'CCI-001108': - 'Remove traffic flow policy exceptions that are no longer supported by an explicit mission or business need for each external telecommunication service.', - 'CCI-001109': - 'Deny network communications traffic by default and allow network communications traffic by exception at managed interfaces; and/or for organization-defined systems.', - 'CCI-001110': - 'The organization prevents the unauthorized release of information outside of the information system boundary or any unauthorized communication through the information system boundary when there is an operational failure of the boundary protection mechanisms.', - 'CCI-001111': - 'The information system prevents remote devices that have established a non-remote connection with the system from communicating outside of that communications path with resources in external networks.', - 'CCI-001112': - 'Route organization-defined internal communications traffic to organization-defined external networks through authenticated proxy servers at managed interfaces.', - 'CCI-001113': - 'Defines the internal communications traffic to be routed to external networks.', - 'CCI-001114': - 'Defines the external networks to which organization-defined internal communications traffic should be routed.', - 'CCI-001115': - 'The information system, at managed interfaces, denies network traffic and audits internal users (or malicious code) posing a threat to external information systems.', - 'CCI-001116': 'Prevent the exfiltration of information.', - 'CCI-001117': - 'The information system checks incoming communications to ensure the communications are coming from an authorized source and routed to an authorized destination.', - 'CCI-001118': - 'The information system implements host-based boundary protection mechanisms for servers, workstations, and mobile devices.', - 'CCI-001119': - 'Isolate organization-defined information security tools, mechanisms, and support components from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.', - 'CCI-001120': - 'Defines the information security tools, mechanisms, and support components to be isolated.', - 'CCI-001121': - 'Protect against unauthorized physical connections at organization-defined managed interfaces.', - 'CCI-001122': - 'The organization defines the managed interfaces where boundary protections against unauthorized physical connections are to be implemented.', - 'CCI-001123': - 'Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.', - 'CCI-001124': - 'Prevent discovery of specific system components that represent a managed interface.', - 'CCI-001125': 'Enforce adherence to protocol formats.', - 'CCI-001126': - 'Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.', - 'CCI-001127': - 'The information system protects the integrity of transmitted information.', - 'CCI-001128': - 'The organization employs cryptographic mechanisms to recognize changes to information during transmission unless otherwise protected by alternative physical measures.', - 'CCI-001129': - 'The information system maintains the integrity of information during aggregation, packaging, and transformation in preparation for transmission.', - 'CCI-001130': - 'The information system protects the confidentiality of transmitted information.', - 'CCI-001131': - 'The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical measures.', - 'CCI-001132': - 'The information system maintains the confidentiality of information during aggregation, packaging, and transformation in preparation for transmission.', - 'CCI-001133': - 'Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.', - 'CCI-001134': - 'Defines the time period of inactivity after which the system terminates a network connection associated with a communications session.', - 'CCI-001135': - 'Provide a physically or logically isolated trusted communication path for communication between the user and the trusted components of the system.', - 'CCI-001136': - 'The organization defines security functions include information system authentication and reauthentication.', - 'CCI-001137': - 'The organization establishes cryptographic keys for required cryptography employed within the information system.', - 'CCI-001138': - 'The organization manages cryptographic keys for required cryptography employed within the information system.', - 'CCI-001139': - 'Maintain availability of information in the event of the loss of cryptographic keys by users.', - 'CCI-001140': - 'The organization produces, controls, and distributes symmetric cryptographic keys using NIST-approved or NSA-approved key management technology and processes.', - 'CCI-001141': - 'The organization produces, controls, and distributes symmetric and asymmetric cryptographic keys using NSA-approved key management technology and processes.', - 'CCI-001142': - 'The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 certificates or prepositioned keying material.', - 'CCI-001143': - "The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key.", - 'CCI-001144': - 'The information system implements required cryptographic protections using cryptographic modules that comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.', - 'CCI-001145': - 'The organization employs, at a minimum, FIPS-validated cryptography to protect unclassified information.', - 'CCI-001146': - 'The organization employs NSA-approved cryptography to protect classified information.', - 'CCI-001147': - 'The organization employs, at a minimum, FIPS-validated cryptography to protect information when such information must be separated from individuals who have the necessary clearances yet lack the necessary access approvals.', - 'CCI-001148': - 'The organization employs FIPS-validated or NSA-approved cryptography to implement digital signatures.', - 'CCI-001149': - 'The information system protects the integrity and availability of publicly available information and applications.', - 'CCI-001150': - 'Prohibit remote activation of collaborative computing devices and applications, excluding the organization-defined exceptions where remote activation is to be allowed.', - 'CCI-001151': - 'Defines exceptions to the prohibition of collaborative computing devices where remote activation is to be allowed.', - 'CCI-001152': - 'Provide an explicit indication of use to users physically present at collaborative computing devices.', - 'CCI-001153': - 'Provide physical or logical disconnect of collaborative computing devices in a manner that supports ease of use.', - 'CCI-001154': - 'The information system or supporting environment blocks both inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers.', - 'CCI-001155': - 'Disable or remove collaborative computing devices and applications from organization-defined systems or system components in organization-defined secure work areas.', - 'CCI-001156': - 'Defines secure work areas where collaborative computing devices and applications are to be disabled or removed.', - 'CCI-001157': - 'Associate organization-defined security attributes with information exchanged between systems.', - 'CCI-001158': 'Verify the integrity of transmitted security attributes.', - 'CCI-001159': - 'Issue public key certificates under an organization-defined certificate policy or obtain public key certificates from an approved service provider.', - 'CCI-001160': - 'Defines acceptable and unacceptable mobile code and mobile code technologies.', - 'CCI-001161': - 'The organization establishes usage restrictions for acceptable mobile code and mobile code technologies.', - 'CCI-001162': - 'The organization establishes implementation guidance for acceptable mobile code and mobile code technologies.', - 'CCI-001163': 'Authorize the use of mobile code within the system.', - 'CCI-001164': 'Monitor the use of mobile code within the system.', - 'CCI-001165': 'Control the use of mobile code within the system.', - 'CCI-001166': 'Identify organization-defined unacceptable mobile code.', - 'CCI-001167': - 'Verify that the development of mobile code to be deployed in information systems meets organization-defined mobile code requirements.', - 'CCI-001168': - 'Defines mobile code requirements for the acquisition, development, and use of mobile code.', - 'CCI-001169': - 'Prevent the download of organization-defined unacceptable mobile code.', - 'CCI-001170': - 'Prevents the automatic execution of mobile code in organization-defined software applications.', - 'CCI-001171': - 'Defines software applications in which automatic mobile code execution is to be prohibited.', - 'CCI-001172': 'Defines actions to be enforced before executing mobile code.', - 'CCI-001173': - 'The organization establishes usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.', - 'CCI-001174': - 'The organization establishes implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.', - 'CCI-001175': - 'The organization authorizes the use of VoIP within the information system.', - 'CCI-001176': - 'The organization monitors the use of VoIP within the information system.', - 'CCI-001177': - 'The organization controls the use of VoIP within the information system.', - 'CCI-001178': - 'Provide additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.', - 'CCI-001179': - 'Provides the means to indicate the security status of child zones, when operating as part of a distributed, hierarchical namespace.', - 'CCI-001180': - 'The information system performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources when requested by client systems.', - 'CCI-001181': - 'The information system performs data origin authentication and data integrity verification on all resolution responses received whether or not local client systems explicitly request this service.', - 'CCI-001182': - 'Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant.', - 'CCI-001183': - 'Ensure the systems that collectively provide name/address resolution service for an organization implement internal/external role separation.', - 'CCI-001184': 'Protect the authenticity of communications sessions.', - 'CCI-001185': - 'Invalidate session identifiers upon user logout or other session termination.', - 'CCI-001186': - 'The information system provides a readily observable logout capability whenever authentication is used to gain access to web pages.', - 'CCI-001187': - 'The information system generates a unique session identifier for each session.', - 'CCI-001188': - 'Generate a unique session identifier for each session with organization-defined randomness requirements.', - 'CCI-001189': - 'Defines randomness requirements for generating unique session identifiers.', - 'CCI-001190': - 'Fail to an organization-defined known-system state for the list of organization-defined types of system failures on organization-defined system components on the indicated components while preserving organization-defined system state information in failure.', - 'CCI-001191': - 'Defines the known system state the system should fail to in the event of an organization-defined system failure.', - 'CCI-001192': - 'Defines types of system failures for which should fail to an organization-defined known system state.', - 'CCI-001193': - 'Defines system state information that should be preserved in the event of a system failure.', - 'CCI-001194': - 'Employ minimal functionality and information storage on organization-defined information system components.', - 'CCI-001195': - 'Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.', - 'CCI-001196': - 'Include system components that proactively seek to identify network-based malicious code or malicious websites.', - 'CCI-001197': - 'Include within organizational systems organization-defined platform-independent applications.', - 'CCI-001198': 'Defines applications that are platform independent.', - 'CCI-001199': - 'Protects the confidentiality and/or integrity of organization-defined information at rest.', - 'CCI-001200': - 'The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information at rest unless otherwise protected by alternative physical measures.', - 'CCI-001201': - 'Employ a diverse set of information technologies for organization-defined system components in the implementation of the system.', - 'CCI-001202': - 'The organization employs virtualization techniques to present information system components as other types of components, or components with differing configurations.', - 'CCI-001203': - 'Employ virtualization techniques to support the deployment of a diversity of operating systems that are changed on an organization-defined frequency.', - 'CCI-001204': - 'Defines the frequency of changes to operating systems and applications to support a diversity of deployments.', - 'CCI-001205': - 'The organization employs randomness in the implementation of the virtualization techniques.', - 'CCI-001206': - 'The organization requires that information system developers/integrators perform a covert channel analysis to identify those aspects of system communication that are potential avenues for covert storage and timing channels.', - 'CCI-001207': - 'Test a subset of the identified covert channels to determine which channels are exploitable.', - 'CCI-001208': - 'The organization partitions the information system into components residing in separate physical domains (or environments) as deemed necessary.', - 'CCI-001209': - 'The information system protects the integrity of information during the processes of data aggregation, packaging, and transformation in preparation for transmission.', - 'CCI-001210': - 'For organization-defined system components, load and execute the operating environment from hardware-enforced, read-only media.', - 'CCI-001211': - 'For organization-defined system components, load and execute organization-defined applications from hardware-enforced, read-only media.', - 'CCI-001212': - 'Defines system components on which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media.', - 'CCI-001213': - 'Defines applications that will be loaded and executed from hardware-enforced, read-only media.', - 'CCI-001214': - 'Employ organization-defined system components with no writeable storage that is persistent across component restart or power on/off.', - 'CCI-001215': - 'Defines the system components to be employed with no writeable storage.', - 'CCI-001216': - 'Protect the integrity of information prior to storage on read-only media.', - 'CCI-001217': - 'Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-001218': - 'Disseminate an organization-level; mission/business process-level; and/or system level system and information integrity policy to organization-defined personnel or roles.', - 'CCI-001219': - 'Review and update the current system and information integrity policy in accordance with organization-defined frequency.', - 'CCI-001220': - 'Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system level system and information integrity policy and associated system integrity controls.', - 'CCI-001221': - 'Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls.', - 'CCI-001222': - 'Review and update the current system and information integrity procedures in accordance with organization-defined frequency.', - 'CCI-001223': - 'Defines the frequency for reviewing and updating the current system and information integrity policy.', - 'CCI-001224': - 'Defines the frequency for reviewing and updating the current system and information integrity procedures.', - 'CCI-001225': 'Identify system flaws.', - 'CCI-001226': 'Report system flaws.', - 'CCI-001227': 'Correct system flaws.', - 'CCI-001228': - 'Test software updates related to flaw remediation for effectiveness before installation.', - 'CCI-001229': - 'Test software updates related to flaw remediation for potential side effects before installation.', - 'CCI-001230': - 'Incorporate flaw remediation into the organizational configuration management process.', - 'CCI-001231': - 'The organization centrally manages the flaw remediation process.', - 'CCI-001232': 'The organization installs software updates automatically.', - 'CCI-001233': - 'The organization employs automated mechanisms on an organization-defined frequency to determine the state of information system components with regard to flaw remediation.', - 'CCI-001234': - 'The organization defines a frequency for employing automated mechanisms to determine the state of information system components with regard to flaw remediation.', - 'CCI-001235': - 'Measure the time between flaw identification and flaw remediation.', - 'CCI-001236': - 'Defines benchmarks for the time taken to apply corrective actions after flaw identification.', - 'CCI-001237': - 'The organization employs automated patch management tools to facilitate flaw remediation to organization-defined information system components.', - 'CCI-001238': - 'The organization defines information system components for which automated patch management tools are to be employed to facilitate flaw remediation.', - 'CCI-001239': - 'The organization employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.', - 'CCI-001240': - 'The organization updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.', - 'CCI-001241': - 'Configure malicious code protection mechanisms to perform periodic scans of the system on an organization-defined frequency.', - 'CCI-001242': - 'The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.', - 'CCI-001243': - 'Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection.', - 'CCI-001244': - 'Defines one or more actions to perform in response to malicious code detection, such as blocking malicious code, quarantining malicious code, or sending alerts to administrators.', - 'CCI-001245': - 'Address the receipt of false positives during malicious code detection and eradication, and the resulting potential impact on the availability of the system.', - 'CCI-001246': - 'The organization centrally manages malicious code protection mechanisms.', - 'CCI-001247': - 'The information system automatically updates malicious code protection mechanisms.', - 'CCI-001248': - 'The information system prevents non-privileged users from circumventing malicious code protection capabilities.', - 'CCI-001249': - 'Update malicious code protection mechanisms only when directed by a privileged user.', - 'CCI-001250': - 'The organization does not allow users to introduce removable media into the information system.', - 'CCI-001251': - 'Test malicious code protection mechanisms on an organization-defined frequency by introducing a known benign code into the system.', - 'CCI-001252': - 'The organization monitors events on the information system in accordance with organization-defined monitoring objectives and detects information system attacks.', - 'CCI-001253': - 'Defines the objectives of monitoring for attacks and indicators of potential attacks on the system.', - 'CCI-001254': - 'The organization identifies unauthorized use of the information system.', - 'CCI-001255': - 'Invoke internal monitoring capabilities or deploy monitoring devices strategically within the system to collect organization-determined essential information.', - 'CCI-001256': - 'Invoke internal monitoring capabilities or deploy monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization.', - 'CCI-001257': - 'Adjust the level of system monitoring activity when there is a change in increased risk to organizational operations and assets, individuals, other organizations, or the Nation.', - 'CCI-001258': - 'Obtain legal opinion with regard to system monitoring activities.', - 'CCI-001259': - 'The organization interconnects and configures individual intrusion detection tools into a systemwide intrusion detection system using common protocols.', - 'CCI-001260': - 'Employ automated tools to support near real-time analysis of events.', - 'CCI-001261': - 'The organization employs automated tools to integrate intrusion detection tools into access control and flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.', - 'CCI-001262': - 'The information system monitors inbound and outbound communications for unusual or unauthorized activities or conditions.', - 'CCI-001263': - 'The information system provides near real-time alerts when any of the organization-defined list of compromise or potential compromise indicators occurs.', - 'CCI-001264': - 'Defines the indicators of compromise or potential compromise which will result in system alerts being provided to organization-defined personnel or roles.', - 'CCI-001265': - 'The information system prevents non-privileged users from circumventing intrusion detection and prevention capabilities.', - 'CCI-001266': - 'Notify an organization-defined incident response personnel (identified by name and/or by role) of detected suspicious events.', - 'CCI-001267': - 'Defines incident response personnel (identified by name and/or by role) to be notified of detected suspicious events.', - 'CCI-001268': - 'Defines the least-disruptive actions to be taken by system to terminate suspicious events.', - 'CCI-001269': - 'The organization protects information obtained from intrusion monitoring tools from unauthorized access, modification, and deletion.', - 'CCI-001270': - 'Test intrusion monitoring tools at an organization-defined frequency.', - 'CCI-001271': 'Defines the frequency for testing intrusion monitoring tools.', - 'CCI-001272': - 'The organization makes provisions so encrypted traffic is visible to information system monitoring tools.', - 'CCI-001273': - 'Analyze outbound communications traffic at the external interfaces to the system to discover anomalies.', - 'CCI-001274': - 'Alert organization-defined personnel or roles using organization-defined automated mechanisms when inappropriate or unusual activities with security or privacy implications.', - 'CCI-001275': - 'Defines the activities which will trigger alerts to security personnel of inappropriate or unusual activities.', - 'CCI-001276': - 'Analyze communications traffic and event patterns for the system.', - 'CCI-001277': - 'Develop profiles representing common traffic and event patterns.', - 'CCI-001278': - 'The organization uses the traffic/event profiles in tuning system monitoring devices to reduce the number of false positives to an organization-defined measure of false positives and the number of false negatives to an organization-defined measure of false negatives.', - 'CCI-001279': - 'The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false positives.', - 'CCI-001280': - 'The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false negatives.', - 'CCI-001281': - 'The organization employs a wireless intrusion detection system.', - 'CCI-001282': - 'Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.', - 'CCI-001283': - 'Correlate information from monitoring tools employed throughout the system.', - 'CCI-001284': - 'Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.', - 'CCI-001285': - 'Receive system security alerts, advisories, and directives from organization-defined external organizations on an ongoing basis.', - 'CCI-001286': - 'Generate internal security alerts, advisories, and directives as deemed necessary.', - 'CCI-001287': - 'Disseminate security alerts, advisories, and directives to organization-defined personnel or roles, organization-defined elements within the organization, and/or organization-defined external organizations.', - 'CCI-001288': - 'Defines the personnel or roles to whom the organization will disseminate security alerts, advisories, and directives.', - 'CCI-001289': - 'Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.', - 'CCI-001290': - 'Broadcast security alert and advisory information throughout the organization using organization-defined automated mechanisms.', - 'CCI-001291': - 'The information system verifies the correct operation of security functions in accordance with organization-defined conditions and in accordance with organization-defined frequency (if periodic verification).', - 'CCI-001292': - 'The organization defines the appropriate conditions, including the system transitional states if applicable, for verifying the correct operation of security functions.', - 'CCI-001293': - 'The organization defines the information system responses and alternative action(s) to anomalies discovered during security function verification.', - 'CCI-001294': - 'Alert organization-defined personnel or roles of failed security verification tests.', - 'CCI-001295': - 'Implement automated mechanisms to support the management of distributed security function testing.', - 'CCI-001296': - 'Report the results of security function verification to organization-defined personnel or roles.', - 'CCI-001297': - 'The information system detects unauthorized changes to software and information.', - 'CCI-001298': - 'The organization reassesses the integrity of software and information by performing, on an organization-defined frequency, integrity scans of the information system.', - 'CCI-001299': - 'The organization defines the frequency of integrity scans to be performed on the information system.', - 'CCI-001300': - 'Employ automated tools that provide notification to organization-defined personnel or roles upon discovering discrepancies during integrity verification.', - 'CCI-001301': 'Employ centrally managed integrity verification tools.', - 'CCI-001302': - 'The organization requires use of tamper-evident packaging for organization-defined information system components during organization-defined conditions.', - 'CCI-001303': - 'The organization defines information system components that require tamper-evident packaging.', - 'CCI-001304': - 'The organization defines conditions (i.e., transportation from vendor to operational site, during operation, both) under which tamper-evident packaging must be used for organization-defined information system components.', - 'CCI-001305': - 'The organization employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.', - 'CCI-001306': - 'The organization updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.', - 'CCI-001307': - 'The organization centrally manages spam protection mechanisms.', - 'CCI-001308': - 'Automatically update spam protection mechanisms on an organization-defined frequency.', - 'CCI-001309': - 'The organization restricts the capability to input information to the information system to authorized personnel.', - 'CCI-001310': - 'Checks the validity of organization-defined information inputs to the system.', - 'CCI-001311': - 'The information system identifies potentially security-relevant error conditions.', - 'CCI-001312': - 'Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited.', - 'CCI-001313': - 'The organization defines sensitive or potentially harmful information that should not be contained in error logs and administrative messages.', - 'CCI-001314': - 'Reveal error messages only to organization-defined personnel or roles.', - 'CCI-001315': - 'Manage information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.', - 'CCI-001316': - 'The organization protects the information system from harm by considering mean time to failure rates for an organization-defined list of information system components in specific environments of operation.', - 'CCI-001317': - 'The organization defines a list of information system components for which mean time to failure rates should be considered to protect the information system from harm.', - 'CCI-001318': 'Provide substitute system components.', - 'CCI-001319': - 'Take system components out of service by transferring component responsibilities to a substitute component no later than an organization-defined fraction or percentage of mean time to failure (MTTF).', - 'CCI-001320': - 'Defines the maximum fraction or percentage of mean time to failure (MTTF) used to determine when system components are taken out of service by transferring component responsibilities to substitute components.', - 'CCI-001321': - 'Prohibit processes from executing without supervision for more than an organization-defined time period.', - 'CCI-001322': - 'Defines a time period that is the longest a process is allowed to execute without supervision.', - 'CCI-001323': - 'Manually initiate transfers between active and standby system components when the use of the active component reaches an organization-defined percentage of the mean time to failure.', - 'CCI-001324': - 'The organization defines the minimum frequency at which the organization manually initiates a transfer between active and standby information system components if the mean time to failure (MTTF) exceeds the organization-defined time period.', - 'CCI-001325': - 'The organization defines a time period that the mean time to failure (MTTF) must exceed before the organization manually initiates a transfer between active and standby information system components.', - 'CCI-001326': - 'If system component failures are detected, ensure standby components are successfully and transparently installed within an organization-defined time period.', - 'CCI-001327': - 'Defines a time period for a standby system component to be successfully and transparently installed for the system component that has failed.', - 'CCI-001328': - 'If system component failures are detected, activate an organization-defined alarm, automatically shut down the system, and/or organization-defined action.', - 'CCI-001329': - 'Defines the alarm to be activated when a system component failure is detected.', - 'CCI-001330': - 'Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official.', - 'CCI-001331': - 'Prohibit the connection of unclassified mobile devices to classified systems.', - 'CCI-001332': - 'Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official.', - 'CCI-001333': - 'Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited.', - 'CCI-001334': - 'Require unclassified mobile devices used in facilities containing systems processing, storing, or transmitting classified information and the information stored on those devices be subject to random reviews and inspections by organization-defined security officials.', - 'CCI-001335': - 'Defines security officials to perform reviews and inspections of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information.', - 'CCI-001336': - 'Retain individual training records for an organization-defined time-period.', - 'CCI-001337': - 'Defines the time period for retaining individual training records.', - 'CCI-001338': - 'The information system associates the identity of the information producer with the information.', - 'CCI-001339': - "The information system validates the binding of the information producer's identity to the information.", - 'CCI-001340': - 'Maintain reviewer or releaser identity and credentials within the established chain of custody for all information reviewed or released.', - 'CCI-001341': - 'Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between organization-defined security domains.', - 'CCI-001342': - 'The organization employs either FIPS-validated or NSA-approved cryptography to implement digital signatures.', - 'CCI-001343': - 'The information system invokes a system shutdown in the event of an audit failure, unless an alternative audit capability exists.', - 'CCI-001344': - 'The organization specifies the permitted actions for each authorized information system process, role, and/or user in the audit and accountability policy.', - 'CCI-001345': - 'The organization employs automated mechanisms to alert security personnel of any organization-defined inappropriate or unusual activities with security implications.', - 'CCI-001346': - 'The organization defines a list of inappropriate or unusual activities with security implications that are to result in alerts to security personnel.', - 'CCI-001347': - 'The organization performs, in a physically dedicated information system, full-text analysis of privileged functions executed.', - 'CCI-001348': - 'Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component than the system or component being audited.', - 'CCI-001349': - 'Defines a frequency for storing audit records in a repository that is part of a physically different system or system component than the system or component being audited.', - 'CCI-001350': - 'Implement cryptographic mechanisms to protect the integrity of audit information.', - 'CCI-001351': - 'Authorize access to management of audit logging functionality to only an organization-defined subset of privileged users or roles.', - 'CCI-001352': - 'The organization protects the audit records of non-local accesses to privileged accounts and the execution of privileged functions.', - 'CCI-001353': - 'Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.', - 'CCI-001354': - 'The organization manages information system accounts by deactivating temporary accounts that are no longer required.', - 'CCI-001355': - 'The organization manages information system accounts by deactivating accounts of terminated or transferred users.', - 'CCI-001356': - 'The organization monitors for atypical usage of information system accounts.', - 'CCI-001357': - 'The organization reports atypical usage to designated organizational officials.', - 'CCI-001358': - 'Establish privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.', - 'CCI-001359': 'The organization tracks privileged role assignments.', - 'CCI-001360': 'Monitor privileged role assignments.', - 'CCI-001361': - 'Defines a time period after which temporary accounts are automatically terminated.', - 'CCI-001362': - 'The information system enforces a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.', - 'CCI-001363': - 'The organization establishes a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.', - 'CCI-001365': - 'Defines a time period after which emergency accounts are automatically terminated.', - 'CCI-001366': - 'The organization defines user information to be encrypted or stored off-line in a secure location.', - 'CCI-001367': - 'The organization defines system information to be encrypted or stored off-line in a secure location.', - 'CCI-001368': - 'Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.', - 'CCI-001371': - 'Defines security or privacy policy filters requiring fully enumerated formats which are to be implemented when transferring information between different security domains.', - 'CCI-001372': - 'When transferring information between different security domains, implement organization-defined security or privacy policy filters requiring fully enumerated formats that restrict data structure and content.', - 'CCI-001373': - 'When transferring information between different security domains, examine the information for the presence of organization-defined unsanctioned information.', - 'CCI-001374': - 'When transferring information between different security domains, prohibit the transfer of such information in accordance with the organization-defined security or privacy policy.', - 'CCI-001376': - 'The information system uniquely identifies source domains for information transfer.', - 'CCI-001377': - 'The information system uniquely authenticates source domains for information transfer.', - 'CCI-001380': - 'The organization documents separation of duties of individuals.', - 'CCI-001382': - 'The organization defines the number of consecutive, unsuccessful login attempts to the mobile device.', - 'CCI-001383': - 'The information system provides additional protection for mobile devices accessed via login by purging information from the device after an organization-defined number of consecutive, unsuccessful login attempts to the mobile device.', - 'CCI-001384': - 'For publicly accessible systems, display system use information with organization-defined conditions before granting further access to the publicly accessible system.', - 'CCI-001385': - 'For publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities.', - 'CCI-001386': - 'For publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities.', - 'CCI-001387': - 'For publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.', - 'CCI-001388': - 'For publicly accessible systems, includes a description of the authorized uses of the system.', - 'CCI-001389': - 'Defines the time period that the system notifies the user of the number of successful logon/access attempts.', - 'CCI-001390': - 'Defines the time period that the system notifies the user of the number of unsuccessful logon/access attempts.', - 'CCI-001391': - 'Notify the user, upon successful logon, of the number of successful logons/accesses during the organization-defined time period.', - 'CCI-001392': - 'Notify the user, upon successful logon, of the number of unsuccessful logon/access attempts during the organization-defined time period.', - 'CCI-001393': - "Defines the security-related characteristics/parameters of the user's account which, when changed, will result in a notification being provided to the user during the organization-defined time period.", - 'CCI-001394': - "Defines the time period during which organization-defined security-related changes to the user's account are to be tracked.", - 'CCI-001395': - "Notify the user, upon successful logon, of changes to organization-defined security-related characteristics/parameters of the user's account during the organization-defined time-period.", - 'CCI-001396': - 'The organization defines security attributes for which the information system supports and maintains the bindings for information in storage.', - 'CCI-001397': - 'The organization defines security attributes for which the information system supports and maintains the bindings for information in process.', - 'CCI-001398': - 'The organization defines security attributes for which the information system supports and maintains the bindings for information in transmission.', - 'CCI-001399': - 'The information system supports and maintains the binding of organization-defined security attributes to information in storage.', - 'CCI-001400': - 'The information system supports and maintains the binding of organization-defined security attributes to information in process.', - 'CCI-001401': - 'The information system supports and maintains the binding of organization-defined security attributes to information in transmission.', - 'CCI-001402': - 'The organization monitors for unauthorized remote access to the information system.', - 'CCI-001403': 'Automatically audit account modification actions.', - 'CCI-001404': 'Automatically audit account disabling actions.', - 'CCI-001405': 'Automatically audit account removal actions.', - 'CCI-001406': - 'Defines a time period of expected inactivity when users are required to log out.', - 'CCI-001407': - 'Administer privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.', - 'CCI-001408': - 'Defines privileged commands for which dual authorization is to be enforced.', - 'CCI-001409': - 'The organization defines nondiscretionary access control policies to be enforced over the organization-defined set of users and resources, where the rule set for each policy specifies access control information employed by the policy rule set (e.g., position, nationality, age, project, time of day) and required relationships among the access control information to permit access.', - 'CCI-001410': - 'The organization defines the set of users and resources over which the information system is to enforce nondiscretionary access control policies.', - 'CCI-001411': - 'Defines security-relevant information to which the system prevents access except during secure, non-operable system states.', - 'CCI-001412': - 'The organization encrypts or stores off-line, in a secure location, organization-defined user information.', - 'CCI-001413': - 'The organization encrypts or stores off-line, in a secure location, organization-defined system information.', - 'CCI-001414': - 'Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.', - 'CCI-001415': - 'Defines limitations for the embedding of data types within other data types.', - 'CCI-001416': - 'The organization defines one-way information flows to be enforced by the information system.', - 'CCI-001417': - 'Defines security policy filters to be enforced and used as a basis for flow control decisions.', - 'CCI-001418': - 'The organization defines security policy filters for which the information system enforces the use of human review.', - 'CCI-001419': - 'Defines the security functions or security-relevant information to which users of system accounts, or roles, have access.', - 'CCI-001420': - 'Defines the privileged commands to which network access is to be authorized only for organization-defined compelling operational needs.', - 'CCI-001421': - 'The organization limits authorization to super user accounts on the information system to designated system administration personnel.', - 'CCI-001422': - 'Prohibit privileged access to the system by non-organizational users.', - 'CCI-001423': - 'Defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts occur.', - 'CCI-001424': - 'Dynamically associate security attributes with organization-defined subjects in accordance with organization-defined security policies as information is created and combined.', - 'CCI-001425': - 'Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes.', - 'CCI-001426': - 'The information system maintains the binding of security attributes to information with sufficient assurance that the information--attribute association can be used as the basis for automated policy actions.', - 'CCI-001427': - 'The information system allows authorized users to associate security attributes with information.', - 'CCI-001428': - 'Display security attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.', - 'CCI-001429': - 'Identify special dissemination, handling, or distribution instructions for identifying security attributes on output.', - 'CCI-001430': - 'Identify human-readable, standard naming conventions for identifying security attributes on output.', - 'CCI-001431': - 'The organization defines a frequency for monitoring for unauthorized remote connections to the information system.', - 'CCI-001432': - 'The organization takes appropriate action if an unauthorized remote connection to the information system is discovered.', - 'CCI-001433': - 'The organization defines a list of security functions and security-relevant information that for remote access sessions have organization-defined security measures employed and are audited.', - 'CCI-001434': - 'The organization defines additional security measures to be employed when an organization-defined list of security functions and security-relevant information is accessed remotely.', - 'CCI-001435': - 'The organization defines networking protocols within the information system deemed to be nonsecure.', - 'CCI-001436': - 'The organization disables organization-defined networking protocols within the information system deemed to be nonsecure except for explicitly identified components in support of specific operational requirements.', - 'CCI-001437': - 'The organization documents the rationale for the execution of privileged commands and access to security-relevant information in the security plan for the information system.', - 'CCI-001438': - 'The organization establishes usage restrictions for wireless access.', - 'CCI-001439': 'Establish implementation guidance for wireless access.', - 'CCI-001440': - 'The organization monitors for unauthorized wireless access to the information system.', - 'CCI-001441': - 'Authorize each type of wireless access to the system prior to allowing such connections.', - 'CCI-001442': - 'The organization enforces requirements for wireless connections to the information system.', - 'CCI-001443': - 'Protect wireless access to the system using authentication of users and/or devices.', - 'CCI-001444': 'Protect wireless access to the system using encryption.', - 'CCI-001445': - 'The organization monitors for unauthorized wireless connections to the information system on an organization-defined frequency.', - 'CCI-001446': - 'The organization scans for unauthorized wireless access points on an organization-defined frequency.', - 'CCI-001447': - 'The organization defines a frequency of monitoring for unauthorized wireless connections to information system, including scans for unauthorized wireless access points.', - 'CCI-001448': - 'The organization takes appropriate action if an unauthorized wireless connection is discovered.', - 'CCI-001449': - 'Disable, when not intended for use, wireless networking capabilities internally embedded within system components prior to issuance and deployment.', - 'CCI-001450': - 'The organization does not allow users to independently configure wireless networking capabilities.', - 'CCI-001451': - 'Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.', - 'CCI-001452': - 'The information system enforces the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted.', - 'CCI-001453': - 'Implement cryptographic mechanisms to protect the integrity of remote access sessions.', - 'CCI-001454': - 'The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information are audited.', - 'CCI-001455': - 'The organization explicitly identifies components needed in support of specific operational requirements.', - 'CCI-001456': - 'The organization defines locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.', - 'CCI-001457': - 'The organization defines inspection and preventative measures to be applied on mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.', - 'CCI-001458': - 'If classified information is found on mobile devices, the incident handling policy is to be followed.', - 'CCI-001459': - 'Defines system components that provide audit record generation capability.', - 'CCI-001460': - 'Monitor organization-defined open source information and/or information sites per organization-defined frequency for evidence of unauthorized disclosure of organizational information.', - 'CCI-001461': - 'Defines a frequency for monitoring open source information and/or information sites for evidence of unauthorized exfiltration or disclosure of organizational information.', - 'CCI-001462': - 'The information system provides the capability for authorized users to capture/record and log content related to a user session.', - 'CCI-001463': - 'The information system provides the capability to remotely view/hear all content related to an established user session in real time.', - 'CCI-001464': 'Initiates session audits automatically at system start-up.', - 'CCI-001465': - 'The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to store organization-controlled information using the external information systems.', - 'CCI-001466': - 'The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to transmit organization-controlled information using the external information systems.', - 'CCI-001467': - "The organization prohibits authorized individuals from using an external information system to process organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.", - 'CCI-001468': - "The organization prohibits authorized individuals from using an external information system to store organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.", - 'CCI-001469': - "The organization prohibits authorized individuals from using an external information system to transmit organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.", - 'CCI-001470': - 'Defines information sharing circumstances where user discretion is required.', - 'CCI-001471': - 'Employ organization-defined automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.', - 'CCI-001472': - 'Defines the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.', - 'CCI-001473': - 'Designate individuals authorized to post information onto a publicly accessible system.', - 'CCI-001474': - 'Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information.', - 'CCI-001475': - 'Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included.', - 'CCI-001476': - 'Review the content on the publicly accessible system for nonpublic information on an organization-defined frequency.', - 'CCI-001477': - 'Defines a frequency for reviewing the content on the publicly accessible system for nonpublic information.', - 'CCI-001478': - 'Remove nonpublic information from the publicly accessible system, if discovered.', - 'CCI-001479': - 'The organization provides refresher security awareness training to all information system users (including managers, senior executives, and contractors) in accordance with the organization-defined frequency.', - 'CCI-001480': - 'The organization defines the frequency for providing refresher security awareness training to all information system users (including managers, senior executives, and contractors).', - 'CCI-001481': - 'Provide organization-defined personnel or roles with initial training in the employment and operation of environmental controls.', - 'CCI-001482': - 'Provide organization-defined personnel or roles with refresher training in the employment and operation of environmental controls in accordance with the organization-defined frequency.', - 'CCI-001483': - 'Defines a frequency for providing employees with refresher training in the employment and operation of environmental controls.', - 'CCI-001484': - 'Defines the frequency of (or situation requiring) logging for each identified event.', - 'CCI-001485': 'Defines the event types for logging within the system.', - 'CCI-001486': - 'The organization defines a frequency for reviewing and updating the list of organization-defined auditable events.', - 'CCI-001487': - 'Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.', - 'CCI-001488': - 'Defines the additional information to be included in the audit records.', - 'CCI-001489': - 'The organization defines information system components for which generated audit records are centrally managed by the organization.', - 'CCI-001490': - 'Defines the actions to be taken by the system upon audit failure, including shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.', - 'CCI-001491': - 'Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.', - 'CCI-001492': - 'The organization defines an authoritative time source for the synchronization of internal information system clocks.', - 'CCI-001493': 'Protect audit tools from unauthorized access.', - 'CCI-001494': 'Protect audit tools from unauthorized modification.', - 'CCI-001495': 'Protect audit tools from unauthorized deletion.', - 'CCI-001496': - 'Implement cryptographic mechanisms to protect the integrity of audit tools.', - 'CCI-001497': - 'Defines a frequency for the review and update to the baseline configuration of the system.', - 'CCI-001498': - 'Defines a time period after which proposed changes to the system that have not been approved or disapproved are highlighted.', - 'CCI-001499': - 'Limit privileges to change software resident within software libraries.', - 'CCI-001500': - 'The information system automatically implements organization-defined safeguards and countermeasures if security functions (or mechanisms) are changed inappropriately.', - 'CCI-001501': - 'The organization defines safeguards and countermeasures to be employed by the information system if security functions (or mechanisms) are changed inappropriately.', - 'CCI-001502': - 'The organization monitors changes to the configuration settings in accordance with organizational policies and procedures.', - 'CCI-001503': - 'The organization controls changes to the configuration settings in accordance with organizational policies and procedures.', - 'CCI-001504': - 'Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-001505': - 'Disseminate an organization-level; mission/business process-level; and/or system-level personnel security policy to organization-defined personnel or roles.', - 'CCI-001506': - 'Review and update the current personnel security policy in accordance with organization-defined frequency.', - 'CCI-001507': - 'Defines the frequency with which to review and update the current personnel security policy.', - 'CCI-001508': - 'Defines the frequency with which to review and update the current personnel security procedures.', - 'CCI-001509': - 'Develop and document procedures to facilitate the implementation of the personnel security policy and associated personnel security controls.', - 'CCI-001510': - 'Disseminate personnel security procedures to organization-defined personnel or roles.', - 'CCI-001511': - 'Review and update the current personnel security procedures in accordance with organization-defined frequency.', - 'CCI-001512': 'Assign a risk designation to all organizational positions.', - 'CCI-001513': - 'Establish screening criteria for individuals filling organizational positions.', - 'CCI-001514': - 'Review and update position risk designations in accordance with organization-defined frequency.', - 'CCI-001515': - 'Defines the frequency with which to review and update position risk designations.', - 'CCI-001516': 'Screen individuals prior to authorizing access to the system.', - 'CCI-001517': - 'Rescreen individuals with authorized access to the system in accordance with organization-defined conditions requiring rescreening, and where rescreening is so indicated, on the organization-defined frequency of rescreening.', - 'CCI-001518': - 'Defines the conditions requiring rescreening of individuals with authorized access to the system.', - 'CCI-001519': - 'Defines the frequency for rescreening individuals with authorized access to the information system when organization-defined conditions requiring rescreening are met.', - 'CCI-001520': - 'Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.', - 'CCI-001521': - 'Verify that individuals accessing a system processing, storing, or transmitting types of classified information which require formal indoctrination, are formally indoctrinated for all of the relevant types of information to which they have access on the system.', - 'CCI-001522': - 'Upon termination of individual employment, disable system access within an organization-defined time period.', - 'CCI-001523': - 'Upon termination of individual employment, conduct exit interviews that include a discussion of organization-defined information security topics.', - 'CCI-001524': - 'Upon termination of individual employment, retrieve all security-related organizational system-related property.', - 'CCI-001525': - 'Upon termination of individual employment, retain access to organizational information formerly controlled by the terminated individual.', - 'CCI-001526': - 'Upon termination of individual employment, retain access to organizational systems formerly controlled by the terminated individual.', - 'CCI-001527': - 'Review and confirm the ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization.', - 'CCI-001528': - 'Initiate organization-defined transfer or reassignment actions within an organization-defined time period following the formal personnel transfer action.', - 'CCI-001529': - 'Defines transfer or reassignment actions to initiate within an organization-defined time period following the formal personnel transfer action.', - 'CCI-001530': - 'Defines the time period within which the organization initiates organization-defined transfer or reassignment actions following the formal personnel transfer action.', - 'CCI-001531': - 'The organization ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access.', - 'CCI-001532': - 'Review and update the access agreements for organizational systems in accordance with organization-defined frequency.', - 'CCI-001533': - 'Defines the frequency with which to review and update access agreements for organizational systems.', - 'CCI-001534': - 'The organization ensures that access to information with special protection measures is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.', - 'CCI-001535': - 'The organization ensures that access to information with special protection measures is granted only to individuals who satisfy associated personnel security criteria.', - 'CCI-001536': - 'Verify that access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.', - 'CCI-001537': - 'Verify that access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria.', - 'CCI-001538': - 'Verify that access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a nondisclosure agreement.', - 'CCI-001539': - 'Establish personnel security requirements including security roles and responsibilities for external providers.', - 'CCI-001540': 'Document personnel security requirements.', - 'CCI-001541': - 'Monitor provider compliance with personnel security requirements.', - 'CCI-001542': - 'The organization employs a formal sanctions process for individuals failing to comply with established information security policies and procedures.', - 'CCI-001543': - 'The organization disseminates the most recent information security program plan to appropriate entities in the organization that includes roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-001544': - 'Manage system authenticators by ensuring that authenticators have sufficient strength of mechanism for their intended use.', - 'CCI-001545': - 'Defines a frequency for reviewing and updating the access control policy.', - 'CCI-001546': - 'Defines a frequency for reviewing and updating the access control procedures.', - 'CCI-001547': - 'Defines the frequency on which it will review information system accounts for compliance with account management requirements.', - 'CCI-001548': - 'Defines the information flow control policies for controlling the flow of information within the system.', - 'CCI-001549': - 'Defines the information flow control policies for controlling the flow of information between interconnected systems.', - 'CCI-001550': - 'The organization defines approved authorizations for controlling the flow of information within the system.', - 'CCI-001551': - 'The organization defines approved authorizations for controlling the flow of information between interconnected systems.', - 'CCI-001552': - 'The organization defines policy that allows or disallows information flows based on changing conditions or operational considerations.', - 'CCI-001553': - 'Defines security or privacy policy filters that privileged administrators have the capability to enable and disable.', - 'CCI-001554': - 'Defines the security or privacy policy filters that privileged administrators have the capability to configure.', - 'CCI-001555': - 'The information system uniquely identifies destination domains for information transfer.', - 'CCI-001556': - 'The information system uniquely authenticates destination domains for information transfer.', - 'CCI-001557': - 'The information system tracks problems associated with the information transfer.', - 'CCI-001558': - 'Defines the security functions (deployed in hardware, software, and firmware) for which access must be authorized.', - 'CCI-001559': - 'The organization identifies the individuals authorized to change the value of associated security attributes.', - 'CCI-001560': - 'The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined objects.', - 'CCI-001561': - 'The organization defines managed access control points for remote access to the information system.', - 'CCI-001562': - 'The organization defines the appropriate action(s) to be taken if an unauthorized remote connection is discovered.', - 'CCI-001563': - 'The organization defines the appropriate action(s) to be taken if an unauthorized wireless connection is discovered.', - 'CCI-001564': - 'Defines the frequency of security awareness and training policy reviews and updates.', - 'CCI-001565': - 'Defines the frequency of security awareness and training procedure reviews and updates.', - 'CCI-001566': - 'Provide organization-defined personnel or roles with initial training in the employment and operation of physical security controls.', - 'CCI-001567': - 'Provide organization-defined personnel or roles with refresher training, thereafter, in the employment and operation of physical security controls in accordance with the organization-defined frequency.', - 'CCI-001568': - 'Defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.', - 'CCI-001569': - 'Defines the frequency on which the current audit and accountability policy will be reviewed and updated.', - 'CCI-001570': - 'Defines the frequency on which the current audit and accountability procedures will be reviewed and updated.', - 'CCI-001571': - 'Defines the event types that the system is capable of logging in support of the audit function.', - 'CCI-001572': - 'Defines the personnel or roles to be alerted in the event of an audit logging process failure.', - 'CCI-001573': - 'Defines whether to reject or delay network traffic that exceeds organization-defined thresholds.', - 'CCI-001574': - 'The information system rejects or delays, as defined by the organization, network traffic which exceed the organization-defined thresholds.', - 'CCI-001575': - 'The organization defines the system or system component for storing audit records that is a different system or system component than the system or component being audited.', - 'CCI-001576': - 'The information system produces a system-wide (logical or physical) audit trail of information system audit records.', - 'CCI-001577': - 'Defines the system components from which audit records are to be compiled into the system-wide audit trail.', - 'CCI-001578': - 'Defines the frequency to review and update the current assessment, authorization, and monitoring procedures.', - 'CCI-001579': - 'The organization conducts security control assessments using organization-defined forms of testing in accordance with organization-defined frequency and assessment techniques.', - 'CCI-001580': - 'The organization identifies connections to external information systems (i.e., information systems outside of the authorization boundary).', - 'CCI-001581': - 'The organization defines personnel or roles to whom the security status of the organization and the information system should be reported.', - 'CCI-001582': - 'Defines other forms of control assessments other than in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment that should be included as part of the control assessments.', - 'CCI-001583': - 'The organization selects announced or unannounced assessments for each form of security control assessment.', - 'CCI-001584': - 'Defines the frequency with which to review and update configuration management procedures.', - 'CCI-001585': - 'Defines the circumstances that require reviews and updates to the baseline configuration of the system.', - 'CCI-001586': - 'Defines the configuration change control element responsible for coordinating and providing oversight for configuration change control activities.', - 'CCI-001587': - 'The organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.', - 'CCI-001588': - 'The organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements.', - 'CCI-001589': - "The organization incorporates detection of unauthorized, security-relevant configuration changes into the organization's incident response capability to ensure they are tracked.", - 'CCI-001590': - 'The organization develops a list of software programs authorized to execute on the information system.', - 'CCI-001591': - 'The organization develops a list of software programs not authorized to execute on the information system.', - 'CCI-001592': - 'Defines the rules authorizing the terms and conditions of software program usage on the system.', - 'CCI-001593': - 'The organization maintains a list of software programs authorized to execute on the information system.', - 'CCI-001594': - 'The organization maintains a list of software programs not authorized to execute on the information system.', - 'CCI-001595': - 'The organization maintains rules authorizing the terms and conditions of software program usage on the information system.', - 'CCI-001596': - 'Defines the frequency with which to review and update the current contingency planning procedures.', - 'CCI-001597': - 'Disseminate contingency planning procedures to organization-defined personnel or roles.', - 'CCI-001598': - 'Review and update the current contingency planning procedures in accordance with the organization-defined frequency.', - 'CCI-001599': - 'Sustain operational continuity of essential missions until full system restoration at primary processing and/or storage sites.', - 'CCI-001600': - 'Sustains operational continuity of essential business functions until full system restoration at primary processing and/or storage sites.', - 'CCI-001601': - 'Sustain operational continuity of essential mission functions at alternate processing and/or storage sites until system restoration to primary processing and/or storage sites.', - 'CCI-001602': - 'Sustain operational continuity of essential business functions at alternate processing and/or storage sites until system restoration at primary processing and/or storage sites.', - 'CCI-001603': - 'The contingency plan identifies the primary storage site hazards.', - 'CCI-001604': - 'Outline explicit mitigation actions for potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.', - 'CCI-001605': - 'The contingency plan identifies the primary processing site hazards.', - 'CCI-001606': - 'Identify potential accessibility problems to outline explicit mitigation actions.', - 'CCI-001607': - 'The organization establishes alternate telecommunications services to support the information system.', - 'CCI-001608': - "The organization identifies the primary provider's telecommunications service hazards.", - 'CCI-001609': - 'Activate the redundant secondary system that is not collocated with the primary system without loss of information or disruption to operations.', - 'CCI-001610': - 'Defines the time-period (by authenticator type) for changing/refreshing authenticators.', - 'CCI-001611': - 'The organization defines the minimum number of special characters for password complexity enforcement.', - 'CCI-001612': - 'The organization defines the minimum number of upper case characters for password complexity enforcement.', - 'CCI-001613': - 'The organization defines the minimum number of lower case characters for password complexity enforcement.', - 'CCI-001614': - 'The organization defines the minimum number of numeric characters for password complexity enforcement.', - 'CCI-001615': - 'The organization defines the minimum number of characters that are changed when new passwords are created.', - 'CCI-001616': - 'The organization defines minimum password lifetime restrictions.', - 'CCI-001617': - 'The organization defines maximum password lifetime restrictions.', - 'CCI-001618': - 'The organization defines the number of generations for which password reuse is prohibited.', - 'CCI-001619': - 'The information system enforces password complexity by the minimum number of special characters used.', - 'CCI-001620': - 'The organization defines the types of and/or specific authenticators for which the registration process must be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).', - 'CCI-001621': - 'Implement organization-defined security controls to manage the risk of compromise due to individuals having accounts on multiple systems.', - 'CCI-001622': - 'The organization identifies personnel with incident response roles and responsibilities with respect to the information system.', - 'CCI-001623': - 'The incident response training material addresses the procedures and activities necessary to fulfill identified organizational incident response roles and responsibilities.', - 'CCI-001624': - 'The organization documents the results of incident response tests.', - 'CCI-001625': - 'Implement the resulting incident handling activity changes to incident response procedures, training, and testing accordingly.', - 'CCI-001626': - 'The organization employs automated mechanisms to assist in the collection of security incident information.', - 'CCI-001627': - 'The organization employs automated mechanisms to assist in the analysis of security incident information.', - 'CCI-001628': - 'Defines a frequency with which to review and update the current maintenance procedures.', - 'CCI-001629': - 'The organization employs automated mechanisms to produce up-to-date, accurate, complete, and available records of all maintenance and repair actions needed, in process, and complete.', - 'CCI-001630': - 'Designated organizational personnel review the maintenance records of the non-local maintenance and diagnostic sessions.', - 'CCI-001631': - 'After the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.', - 'CCI-001632': - 'Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by either physically separated communications paths or logically separated communications paths based upon encryption.', - 'CCI-001633': - 'The organization defines removable media types and information output requiring marking.', - 'CCI-001634': - 'The organization identifies authorized personnel with appropriate clearances and access authorizations for gaining physical access to the facility containing an information system that processes classified information.', - 'CCI-001635': - 'Remove individuals from the facility access list when access is no longer required.', - 'CCI-001636': - 'Defines the frequency with which to review and update the current planning policy.', - 'CCI-001637': - 'Review and update the current planning policy in accordance with organization-defined frequency.', - 'CCI-001638': - 'Defines the frequency with which to review and update the current planning procedures.', - 'CCI-001639': - 'The organization makes readily available to individuals requiring access to the information system the rules that describe their responsibilities and expected behavior with regard to information and information system usage.', - 'CCI-001640': - 'Address information security issues in the updating of a critical infrastructure and key resources protection plan.', - 'CCI-001641': - 'Defines the process for conducting random vulnerability scans on the system and hosted applications.', - 'CCI-001642': - 'Defines the organizational document in which risk assessment results are documented (e.g., security plan, privacy plan; risk assessment report).', - 'CCI-001643': - 'Monitor and scan for vulnerabilities in the system and hosted applications in accordance with the organization-defined process for random scans.', - 'CCI-001644': - 'The organization employs vulnerability scanning procedures that can demonstrate the depth of coverage (i.e., vulnerabilities checked).', - 'CCI-001645': - 'The organization identifies the information system components to which privileged access is authorized for selected organization-defined vulnerability scanning activities.', - 'CCI-001646': - 'Defines the frequency with which to review and update the current system and services acquisition procedures.', - 'CCI-001647': - 'The organization requires the use of a FIPS-validated, cryptographic module for a technology product that relies on cryptographic functionality to enforce its security policy when no U.S. Government Protection Profile exists for such a specific technology type.', - 'CCI-001648': - 'The organization makes available to authorized personnel the source code for the information system to permit analysis and testing.', - 'CCI-001649': - 'The organization identifies and documents (as appropriate) explicit rules to be enforced when governing the installation of software by users.', - 'CCI-001650': - 'The organization requires the information system developers to manage and control changes to the information system during development.', - 'CCI-001651': - 'The organization requires the information system integrators to manage and control changes to the information system during development.', - 'CCI-001652': - 'The organization requires the information system developers to manage and control changes to the information system during implementation.', - 'CCI-001653': - 'The organization requires the information system integrators to manage and control changes to the information system during implementation.', - 'CCI-001654': - 'The organization requires the information system developers to manage and control changes to the information system during modification.', - 'CCI-001655': - 'The organization requires the information system integrators to manage and control changes to the information system during modification.', - 'CCI-001656': - 'The organization defines the security functions of the information system to be isolated from nonsecurity functions.', - 'CCI-001657': - 'The organization defines the external boundary of the information system.', - 'CCI-001658': - 'The organization defines key internal boundaries of the information system.', - 'CCI-001659': - "The organization defines the mediation necessary for public access to the organization's internal networks.", - 'CCI-001660': - 'The organization defines the measures to protect against unauthorized physical connections across boundary protections implemented at organization-defined managed interfaces.', - 'CCI-001661': - 'Defines the security functions, to at a minimum, include system authentication and re-authentication, for permitting users to invoke the trusted communications path.', - 'CCI-001662': - 'Take organization-defined corrective action when organization-defined unacceptable mobile code is identified.', - 'CCI-001663': - 'The information system, when operating as part of a distributed, hierarchical namespace, provides the means to enable verification of a chain of trust among parent and child domains (if the child supports secure resolution services).', - 'CCI-001664': 'Recognize only session identifiers that are system-generated.', - 'CCI-001665': - 'Preserve organization-defined system state information in the event of a system failure.', - 'CCI-001666': - 'The organization employs cryptographic mechanisms to prevent unauthorized modification of information at rest unless otherwise protected by alternative physical measures.', - 'CCI-001667': - 'The organization compares the time measured between flaw identification and flaw remediation with organization-defined benchmarks.', - 'CCI-001668': - 'The organization employs malicious code protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.', - 'CCI-001669': - 'Defines the frequency of testing malicious code protection mechanisms.', - 'CCI-001670': - 'Take organization-defined least-disruptive actions to terminate suspicious events.', - 'CCI-001671': - 'Analyze outbound communications traffic at selected organization-defined interior points within the system to discover anomalies.', - 'CCI-001672': - 'The organization employs a wireless intrusion detection system to identify rogue wireless devices.', - 'CCI-001673': - 'Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.', - 'CCI-001674': - 'The information system responds to security function anomalies in accordance with organization-defined responses and alternative action(s).', - 'CCI-001675': - 'Defines the personnel or roles that are to receive reports on the results of security function verification.', - 'CCI-001676': - 'The organization defines, for periodic security function verification, the frequency of the verifications.', - 'CCI-001677': - 'The organization employs spam protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.', - 'CCI-001678': - 'Retain information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.', - 'CCI-001679': - 'The organization provides a mechanism to exchange active and standby roles of the components.', - 'CCI-001680': - 'Develop an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-001681': - 'The organization defines the frequency at which each form of security control assessment should be conducted.', - 'CCI-001682': - 'Automatically remove or disable emergency accounts after an organization-defined time period for each type of account.', - 'CCI-001683': - 'The information system notifies organization-defined personnel or roles for account creation actions.', - 'CCI-001684': - 'The information system notifies organization-defined personnel or roles for account modification actions.', - 'CCI-001685': - 'The information system notifies organization-defined personnel or roles for account disabling actions.', - 'CCI-001686': - 'The information system notifies organization-defined personnel or roles for account removal actions.', - 'CCI-001687': - 'Verify that the use of mobile code deployed in system meets organization-defined mobile code requirements.', - 'CCI-001688': - 'Verify the acquisition of mobile code deployed in the system meets organization-defined mobile code requirements.', - 'CCI-001689': - 'The organization, if an information system component failure is detected, automatically shuts down the information system.', - 'CCI-001690': - 'The organization protects, as required, vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system.', - 'CCI-001691': - 'The organization makes available to authorized personnel vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.', - 'CCI-001692': - 'The organization makes available to authorized personnel vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.', - 'CCI-001693': - 'The information system enforces a Discretionary Access Control (DAC) policy that limits propagation of access rights.', - 'CCI-001694': - 'The information system enforces a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.', - 'CCI-001695': - 'Prevent the execution of organization-defined unacceptable mobile code.', - 'CCI-001726': 'Use software in accordance with contract agreements.', - 'CCI-001727': - 'Use software documentation in accordance with contract agreements.', - 'CCI-001728': 'Use software in accordance with copyright laws.', - 'CCI-001729': 'Use software documentation in accordance with copyright laws.', - 'CCI-001730': - 'Track the use of software protected by quantity licenses to control copying of the software.', - 'CCI-001731': - 'Track the use of software documentation protected by quantity licenses to control distribution of the software documentation.', - 'CCI-001732': - 'Control the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.', - 'CCI-001733': - 'Document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.', - 'CCI-001734': - 'Defines the restrictions to be followed on the use of open source software.', - 'CCI-001735': - 'Establish organization-defined restrictions on the use of open source software.', - 'CCI-001736': - 'Defines the number of previous versions of the baseline configuration of the system required to support rollback.', - 'CCI-001737': - 'Defines the systems or system components that are to have organization-defined configurations applied when located in areas of significant risk.', - 'CCI-001738': - 'Defines the configurations to be implemented on systems and system components when they are located in areas of significant risk.', - 'CCI-001739': - 'Issue organization-defined systems or system components with organization-defined configurations to individuals traveling to locations the organization deems to be of significant risk.', - 'CCI-001740': - 'Review proposed configuration-controlled changes to the system.', - 'CCI-001741': - 'Document configuration change decisions associated with the system.', - 'CCI-001742': - 'Defines the approval authorities to be notified when proposed changes to the system are received.', - 'CCI-001743': - 'Defines the security responses to be automatically implemented if baseline configurations are changed in an unauthorized manner.', - 'CCI-001744': - 'Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.', - 'CCI-001745': - 'Defines the controls that are to be provided by the cryptographic mechanisms are under configuration management.', - 'CCI-001746': - 'Ensure that cryptographic mechanisms used to provide organization-defined control are under configuration management.', - 'CCI-001747': - 'The organization defines critical software components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.', - 'CCI-001748': - 'The organization defines critical firmware components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.', - 'CCI-001749': - 'The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.', - 'CCI-001750': - 'The information system prevents the installation of organization-defined firmware components without verification the firmware component has been digitally signed using a certificate that is recognized and approved by the organization.', - 'CCI-001751': - 'Defines system-level information requiring enforcement of a dual authorization for system changes.', - 'CCI-001752': - 'Enforce dual authorization for implementing changes to organization-defined system-level information.', - 'CCI-001753': - 'Limit privileges to change system components within a production or operational environment.', - 'CCI-001754': - 'Limit privileges to change system-related information within a production or operational environment.', - 'CCI-001755': - 'Defines the system components for which any deviation from the established configuration settings are to be identified, documented, and approved.', - 'CCI-001756': - 'Defines the operational requirements on which the configuration settings for the organization-defined system components are to be based.', - 'CCI-001757': - 'Defines the actions to employ when responding to unauthorized changes to the organization-defined configuration settings.', - 'CCI-001758': - 'Defines the configuration settings for which to employ organization-defined actions in response to unauthorized changes.', - 'CCI-001759': - 'Take organization-defined actions in response to unauthorized changes to organization-defined configuration settings.', - 'CCI-001760': - 'Defines the frequency of system reviews to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services.', - 'CCI-001761': - 'Defines the functions, ports, protocols, software, and services within the information system that are to be disabled or removed when deemed unnecessary and/or nonsecure.', - 'CCI-001762': - 'Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.', - 'CCI-001763': - 'Defines the policies regarding software program usage and restrictions.', - 'CCI-001764': - 'Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.', - 'CCI-001765': - 'Defines the software programs not authorized to execute on the system.', - 'CCI-001766': - 'Identify the organization-defined software programs not authorized to execute on the system.', - 'CCI-001767': - 'Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system.', - 'CCI-001768': - 'Defines the frequency on which the list of unauthorized software programs will be reviewed and updated.', - 'CCI-001769': - 'The organization defines the frequency on which it will update the list of unauthorized software programs.', - 'CCI-001770': - 'Review and update the list of unauthorized software programs per organization-defined frequency.', - 'CCI-001771': - 'The organization updates the list of unauthorized software programs per organization-defined frequency.', - 'CCI-001772': - 'Defines the software programs authorized to execute on the system.', - 'CCI-001773': - 'Identify the organization-defined software programs authorized to execute on the system.', - 'CCI-001774': - 'Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.', - 'CCI-001775': - 'Defines the frequency on which the list of authorized software programs will be reviewed and updated.', - 'CCI-001776': - 'The organization defines the frequency on which it will update the list of authorized software programs.', - 'CCI-001777': - 'Review and update the list of authorized software programs per organization-defined frequency.', - 'CCI-001778': - 'The organization updates the list of authorized software programs per organization-defined frequency.', - 'CCI-001779': - 'Defines the frequency on which the system component inventory is to be reviewed and updated.', - 'CCI-001780': - 'Review and update the system component inventory per organization-defined frequency.', - 'CCI-001781': - 'The organization defines the frequency on which the information system component inventory is to be updated.', - 'CCI-001782': - 'The organization updates the information system component inventory per organization-defined frequency.', - 'CCI-001783': - 'Defines the personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the system.', - 'CCI-001784': - 'When unauthorized hardware, software, and firmware components are detected within the system, the organization takes action to disable network access by such components, isolates the components, and/or notifies organization-defined personnel or roles.', - 'CCI-001785': - 'Provide a centralized repository for the inventory of system components.', - 'CCI-001786': - 'Support the tracking of system components by geographic location using organization-defined automated mechanisms.', - 'CCI-001787': - 'The organization defines the acquired information system components that are to be assigned to an information system.', - 'CCI-001788': 'Assign system components to a system.', - 'CCI-001789': - 'Receive an acknowledgement from organization-defined personnel or roles of the acquired system components to a system.', - 'CCI-001790': - 'The organization develops a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.', - 'CCI-001791': - 'The organization documents a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.', - 'CCI-001792': - 'Implement a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle.', - 'CCI-001793': - 'The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.', - 'CCI-001794': - 'The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.', - 'CCI-001795': - 'Implement a configuration management plan for the system that establishes a process for managing the configuration of the configuration items.', - 'CCI-001796': - 'The organization develops a configuration management plan for the information system that places the configuration items under configuration management.', - 'CCI-001797': - 'The organization documents a configuration management plan for the information system that places the configuration items under configuration management.', - 'CCI-001798': - 'Implement a configuration management plan for the system that places the configuration items under configuration management.', - 'CCI-001799': - 'Develop and document a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification.', - 'CCI-001800': - 'The organization documents a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification.', - 'CCI-001801': - 'Implement a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification.', - 'CCI-001802': - 'Track the use of software documentation protected by quantity licenses to control copying of the software documentation.', - 'CCI-001803': - 'Track the use of software protected by quantity licenses to control distribution of the software.', - 'CCI-001804': - 'Defines the policies for governing the installation of software by users.', - 'CCI-001805': - 'Establish organization-defined policies governing the installation of software by users.', - 'CCI-001806': - 'Defines methods to be employed to enforce the software installation policies.', - 'CCI-001807': - 'Enforce software installation policies through organization-defined methods.', - 'CCI-001808': - 'Defines the frequency on which it will monitor software installation policy compliance.', - 'CCI-001809': - 'Monitor software installation policy compliance per an organization-defined frequency.', - 'CCI-001810': - 'The organization defines the personnel or roles to be notified when unauthorized software is detected.', - 'CCI-001811': - 'The information system alerts organization-defined personnel or roles when the unauthorized installation of software is detected.', - 'CCI-001812': - 'The information system prohibits user installation of software without explicit privileged status.', - 'CCI-001813': - 'Enforce access restrictions using organization-defined mechanisms.', - 'CCI-001814': - 'The Information system supports auditing of the enforcement actions.', - 'CCI-001815': - 'Defines the controls to be applied to devices when individuals return from areas of significant risk.', - 'CCI-001816': - 'Apply organization-defined controls to the systems or components when the individuals return from travel.', - 'CCI-001817': - 'When analyzing changes to the system, looks for privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.', - 'CCI-001818': - 'Analyze changes to the system in a separate test environment before installation in an operational environment.', - 'CCI-001819': - 'Implement approved configuration-controlled changes to the system.', - 'CCI-001820': - 'The organization documents a configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-001821': - 'Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management policy is to be disseminated.', - 'CCI-001822': - 'Disseminate the organization-level; mission/business process-level; and/or system-level configuration management policy to organization-defined personnel or roles.', - 'CCI-001823': - 'The organization documents the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.', - 'CCI-001824': - 'Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management procedures are to be disseminated.', - 'CCI-001825': - 'Disseminate to organization-defined personnel or roles the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls.', - 'CCI-001826': - 'The organization defines the circumstances upon which the organization reviews the information system changes to determine whether unauthorized changes have occurred.', - 'CCI-001827': - 'The organization defines the frequency with which to review information system privileges.', - 'CCI-001828': - 'The organization defines the frequency with which to reevaluate information system privileges.', - 'CCI-001829': - 'The organization reviews information system privileges per an organization-defined frequency.', - 'CCI-001830': - 'The organization reevaluates information system privileges per an organization-defined frequency.', - 'CCI-001831': - 'The organization documents an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-001832': - 'Disseminate the organization-level; mission/business process-level; and/or system-level audit and accountability policy to organization-defined personnel or roles.', - 'CCI-001833': - 'The organization documents procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.', - 'CCI-001834': - 'Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.', - 'CCI-001835': - 'The organization defines the frequency on which it will review the audit and accountability policy.', - 'CCI-001836': - 'The organization defines the frequency on which it will update the audit and accountability policy.', - 'CCI-001837': - 'The organization reviews the audit and accountability policy on an organization-defined frequency.', - 'CCI-001838': - 'The organization updates the audit and accountability policy on an organization-defined frequency.', - 'CCI-001839': - 'The organization defines the frequency on which it will review the audit and accountability procedures.', - 'CCI-001840': - 'The organization defines the frequency on which it will update the audit and accountability procedures.', - 'CCI-001841': - 'The organization reviews the audit and accountability procedures on an organization-defined frequency.', - 'CCI-001842': - 'The organization updates the audit and accountability procedures on an organization-defined frequency.', - 'CCI-001843': - 'The organization defines a frequency for updating the list of organization-defined auditable events.', - 'CCI-001844': - 'The information system provides centralized management and configuration of the content to be captured in audit records generated by organization-defined information system components.', - 'CCI-001845': - 'The information system provides centralized configuration of the content to be captured in audit records generated by organization-defined information system components.', - 'CCI-001846': - 'The organization defines information system components that will generate the audit records which are to be captured for centralized management of the content.', - 'CCI-001847': - 'The organization defines information system components that will generate the audit records which are to be captured for centralized configuration of the content.', - 'CCI-001848': - 'Defines the audit log retention requirements for allocating audit log storage capacity.', - 'CCI-001849': - 'Allocate audit log storage capacity to accommodate organization-defined audit log retention requirements.', - 'CCI-001850': - 'Defines the frequency to off-load audit records onto a different system or media than the system being audited.', - 'CCI-001851': - 'Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.', - 'CCI-001852': - 'Defines the personnel, roles and/or locations to receive a warning when allocated audit log storage volume reaches a defined percentage of maximum audit log storage capacity.', - 'CCI-001853': - 'Defines the time period within which organization-defined personnel, roles, and/or locations are to receive warnings when allocated audit log storage volume reaches an organization-defined percentage of maximum audit log storage capacity.', - 'CCI-001854': - 'Defines the percentage of maximum audit log storage capacity that is to be reached, at which time the system will provide a warning to organization-defined personnel, roles, and/or locations.', - 'CCI-001855': - 'Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.', - 'CCI-001856': - 'Defines the real-time period in which to provide an alert when organization-defined audit failure events occur.', - 'CCI-001857': - 'Defines the personnel, roles, and/or locations to receive alerts when organization-defined audit failure events occur.', - 'CCI-001858': - 'Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.', - 'CCI-001859': - 'Defines the network communication traffic volume thresholds reflecting limits on auditing capacity, specifying when the information system will reject or delay network traffic that exceed those thresholds.', - 'CCI-001860': - 'Defines the audit logging failures which, should they occur, will invoke an organization-defined system mode.', - 'CCI-001861': - 'Invoke a full system shutdown, partial system shutdown, or degraded operational mode with limited mission or business functionality available in the event of organization-defined audit logging failures, unless an alternate audit logging capability exists.', - 'CCI-001862': - 'Defines the types of inappropriate or unusual activity to be reviewed and analyzed in the audit records.', - 'CCI-001863': - 'Defines the personnel or roles to receive the reports of organization-defined inappropriate or unusual activity.', - 'CCI-001864': - 'Integrate audit review and analysis using organization-defined automated mechanisms.', - 'CCI-001865': - 'Integrate reporting processes using organization-defined automated mechanisms.', - 'CCI-001866': - 'Defines the data/information to be collected from other sources to enhance its ability to identify inappropriate or unusual activity.', - 'CCI-001867': - 'Integrate analysis of audit records with analysis of vulnerability scanning information, performance data, system monitoring information, and/or organization-defined data/information collected from other sources to further enhance the ability to identify inappropriate or unusual activity.', - 'CCI-001868': - 'Specify the permitted actions for each information system process, role, and/or user associated with the review and analysis of audit information.', - 'CCI-001869': - 'Specify the permitted actions for each information system process, role, and/or user associated with the reporting of audit information.', - 'CCI-001870': - 'Perform a full-text analysis of logged privileged commands in a physically-distinct component or subsystem of the system, or other system that is dedicated to that analysis.', - 'CCI-001871': - 'Correlate information from non-technical sources with audit record information to enhance organization-wide situational awareness.', - 'CCI-001872': - 'The organization adjusts the level of audit review and analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.', - 'CCI-001873': - 'The organization adjusts the level of audit analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.', - 'CCI-001874': - 'The organization adjusts the level of audit reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.', - 'CCI-001875': - 'Provide an audit reduction capability that supports on-demand audit review and analysis.', - 'CCI-001876': - 'Provide an audit reduction capability that supports on-demand reporting requirements.', - 'CCI-001877': - 'Provide an audit reduction capability that supports after-the-fact investigations of incidents.', - 'CCI-001878': - 'Provide a report generation capability that supports on-demand audit review and analysis.', - 'CCI-001879': - 'Provide a report generation capability that supports on-demand reporting requirements.', - 'CCI-001880': - 'Provide a report generation capability that supports after-the-fact investigations of security incidents.', - 'CCI-001881': - 'Provide an audit reduction capability that does not alter original content or time ordering of audit records.', - 'CCI-001882': - 'Provide a report generation capability that does not alter original content or time ordering of audit records.', - 'CCI-001883': - 'Defines the audit fields within audit records to be processed, sorted, and searched for events of interest by the system.', - 'CCI-001884': - 'The organization defines the audit fields within audit records to be sorted for events of interest by the information system.', - 'CCI-001885': - 'The organization defines the audit fields within audit records to be searched for events of interest by the information system.', - 'CCI-001886': - 'The information system provides the capability to sort audit records for events of interest based on the content of organization-defined audit fields within audit records.', - 'CCI-001887': - 'The information system provides the capability to search audit records for events of interest based on the content of organization-defined audit fields within audit records.', - 'CCI-001888': - 'Defines the granularity of time measurement for time stamps generated for audit records.', - 'CCI-001889': - 'Record time stamps for audit records that meet organization-defined granularity of time measurement.', - 'CCI-001890': - 'Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.', - 'CCI-001891': - 'The information system compares internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.', - 'CCI-001892': - 'The organization defines the time difference which, when exceeded, will require the information system to synchronize the internal information system clocks to the organization-defined authoritative time source.', - 'CCI-001893': - 'The information system identifies a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source.', - 'CCI-001894': - 'Defines the subset of privileged users who will be authorized access to the management of audit functionality.', - 'CCI-001895': - 'Defines the audit information requiring dual authorization for movement or deletion actions.', - 'CCI-001896': - 'Enforce dual authorization for movement and/or deletion of organization-defined audit information.', - 'CCI-001897': - 'Defines the subset of privileged users or roles who will be authorized read-only access to audit information.', - 'CCI-001898': - 'Authorize read-only access to audit information to an organization-defined subset of privileged users or roles.', - 'CCI-001899': 'Defines the actions to be covered by non-repudiation.', - 'CCI-001900': - 'Defines the strength of binding to be applied to the binding of the identity of the information producer with the information.', - 'CCI-001901': - 'Bind the identity of the information producer with the information to an organization-defined strength of binding.', - 'CCI-001902': - 'Provide the means for authorized individuals to determine the identity of the producer of the information.', - 'CCI-001903': - 'Defines the frequency on which the system is to validate the binding of the information producer identity to the information.', - 'CCI-001904': - 'Validate the binding of the information producer identity to the information at an organization-defined frequency.', - 'CCI-001905': - 'Defines the actions to be performed in the event of an error when validating the binding of the information producer identity to the information.', - 'CCI-001906': - 'Perform organization-defined actions in the event of an error when validating the binding of the information producer identity to the information.', - 'CCI-001907': - 'Defines the security domains which will require the system validate the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer.', - 'CCI-001908': - 'Defines the action the system is to perform in the event of an information reviewer identity binding validation error.', - 'CCI-001909': - 'Perform organization-defined actions in the event of an information reviewer identity binding validation error.', - 'CCI-001910': - 'Defines the personnel or roles allowed to select which event types are to be logged by specific components of the system.', - 'CCI-001911': - 'Defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined system components, by organization-defined individuals or roles, within organization-defined time thresholds.', - 'CCI-001912': - 'Defines the time thresholds for organization-defined individuals or roles to change the auditing to be performed based on organization-defined selectable event criteria.', - 'CCI-001913': - 'Defines the individuals or roles that are to be provided the capability to change the auditing to be performed based on organization-defined selectable event criteria, within organization-defined time thresholds.', - 'CCI-001914': - 'Provide the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.', - 'CCI-001915': - 'Defines the open source information and/or information sites to be monitored for evidence of unauthorized exfiltration or disclosure of organizational information.', - 'CCI-001916': - 'The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner.', - 'CCI-001917': - 'Defines the frequency for reviewing the open source information sites being monitored.', - 'CCI-001918': - 'Review the open source information sites being monitored per organization-defined frequency.', - 'CCI-001919': - 'Provide the capability for organization-defined users or roles to select a user session to record; view; hear; or log the content of a user session under organization-defined circumstances.', - 'CCI-001920': - 'Provide the capability for authorized users to remotely view and hear content related to an established user session in real time.', - 'CCI-001921': - 'The organization defines the alternative audit functionality to be provided in the event of a failure in the primary audit capability.', - 'CCI-001922': - 'The organization provides an alternative audit capability in the event of a failure in primary audit capability that provides organization-defined alternative audit functionality.', - 'CCI-001923': - 'Defines the audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries.', - 'CCI-001924': - 'Defines the methods to be employed when coordinating audit information among external organizations when audit information is transmitted across organizational boundaries.', - 'CCI-001925': - 'Employ organization-defined methods for coordinating organization-defined audit information among external organizations when audit information is transmitted across organizational boundaries.', - 'CCI-001926': - 'Preserve the identity of individuals in cross-organizational audit trails.', - 'CCI-001927': - 'Defines the organizations that will be provided cross-organizational audit information.', - 'CCI-001928': - 'Defines the cross-organizational sharing agreements to be established with organization-defined organizations authorized to be provided cross-organizational sharing of audit information.', - 'CCI-001929': - 'Provide cross-organizational audit information to organization-defined organizations based on organization-defined cross organizational sharing agreements.', - 'CCI-001930': - 'Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level audit and accountability policy is to be disseminated.', - 'CCI-001931': - 'Defines the personnel or roles to whom the audit and accountability procedures are to be disseminated.', - 'CCI-001932': - 'The organization documents an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-001933': - 'The organization defines the personnel or roles to be recipients of the identification and authentication policy and the procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.', - 'CCI-001934': - 'The organization documents procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.', - 'CCI-001935': - 'The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to privileged accounts.', - 'CCI-001936': - 'The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.', - 'CCI-001937': - 'The device used in the information system implementation of multifactor authentication for network access to privileged accounts meets organization-defined strength of mechanism requirements.', - 'CCI-001938': - 'The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to non-privileged accounts.', - 'CCI-001939': - 'The information system implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.', - 'CCI-001940': - 'The device used in the information system implementation of multifactor authentication for network access to non-privileged accounts meets organization-defined strength of mechanism requirements.', - 'CCI-001941': - 'Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.', - 'CCI-001942': - 'The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.', - 'CCI-001943': - 'Defines the system accounts for which single sign-on capability will be provided.', - 'CCI-001944': - 'Defines the system services for which single sign-on capability will be provided.', - 'CCI-001945': - 'Provide a single sign-on capability for organization-defined system accounts.', - 'CCI-001946': - 'Provide a single sign-on capability for organization-defined system services.', - 'CCI-001947': - 'The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to privileged accounts.', - 'CCI-001948': - 'The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.', - 'CCI-001949': - 'The device used in the information system implementation of multifactor authentication for remote access to privileged accounts meets organization-defined strength of mechanism requirements.', - 'CCI-001950': - 'The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to non-privileged accounts.', - 'CCI-001951': - 'The information system implements multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.', - 'CCI-001952': - 'The device used in the information system implementation of multifactor authentication for remote access to non-privileged accounts meets organization-defined strength of mechanism requirements.', - 'CCI-001953': 'Accept Personal Identity Verification-compliant credentials.', - 'CCI-001954': - 'Electronically verify Personal Identity Verification-compliant credentials.', - 'CCI-001955': - 'Defines the out-of-band authentication to be implemented under organization-defined conditions.', - 'CCI-001956': - 'Defines the conditions for implementing organization-defined out-of-band authentication.', - 'CCI-001957': - 'Implement organization-defined out-of-band authentication mechanisms under organization-defined conditions.', - 'CCI-001958': - 'Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.', - 'CCI-001959': - 'Defines the devices and/or types of devices the system is to authenticate before establishing a connection.', - 'CCI-001960': 'Defines the lease information to be assigned to devices.', - 'CCI-001961': 'Defines the lease duration to be assigned to devices.', - 'CCI-001962': - 'Where addresses are allocated dynamically, standardize dynamic address allocation lease information assigned to devices in accordance with organization-defined lease information.', - 'CCI-001963': - 'Where addresses are allocated dynamically, standardize dynamic address allocation lease duration assigned to devices in accordance with organization-defined lease duration.', - 'CCI-001964': - 'The organization defines the configuration management process that is to handle the device identification procedures.', - 'CCI-001965': - 'Defines the configuration management process that is to handle the device authentication procedures.', - 'CCI-001966': - 'Handle device identification based on attestation is handled by the organization-defined configuration management process.', - 'CCI-001967': - 'Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.', - 'CCI-001968': - 'Defines the configuration management process that is to handle the device identification procedures.', - 'CCI-001969': - 'Handle device authentication based on attestation is handled by the organization-defined configuration management process.', - 'CCI-001970': - 'Defines the personnel or roles that authorize the assignment of individual, group, role, and device identifiers.', - 'CCI-001971': - 'Manage system identifiers by receiving authorization from organization-defined personnel or roles to assign an individual, group, role, or device identifier.', - 'CCI-001972': - 'Manage system identifiers by selecting an identifier that identifies an individual, group, role, or device.', - 'CCI-001973': - 'Manage system identifiers by assigning the identifier to the intended individual, group, role, or device.', - 'CCI-001974': - 'Defines the time period for which the reuse of identifiers is prohibited.', - 'CCI-001975': - 'Manage system identifiers by preventing reuse of identifiers for an organization-defined time period.', - 'CCI-001976': - 'Manage individual identifiers dynamically in accordance with organization-defined identifier policy.', - 'CCI-001977': - 'Defines the external organizations with which it will coordinate for cross-management of identifiers.', - 'CCI-001978': - 'Coordinate with organization-defined external organizations for cross-organization management of identifiers.', - 'CCI-001979': - 'The organization requires the registration process to receive an individual identifier be conducted in person before a designated registration authority.', - 'CCI-001980': - 'Manage system authenticators by verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator.', - 'CCI-001981': - 'Manage system authenticators by establishing administrative procedures for initial authenticator distribution.', - 'CCI-001982': - 'The organization manages information system authenticators by establishing administrative procedures for lost/compromised authenticators.', - 'CCI-001983': - 'The organization manages information system authenticators by establishing administrative procedures for damaged authenticators.', - 'CCI-001984': - 'Manage system authenticators by establishing administrative procedures for revoking authenticators.', - 'CCI-001985': - 'Manage system authenticators by implementing administrative procedures for initial authenticator distribution.', - 'CCI-001986': - 'The organization manages information system authenticators by implementing administrative procedures for lost/compromised authenticators.', - 'CCI-001987': - 'The organization manages information system authenticators by implementing administrative procedures for damaged authenticators.', - 'CCI-001988': - 'Manage system authenticators by implementing administrative procedures for revoking authenticators.', - 'CCI-001989': - 'The organization manages information system authenticators by changing default content of authenticators prior to information system installation.', - 'CCI-001990': - 'Manage system authenticators by changing authenticators for group or role accounts when membership to those accounts changes.', - 'CCI-001991': - 'The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.', - 'CCI-001992': - "The organization defines the personnel or roles responsible for authorizing the organization's registration authority accountable for the authenticator registration process.", - 'CCI-001993': - 'The organization defines the registration authority accountable for the authenticator registration process.', - 'CCI-001994': - 'The organization defines the types of and/or specific authenticators that are subject to the authenticator registration process.', - 'CCI-001995': - 'The organization requires that the registration process, to receive organization-defined types of and/or specific authenticators, be conducted in person, or by a trusted third-party, before an organization-defined registration authority with authorization by organization-defined personnel or roles.', - 'CCI-001996': - 'The organization defines the requirements required by the automated tools to determine if password authenticators are sufficiently strong.', - 'CCI-001997': - 'The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy organization-defined requirements.', - 'CCI-001998': - 'Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.', - 'CCI-001999': - 'The organization defines the external organizations to be coordinated with for cross-organization management of credentials.', - 'CCI-002000': - 'The organization coordinates with organization-defined external organizations for cross-organization management of credentials.', - 'CCI-002001': - 'Bind identities and authenticators dynamically using organization-defined binding rules.', - 'CCI-002002': - 'The organization defines the token quality requirements to be employed by the information system mechanisms for token-based authentication.', - 'CCI-002003': - 'The information system, for token-based authentication, employs mechanisms that satisfy organization-defined token quality requirements.', - 'CCI-002004': - 'Defines the biometric quality requirements to be employed by the mechanisms for biometric-based authentication.', - 'CCI-002005': - 'For biometric-based authentication, employ mechanisms that satisfy organization-defined biometric quality requirements.', - 'CCI-002006': - 'Defines the time period after which the use of cached authenticators is prohibited.', - 'CCI-002007': - 'Prohibit the use of cached authenticators after an organization-defined time period.', - 'CCI-002008': - 'For PKI-based authentication, employs an organization-wide methodology for managing the content of PKI trust stores installed across all platforms including networks, operating systems, browsers, and applications.', - 'CCI-002009': - 'Accept Personal Identity Verification-compliant credentials from other federal agencies.', - 'CCI-002010': - 'Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.', - 'CCI-002011': - 'The information system accepts FICAM-approved third-party credentials.', - 'CCI-002012': - 'The organization defines the information systems which will employ only FICAM-approved information system components.', - 'CCI-002013': - 'The organization employs only FICAM-approved information system components in organization-defined information systems to accept third-party credentials.', - 'CCI-002014': 'The information system conforms to FICAM-issued profiles.', - 'CCI-002015': - 'Accept federated or PKI credentials that meet organization-defined policy.', - 'CCI-002016': - 'Verify federated PKI credentials that meet organization-defined policy.', - 'CCI-002017': - 'The organization defines the information system services requiring identification.', - 'CCI-002018': - 'Defines the system services and applications requiring authentication.', - 'CCI-002019': - 'The organization defines the security safeguards to be used when identifying information system services.', - 'CCI-002020': - 'The organization defines the security safeguards to be used when authenticating information system services.', - 'CCI-002021': - 'Uniquely identify organization-defined system services and applications before establishing communications with devices, users, or other services or applications.', - 'CCI-002022': - 'Uniquely authenticate organization-defined system services and applications before establishing communications with devices, users, or other services or applications.', - 'CCI-002023': - 'The organization ensures that service providers receive identification information.', - 'CCI-002024': - 'The organization ensures that service providers validate identification information.', - 'CCI-002025': - 'The organization ensures that service providers transmit identification information.', - 'CCI-002026': - 'The organization ensures that service providers receive authentication information.', - 'CCI-002027': - 'The organization ensures that service providers validate authentication information.', - 'CCI-002028': - 'The organization ensures that service providers transmit authentication information.', - 'CCI-002029': - 'The organization defines the services between which identification decisions are to be transmitted.', - 'CCI-002030': - 'The organization defines the services between which authentication decisions are to be transmitted.', - 'CCI-002031': - 'The organization ensures that identification decisions are transmitted between organization-defined services consistent with organizational policies.', - 'CCI-002032': - 'The organization ensures that authentication decisions are transmitted between organization-defined services consistent with organizational policies.', - 'CCI-002033': - 'Defines the specific circumstances or situations when individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms.', - 'CCI-002034': - 'Defines the supplemental authentication techniques or mechanisms to be employed in specific organization-defined circumstances or situations by individuals accessing the system.', - 'CCI-002035': - 'Require individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms under specific organization-defined circumstances or situations.', - 'CCI-002036': - 'Defines the circumstances or situations under which users will be required to reauthenticate.', - 'CCI-002037': - 'The organization defines the circumstances or situations under which devices will be required to reauthenticate.', - 'CCI-002038': - 'The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.', - 'CCI-002039': - 'The organization requires devices to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.', - 'CCI-002040': - 'The organization requires that the registration process to receive an individual identifier includes supervisor authorization.', - 'CCI-002041': - 'The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.', - 'CCI-002042': - 'Manage system authenticators by protecting authenticator content from unauthorized modification.', - 'CCI-002043': - 'The organization uses only FICAM-approved path discovery and validation products and services.', - 'CCI-002044': - 'Defines measures to be employed to ensure that long-term audit records generated by the system can be retrieved.', - 'CCI-002045': - 'Employ organization-defined measures to ensure that long-term audit records generated by the information system can be retrieved.', - 'CCI-002046': - 'The information system synchronizes the internal system clocks to the authoritative time source when the time difference is greater than the organization-defined time period.', - 'CCI-002047': - 'Defines the system components on which the auditing that is to be performed can be changed by organization-defined individuals or roles.', - 'CCI-002048': - 'Defines the personnel or roles to whom the awareness and training policy is disseminated.', - 'CCI-002049': - 'Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level awareness and training procedures are disseminated.', - 'CCI-002050': - 'Defines the personnel or roles to whom initial and refresher training in the employment and operation of environmental controls is to be provided.', - 'CCI-002051': - 'Defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.', - 'CCI-002052': - 'Provide practical exercises in security training that reinforce training objectives.', - 'CCI-002053': - 'The organization provides training to its personnel on organization-defined indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.', - 'CCI-002054': - 'The organization defines indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.', - 'CCI-002055': - 'Provide literacy training on recognizing and reporting potential indicators of insider threat.', - 'CCI-002056': - 'Defines the time period the records of configuration-controlled changes are to be retained.', - 'CCI-002057': - 'Defines the personnel to be notified when approved changes to the system are completed.', - 'CCI-002058': - 'Employ automated mechanisms to notify organization-defined personnel when approved changes to the system are completed.', - 'CCI-002059': - 'Defines the system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.', - 'CCI-002060': - 'The organization develops and documents a security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-002061': - 'Defines the personnel or roles to whom the organization-level; mission/business process; system-level assessment, authorization, and monitoring policy is to be disseminated.', - 'CCI-002062': - 'Defines the personnel or roles to whom the assessment, authorization, monitoring procedures are to be disseminated.', - 'CCI-002063': - 'The organization defines the level of independence for assessors or assessment teams to conduct security control assessments of organizational information systems.', - 'CCI-002064': - 'The organization selects one or more security assessment techniques to be conducted.', - 'CCI-002065': - 'Defines the frequency at which to conduct control assessments.', - 'CCI-002066': - 'Leverage the results of control assessments of the organization-defined system performed by an organization-defined external organization when the assessment meets organization-defined requirements.', - 'CCI-002067': - 'Defines the system for which the results of control assessments will be leveraged.', - 'CCI-002068': - 'Defines the external organizations from which control assessment results for organization-defined systems will be accepted.', - 'CCI-002069': - 'Defines the requirements the control assessments for organization-defined systems from organization-defined external organizations must meet.', - 'CCI-002070': - 'Develop a control assessment plan that describes the scope of the assessment including assessment team, and assessment roles and responsibilities.', - 'CCI-002071': - 'Defines the individuals or roles to whom the results of the control assessment are to be provided.', - 'CCI-002072': - 'The organization defines the unclassified, national security systems that are prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.', - 'CCI-002073': - 'The organization defines the boundary protection device to be used to connect organization-defined unclassified, national security systems to an external network.', - 'CCI-002074': - 'The organization defines the boundary protection device to be used for the direct connection of classified, national security system to an external network.', - 'CCI-002075': - 'The organization prohibits the direct connection of an organization-defined unclassified, non-national security system to an external network without the use of organization-defined boundary protection device.', - 'CCI-002076': - 'The organization defines the unclassified, non-national security system that is prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.', - 'CCI-002077': - 'The organization defines the boundary protection device to be used to directly connect an organization-defined unclassified, non-national security system to an external network.', - 'CCI-002078': - 'The organization prohibits the direct connection of an organization-defined information system to a public network.', - 'CCI-002079': - 'The organization defines the information system that is prohibited from directly connecting to a public network.', - 'CCI-002080': - 'The organization employs either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.', - 'CCI-002081': - 'The organization defines the information systems that employ either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing connections to external information systems.', - 'CCI-002082': - 'The organization selects either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.', - 'CCI-002083': - 'Review and update the agreements on an organization-defined frequency.', - 'CCI-002084': - 'Defines the frequency at which reviews and updates to the agreements must be conducted.', - 'CCI-002085': - 'The organization defines the level of independence the assessors or assessment teams must have to monitor the security controls in the information system on an ongoing basis.', - 'CCI-002086': - 'Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.', - 'CCI-002087': - 'Establish organization-defined system-level metrics to be monitored.', - 'CCI-002088': 'Establish organization-defined frequencies for monitoring.', - 'CCI-002089': - 'The organization establishes and defines the frequencies for assessments supporting continuous monitoring.', - 'CCI-002090': - 'Implement ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy.', - 'CCI-002091': - 'Implement a continuous monitoring program that includes correlation and analysis of information generated by assessments and monitoring.', - 'CCI-002092': - 'Implement a continuous monitoring program that includes response actions to address results of the analysis of control assessment and monitoring information.', - 'CCI-002093': - 'Conduct penetration testing in accordance with organization-defined frequency on organization-defined systems or system components.', - 'CCI-002094': - 'Defines the frequency for conducting penetration testing on organization-defined systems or system components.', - 'CCI-002095': - 'Defines the systems or system components on which penetration testing will be conducted.', - 'CCI-002096': - 'Employ an independent penetration agent or penetration team to perform penetration testing on the system or system components.', - 'CCI-002097': - 'Defines red team exercises to simulate attempts by adversaries to compromise organizational systems.', - 'CCI-002098': - 'The organization defines rules of engagement for red team exercises to simulate attempts by adversaries to compromise organizational information systems.', - 'CCI-002099': - 'Employ organization-defined red team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.', - 'CCI-002100': - 'Perform security compliance checks on constituent components prior to the establishment of the internal connection.', - 'CCI-002101': - 'Authorizes internal connections of organization-defined system components or classes of components to the system.', - 'CCI-002102': - 'Defines the system components or classes of components that are authorized internal connections to the system.', - 'CCI-002103': - 'Document, for each internal connection, the interface characteristics.', - 'CCI-002104': - 'Document, for each internal connection, the security requirements.', - 'CCI-002105': - 'Document, for each internal connection, the nature of the information communicated.', - 'CCI-002106': 'The organization documents the access control policy.', - 'CCI-002107': - 'Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level access control policy necessary to facilitate the implementation of the access control policy and associated access controls.', - 'CCI-002108': - 'Defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls.', - 'CCI-002109': - 'The organization documents procedures to facilitate the implementation of the access control policy and associated access controls.', - 'CCI-002110': - 'The organization defines the information system account types that support the organizational missions/business functions.', - 'CCI-002111': - 'The organization identifies and selects the organization-defined information system account types of information system accounts which support organizational missions/business functions.', - 'CCI-002112': 'Assign account managers.', - 'CCI-002113': 'The organization establishes conditions for role membership.', - 'CCI-002114': - 'The organization specifies authorized users of the information system for each account.', - 'CCI-002115': 'Specify authorized users of the system.', - 'CCI-002116': 'Specify authorized users of the group.', - 'CCI-002117': 'Specify authorized users of the role membership.', - 'CCI-002118': - 'Specify authorized access authorizations (i.e., privileges) for each account.', - 'CCI-002119': - 'Specify organization-attributes (as required) for each account on the system.', - 'CCI-002120': - 'Defines the personnel or roles authorized to approve the creation of accounts.', - 'CCI-002121': - 'Defines the procedures to be employed when creating, enabling, modifying, disabling, and removing information system accounts.', - 'CCI-002122': 'Monitor the use of accounts.', - 'CCI-002123': - 'Notify account managers and organization-defined personnel or roles within an organization-defined time-period when accounts are no longer required.', - 'CCI-002124': - 'Notify account managers and organization-defined personnel or roles within an organization-defined time-period when users are terminated or transferred.', - 'CCI-002125': - 'Notify account managers and organization-defined personnel or roles within an organization-defined time-period when system usage or need-to-know changes for an individual.', - 'CCI-002126': - 'Authorize access to the system based on a valid access authorization.', - 'CCI-002127': - 'Authorize access to the system based on intended system usage.', - 'CCI-002128': - 'Authorize access to the system based on organization-defined attributes (as required).', - 'CCI-002129': - 'Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group.', - 'CCI-002130': 'Automatically audit account enabling actions.', - 'CCI-002131': - 'The organization defines the personnel or roles to be notified on account creation, modification, enabling, disabling, and removal actions.', - 'CCI-002132': - 'The information system notifies organization-defined personnel or roles for account enabling actions.', - 'CCI-002133': 'Defines other conditions when users are required to log out.', - 'CCI-002134': - 'Defines a list of dynamic privilege management capabilities to be implemented.', - 'CCI-002135': - 'Implement the organization-defined list of dynamic privilege management capabilities.', - 'CCI-002136': - 'The organization defines the actions to be taken when privileged role assignments are no longer appropriate.', - 'CCI-002137': - 'Revoke access when privileged role or attribute assignments are no longer appropriate.', - 'CCI-002138': 'Defines the system accounts that can be dynamically created.', - 'CCI-002139': 'Create organization-defined system accounts dynamically.', - 'CCI-002140': - 'Defines the conditions for establishing shared/group accounts.', - 'CCI-002141': - 'Only permit the use of shared and group accounts that meet organization-defined conditions for establishing shared and group accounts.', - 'CCI-002142': - 'The information system terminates shared/group account credentials when members leave the group.', - 'CCI-002143': - 'Defines the circumstances and/or usage conditions that are to be enforced for organization-defined information system accounts.', - 'CCI-002144': - 'Defines the system accounts that are to be subject to the enforcement of organization-defined circumstances and/or usage conditions.', - 'CCI-002145': - 'Enforce organization-defined circumstances and/or usage conditions for organization-defined system accounts.', - 'CCI-002146': - 'Defines atypical usage for which the system accounts are to be monitored.', - 'CCI-002147': - 'Monitor system accounts for organization-defined atypical usage.', - 'CCI-002148': - 'Defines the personnel or roles to whom atypical usage of system accounts are to be reported.', - 'CCI-002149': - 'Report atypical usage of system accounts to organization-defined personnel or roles.', - 'CCI-002150': - 'Defines the time period within which the accounts of users posing a significant risk are to be disabled after discovery of the risk.', - 'CCI-002151': - 'Disable accounts of individuals within an organization-defined time-period of discovery of organization-defined significant risk.', - 'CCI-002152': - 'Defines other actions necessary for which dual authorization is to be enforced.', - 'CCI-002153': - 'Defines the mandatory access control policies that are to be enforced over all subjects and objects.', - 'CCI-002154': - 'Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy is uniformly enforced across the covered subjects and objects within the system.', - 'CCI-002155': - 'Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects.', - 'CCI-002156': - 'Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects.', - 'CCI-002157': - 'Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the system, or system components.', - 'CCI-002158': - 'Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects.', - 'CCI-002159': - 'Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects.', - 'CCI-002160': - 'Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing the rules governing access control.', - 'CCI-002161': - 'Defines subjects which may explicitly be granted organization-defined privileges such that they are not limited by any of the mandatory access control constraints.', - 'CCI-002162': - 'Defines the privileges that may explicitly be granted to organization-defined subjects such that they are not limited by any of the mandatory access control constraints.', - 'CCI-002163': - 'Defines the discretionary access control policies the information system is to enforce over subjects and objects.', - 'CCI-002164': - "Enforce organization-defined discretionary access control policy that over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: pass the information to any other subjects or objects; grant its privileges to other subjects; change security attributes on subjects, objects, the system, or the system's components; choose the security attributes to be associated with newly created or revised objects; and/or change the rules governing access control.", - 'CCI-002165': - 'Enforce organization-defined discretionary access control policies over defined subjects and objects.', - 'CCI-002166': - 'Defines the role-based access control policies to enforce over all subjects and objects.', - 'CCI-002167': - 'The organization defines the subjects over which the information system will enforce a role-based access control policy.', - 'CCI-002168': - 'The organization defines the objects over which the information system will enforce a role-based access control policy.', - 'CCI-002169': - 'Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.', - 'CCI-002170': - 'Control access based upon organization-defined roles and users authorized to assume such roles.', - 'CCI-002171': - 'The information system enforces a role-based access control policy over organization-defined subjects.', - 'CCI-002172': - 'The information system enforces a role-based access control policy over organization-defined objects.', - 'CCI-002173': - 'Defines the roles authorized to control access based upon the role-based access control policy.', - 'CCI-002174': - 'Defines the users authorized to control access based upon the role-based access control policy.', - 'CCI-002175': - 'The information system controls access based upon organization-defined roles authorized to assume such roles, employing the organization-defined role-based access control policy.', - 'CCI-002176': - 'The information system controls access based upon organization-defined users authorized to assume such roles, employing the organization-defined role-based access control policy.', - 'CCI-002177': - 'Defines the rules governing the timing of revocation of access authorizations.', - 'CCI-002178': - 'Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects based on organization-defined rules governing the timing of revocations of access authorizations.', - 'CCI-002179': - 'Enforce the revocation of access authorizations resulting from changes to the security attributes of objects based on organization-defined rules governing the timing of revocations of access authorizations.', - 'CCI-002180': - 'Defines the controls the organization-defined system or system component is to provide to protect information released outside the established system boundary.', - 'CCI-002181': - 'Defines system or system components that are to provide organization-defined controls to protect information received outside the established system boundary.', - 'CCI-002182': - 'Release information outside of the established system boundary only if organization-defined system or system components provides organization-defined controls.', - 'CCI-002183': - 'Defines the controls to be used to validate the appropriateness of the information designated for release.', - 'CCI-002184': - 'Release information outside of the established system boundary only if organization-defined controls are used to validate the appropriateness of the information designated for release.', - 'CCI-002185': - 'Defines the conditions on which it will employ an audited override of automated access control mechanisms.', - 'CCI-002186': - 'Employ an audited override of automated access control mechanisms under organization-defined conditions by organization-defined roles.', - 'CCI-002187': - 'Defines the security attributes to be used to enforce organization-defined information flow control policies.', - 'CCI-002188': - 'Defines the information, source, and destination objects with which the organization-defined security attributes are to be associated.', - 'CCI-002189': - 'Defines the information flow control policies to be enforced for flow control decisions.', - 'CCI-002190': - 'Use organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.', - 'CCI-002191': - 'Defines the information flow control policies to be enforced by the information system using protected processing domains.', - 'CCI-002192': - 'Defines the policies to enforce dynamic information flow control.', - 'CCI-002193': - 'Defines procedures or methods to be employed to prevent encrypted information from bypassing flow control mechanisms, such as decrypting the information, blocking the flow of the encrypted information, and/or terminating communications sessions attempting to pass encrypted information.', - 'CCI-002194': - 'Defines the metadata the information system uses to enforce information flow control.', - 'CCI-002195': - 'Defines the information flows against which the organization-defined security or privacy policy filters are to be enforced.', - 'CCI-002196': - 'Defines the information flows for which will enforce the use of human reviews under organization-defined conditions.', - 'CCI-002197': - 'Defines the conditions which will require the use of human reviews of organization-defined information flows.', - 'CCI-002198': - 'Enforce the use of human reviews for organization-defined information flows under organization-defined conditions.', - 'CCI-002199': - 'Defines the conditions that provides the capability for privileged administrators to enable and disable organization-defined security policy filters.', - 'CCI-002200': - 'Defines the data type identifiers to be used to validate data being transferred between different security domains.', - 'CCI-002201': - 'When transferring information between different security domains, use organization-defined data type identifiers to validate data essential for information flow decisions.', - 'CCI-002202': - 'Defines the policy-relevant subcomponents into which information being transferred between different security domains is to be decomposed for submission to policy enforcement mechanisms.', - 'CCI-002203': - 'Defines the unsanctioned information when transferring information between different security domains.', - 'CCI-002204': - 'Defines the security or privacy policy which prohibits the transfer of unsanctioned information between different security domains.', - 'CCI-002205': - 'Uniquely identify and authenticate source by organization, system, application, service, and/or individual for information transfer.', - 'CCI-002206': - 'The information system uniquely authenticates source by organization, system, application, and/or individual for information transfer.', - 'CCI-002207': - 'Uniquely identify and authenticate destination points by organization, system, application, service, and/or individual for information transfer.', - 'CCI-002208': - 'The information system uniquely authenticates destination by organization, system, application, and/or individual for information transfer.', - 'CCI-002209': - 'The organization defines the techniques to be used to bind security attributes to information.', - 'CCI-002210': - 'The information system binds security attributes to information using organization-defined binding techniques to facilitate information flow policy enforcement.', - 'CCI-002211': - 'When transferring information between different security domains, implement organization-defined security or privacy filters on metadata.', - 'CCI-002212': - 'Defines the solutions in approved configurations to be employed to control the flow of organization-defined information across security domains.', - 'CCI-002213': - 'Defines the information to be subjected to flow control across security domains.', - 'CCI-002214': - 'Employ organization-defined solutions in approved configurations to control the flow of organization-defined information across security domains.', - 'CCI-002215': - 'Defines the mechanisms and/or techniques to be used to logically or physically separate information flows.', - 'CCI-002216': - 'Defines the types of information required to accomplish logical or physical separation of information flows.', - 'CCI-002217': - 'Separate information flows logically or physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations by types of information.', - 'CCI-002218': - 'Provide access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.', - 'CCI-002219': 'Defines the duties of individuals requiring separation.', - 'CCI-002220': - 'Define system access authorizations to support separation of duties.', - 'CCI-002221': - 'Defines the security-relevant information for which access must be explicitly authorized.', - 'CCI-002222': - 'Authorize access for organization-defined individuals or roles to organization-defined security functions (deployed in hardware, software, and firmware).', - 'CCI-002223': - 'Authorize access for organization-defined individuals or roles to organization-defined security-relevant information.', - 'CCI-002224': - 'Defines the compelling operational needs that must be met in order to be authorized network access to organization-defined privileged commands.', - 'CCI-002225': - 'Provide separate processing domains to enable finer-grained allocation of user privileges.', - 'CCI-002226': - 'Defines the personnel or roles to whom privileged accounts are to be restricted on the information system.', - 'CCI-002227': - 'Restrict privileged accounts on the system to organization-defined personnel or roles.', - 'CCI-002228': - 'Defines the frequency on which it conducts reviews of the privileges assigned to organization-defined roles or classes of users.', - 'CCI-002229': - 'Defines the roles or classes of users that are to have their privileges reviewed on an organization-defined frequency.', - 'CCI-002230': - 'Review, on an organization-defined frequency, the privileges assigned to organization-defined roles or classes of users to validate the need for such privileges.', - 'CCI-002231': - 'Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.', - 'CCI-002232': - 'Defines the software that is prevented from executing at a higher privilege than users executing the software.', - 'CCI-002233': - 'Prevent the organization-defined software from executing at higher privilege levels than users executing the software.', - 'CCI-002234': 'Log the execution of privileged functions.', - 'CCI-002235': - 'Prevent non-privileged users from executing privileged functions.', - 'CCI-002236': - 'Defines the time period the information system will automatically lock the account or node when the maximum number of unsuccessful logon attempts is exceeded.', - 'CCI-002237': - 'Defines the delay algorithm to delay the next logon prompt when the maximum number of unsuccessful logon attempts is exceeded.', - 'CCI-002238': - 'Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.', - 'CCI-002239': - 'Defines the mobile devices that are to be purged or wiped after an organization-defined number of consecutive, unsuccessful device logon attempts.', - 'CCI-002240': - 'Defines the purging or wiping requirements and techniques to be used on organization-defined mobile devices after an organization-defined number of consecutive, unsuccessful device logon attempts.', - 'CCI-002241': - 'Defines the number of consecutive, unsuccessful device logon attempts after which the organization-defined mobile devices will be purged or wiped.', - 'CCI-002242': - 'Purge or wipe information from organization-defined mobile devices based on organization-defined purging or wiping requirements and techniques after an organization-defined number of consecutive, unsuccessful device logon attempts.', - 'CCI-002243': - 'Organization-defined system use notification message or banner is to state that users are accessing a U.S. Government system.', - 'CCI-002244': - 'Organization-defined system use notification message or banner is to state that system usage may be monitored, recorded, and subject to audit.', - 'CCI-002245': - 'Organization-defined system use notification message or banner is to state that unauthorized use of the system is prohibited and subject to criminal and civil penalties.', - 'CCI-002246': - 'Organization-defined system use notification message or banner is to state that use of the system indicates consent to monitoring and recording.', - 'CCI-002247': - 'Defines the use notification message or banner the system displays to users before granting access to the system.', - 'CCI-002248': - 'Defines the conditions of use which are to be displayed to users of the system before granting further access.', - 'CCI-002249': - 'Defines the additional information to be included in the notification to the user upon successful logon.', - 'CCI-002250': - 'Notify the user, upon successful logon, of the following additional information: organization-defined additional information.', - 'CCI-002251': - 'The information system notifies the user, upon successful logon (access), of the date and time of the last logon (access).', - 'CCI-002252': - 'Defines the accounts and/or account types for which will limit the number of concurrent sessions.', - 'CCI-002253': - 'The organization defines the account types for which the information system will limit the number of concurrent sessions.', - 'CCI-002254': - 'The organization defines the conditions or trigger events requiring session disconnect to be employed by the information system when automatically terminating a user session.', - 'CCI-002255': - 'The organization defines the user actions that can be performed on the information system without identification and authentication.', - 'CCI-002256': - 'Defines security attributes having organization-defined types of security attribute values which are associated with information in storage.', - 'CCI-002257': - 'Defines security attributes having organization-defined types of security attribute values which are associated with information in process.', - 'CCI-002258': - 'Defines security attributes, having organization-defined types of security attribute values, which are associated with information in transmission.', - 'CCI-002259': - 'Defines security attribute values associated with organization-defined types of security attributes for information in storage.', - 'CCI-002260': - 'Defines security attribute values associated with organization-defined types of security attributes for information in process.', - 'CCI-002261': - 'Defines security attribute values associated with organization-defined types of security attributes for information in transmission.', - 'CCI-002262': - 'Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.', - 'CCI-002263': - 'Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in process.', - 'CCI-002264': - 'Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.', - 'CCI-002265': - 'Ensure that the attribute associations are made and retained with the information.', - 'CCI-002266': - 'Ensure that the security attribute associations are retained with the information.', - 'CCI-002267': - 'Defines the security attributes that are permitted for organization-defined systems.', - 'CCI-002268': - 'Defines the systems for which permitted organization-defined attributes are to be established.', - 'CCI-002269': - 'Establish the following permitted organization-defined security attributes in AC-16a for organization-defined systems.', - 'CCI-002270': - 'Defines the attribute values or ranges permitted for each of the established security attributes.', - 'CCI-002271': - 'Determine organization-defined attribute values or ranges for each of the established attributes.', - 'CCI-002272': - 'Dynamically associate security attributes with organization-defined objects in accordance with organization-defined security policies as information is created and combined.', - 'CCI-002273': - 'Defines the security policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects.', - 'CCI-002274': - 'Defines the subjects with which the system is to dynamically associate security attributes as information is created and combined.', - 'CCI-002275': - 'Defines the objects with which the system is to dynamically associate security attributes as information is created and combined.', - 'CCI-002276': - 'The organization identifies the individuals authorized to define the value of associated security attributes.', - 'CCI-002277': - 'Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes.', - 'CCI-002278': - 'Defines the security attributes for which the association and integrity to organization-defined subjects and objects is maintained.', - 'CCI-002279': - 'Defines the subjects for which the association and integrity of organization-defined security attributes is maintained.', - 'CCI-002280': - 'Defines the objects for which the association and integrity of organization-defined security attributes is maintained.', - 'CCI-002281': - 'Maintain the association of organization-defined security attributes to organization-defined subjects.', - 'CCI-002282': - 'Maintain the association of organization-defined security attributes to organization-defined objects.', - 'CCI-002283': - 'Maintain the integrity of organization-defined security attributes associated with organization-defined subjects.', - 'CCI-002284': - 'Maintain the integrity of organization-defined security attributes associated with organization-defined objects.', - 'CCI-002285': - 'The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined subjects.', - 'CCI-002286': - 'Defines the subjects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).', - 'CCI-002287': - 'Defines the objects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).', - 'CCI-002288': - 'Defines the security attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.', - 'CCI-002289': - 'Provide the capability to associate organization-defined security attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).', - 'CCI-002290': - 'Provide the capability to associate organization-defined security attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).', - 'CCI-002291': - 'Defines the security policies to be followed by personnel when associating organization-defined security attributes with organization-defined subjects and objects.', - 'CCI-002292': - 'Defines the security attributes which are to be associated with organization-defined subjects and objects.', - 'CCI-002293': - 'Defines the subjects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.', - 'CCI-002294': - 'Defines the objects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.', - 'CCI-002295': - 'Require personnel to associate organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.', - 'CCI-002296': - 'Require personnel to associate organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.', - 'CCI-002297': - 'Require personnel to maintain the association of organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.', - 'CCI-002298': - 'Require personnel to maintain the association of organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.', - 'CCI-002299': - 'Provide a consistent interpretation of security attributes transmitted between distributed system components.', - 'CCI-002300': - 'Defines the techniques and technologies to be implemented when associating security attributes with information.', - 'CCI-002301': - 'Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating security attributes to information.', - 'CCI-002302': - 'Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating security attributes to information.', - 'CCI-002303': - 'Defines the techniques or procedures to be employed to validate re-grading mechanisms.', - 'CCI-002304': - 'Change security attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.', - 'CCI-002305': - 'The organization identifies individuals authorized to define or change the type and value of security attributes available for association with subjects and objects.', - 'CCI-002306': - 'Provide authorized individuals the capability to define or change the type of security attributes available for association with subjects.', - 'CCI-002307': - 'Provide authorized individuals the capability to define or change the value of security attributes available for association with subjects.', - 'CCI-002308': - 'Provide authorized individuals the capability to define or change the type of security attributes available for association with objects.', - 'CCI-002309': - 'Provide authorized individuals the capability to define or change the value of security attributes available for association with objects.', - 'CCI-002310': - 'Establish and document usage restrictions for each type of remote access allowed.', - 'CCI-002311': - 'Establish and document configuration/connection requirements for each type of remote access allowed.', - 'CCI-002312': - 'Establish and document implementation guidance for each type of remote access allowed.', - 'CCI-002313': 'The information system controls remote access methods.', - 'CCI-002314': 'Employ automated mechanisms to control remote access methods.', - 'CCI-002315': - 'The organization defines the number of managed network access control points through which the information system routes all remote access.', - 'CCI-002316': - 'Authorize access to security-relevant information via remote access only in a format that provides assessable evidence for organization-defined needs.', - 'CCI-002317': - 'Defines the needs for when the execution of privileged commands via remote access is to be authorized.', - 'CCI-002318': - 'Defines the needs for when access to security-relevant information via remote access is to be authorized.', - 'CCI-002319': - 'Document the rationale for authorization of the execution of privilege commands via remote access.', - 'CCI-002320': - 'Document the rationale for authorization of access to security-relevant information via remote access.', - 'CCI-002321': - 'Defines the time-period within which it disconnects or disables remote access to the system.', - 'CCI-002322': - 'Provide the capability to disconnect or disable remote access to the system within the organization-defined time period.', - 'CCI-002323': - 'Establish configuration requirements and connection requirements for wireless access.', - 'CCI-002324': - 'Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.', - 'CCI-002325': - 'Establish configuration requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.', - 'CCI-002326': - 'Establish connection requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.', - 'CCI-002327': - 'Defines the security policies which restrict the connection of classified mobile devices to classified systems.', - 'CCI-002328': - 'Restrict the connection of classified mobile devices to classified systems in accordance with organization-defined security policies.', - 'CCI-002329': - 'Defines the mobile devices that are to employ full-device or container encryption to protect the confidentiality and integrity of the information on the device.', - 'CCI-002330': - 'Employ full-device encryption or container encryption to protect the confidentiality of information on organization-defined mobile devices.', - 'CCI-002331': - 'Employ full-device encryption or container encryption to protect the integrity of information on organization-defined mobile devices.', - 'CCI-002332': - 'Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using the external systems.', - 'CCI-002333': - "The organization permits authorized individuals to use an external information system to access the information system only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.", - 'CCI-002334': - "The organization permits authorized individuals to use an external information system to process organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.", - 'CCI-002335': - "The organization permits authorized individuals to use an external information system to store organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.", - 'CCI-002336': - "The organization permits authorized individuals to use an external information system to transmit organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.", - 'CCI-002337': - 'Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after the system retains approved system connection or processing agreements with the organizational entity hosting the external system.', - 'CCI-002338': - 'Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using organization-defined restrictions.', - 'CCI-002339': - 'Defines the network accessible storage devices that are to be prohibited from being used in external systems.', - 'CCI-002340': - 'Prohibit the use of organization-defined network accessible storage devices in external systems.', - 'CCI-002341': - 'Defines the information sharing restrictions to be enforced when implementing information search and retrieval services.', - 'CCI-002342': - 'Implement information search and retrieval services that enforce organization-defined information sharing restrictions.', - 'CCI-002343': - 'Defines the data mining prevention techniques to be employed to protect organization-defined data storage objects against data mining.', - 'CCI-002344': - 'Defines the data mining detection techniques to be employed to detect data mining attempts against organization-defined data storage objects.', - 'CCI-002345': - 'Defines the data storage objects that are to be protected against data mining attempts.', - 'CCI-002346': - 'Employ organization-defined data mining prevention techniques for organization-defined data storage objects to protect against unauthorized data mining.', - 'CCI-002347': - 'Employ organization-defined data mining detection techniques for organization-defined data storage objects to detect data mining attempts.', - 'CCI-002348': - 'Defines the access control decisions that are to be applied to each access request prior to access enforcement.', - 'CCI-002349': - 'Establish procedures or implement mechanisms to ensure organization-defined access control decisions are applied to each access request prior to access enforcement.', - 'CCI-002350': - 'Defines the access authorization information that is to be transmitted using organization-defined security safeguards to organization-defined systems that enforce access control decisions.', - 'CCI-002351': - 'Defines the controls to be employed when transmitting organization-defined access authorization information to organization-defined systems that enforce access control decisions.', - 'CCI-002352': - 'Defines the systems that are to be recipients of organization-defined access authorization information using organization-defined security safeguards.', - 'CCI-002353': - 'Transmit organization-defined access authorization information using organization-defined controls to organization-defined systems that enforce access control decisions.', - 'CCI-002354': - 'Defines the security attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.', - 'CCI-002355': - 'Enforce access control decisions based on organization-defined security or privacy attributes that do not include the identity of the user or process acting on behalf of the user.', - 'CCI-002356': - 'Defines the access control policies to be implemented by the reference monitor.', - 'CCI-002357': - 'Implement a reference monitor for organization-defined access control policies that is tamperproof.', - 'CCI-002358': - 'Implement a reference monitor for organization-defined access control policies that is always invoked.', - 'CCI-002359': - 'Implement a reference monitor for organization-defined access control policies that is small enough to be subject to analysis and testing, the completeness of which can be assured.', - 'CCI-002360': - 'Defines the conditions or trigger events requiring session disconnect when automatically terminating a user session.', - 'CCI-002361': - 'Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.', - 'CCI-002362': - 'Defines the information resources requiring authentication in order to gain access.', - 'CCI-002363': - 'Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources.', - 'CCI-002364': - 'Display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.', - 'CCI-002365': - 'The organization manages information system authenticators by requiring individuals to take specific security safeguards to protect authenticators.', - 'CCI-002366': - 'The organization manages information system authenticators by having devices implement specific security safeguards to protect authenticators.', - 'CCI-002367': - 'The organization ensures unencrypted static authenticators are not embedded in applications.', - 'CCI-002368': - 'Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level risk assessment policy is disseminated.', - 'CCI-002369': - 'Defines the personnel or roles to whom the risk assessment procedures are disseminated.', - 'CCI-002370': - 'Disseminate risk assessment results to organization-defined personnel or roles.', - 'CCI-002371': - 'Defines the personnel or roles to whom the risk assessment results will be disseminated.', - 'CCI-002372': - 'Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.', - 'CCI-002373': - 'Define the breadth and depth of vulnerability scanning coverage (i.e., information system components scanned and vulnerabilities checked).', - 'CCI-002374': - 'Defines the corrective actions if unintended information about the system is discovered.', - 'CCI-002375': - 'Take organization-defined corrective actions if information about the system is discovered.', - 'CCI-002376': - 'Defines the personnel or roles with whom the information obtained from the vulnerability monitoring process and control assessments will be shared.', - 'CCI-002377': - 'The organization documents the system and communications protection policy.', - 'CCI-002378': - 'Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level system and communications protection policy.', - 'CCI-002379': - 'The organization documents procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.', - 'CCI-002380': - 'Defines the personnel or roles to be recipients of the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.', - 'CCI-002381': - 'Minimize the number of nonsecurity functions included within the isolation boundary containing security functions.', - 'CCI-002382': - 'Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.', - 'CCI-002383': - 'Defines the procedures to be employed to prevent unauthorized information transfer via shared resources when system processing explicitly switches between different information classification levels or security categories.', - 'CCI-002384': - 'Prevent unauthorized information transfer via shared resources in accordance with organization-defined procedures when system processing explicitly switches between different information classification levels or security categories.', - 'CCI-002385': - 'Protect against or limit the effects of organization-defined types of denial-of-service events.', - 'CCI-002386': - 'The organization defines the security safeguards to be employed to protect the information system against, or limit the effects of, denial of service attacks.', - 'CCI-002387': - 'Defines the denial of service attacks against other systems that the system is to restrict the ability of individuals to launch.', - 'CCI-002388': - 'Defines the monitoring tools to be employed to detect indicators of denial-of-service attacks against the system.', - 'CCI-002389': - 'Employ organization-defined monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system.', - 'CCI-002390': - 'Defines the system resources to be monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks.', - 'CCI-002391': - 'Monitor organization-defined system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks.', - 'CCI-002392': - 'Defines the resources to be allocated to protect the availability of system resources.', - 'CCI-002393': - 'Defines the controls to be employed to protect the availability of system resources.', - 'CCI-002394': - 'Protect the availability of resources by allocating organization-defined resources based on priority, quota, and/or organization-defined controls.', - 'CCI-002395': - 'Implement subnetworks for publicly accessible system components that are physically and/or logically separated from internal organizational networks.', - 'CCI-002396': - 'Protect the confidentiality and integrity of the information being transmitted across each interface for each external telecommunication service.', - 'CCI-002397': - 'Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using organization-defined safeguards.', - 'CCI-002398': - 'Detect outgoing communications traffic posing a threat to external systems.', - 'CCI-002399': - 'Deny outgoing communications traffic posing a threat to external systems.', - 'CCI-002400': - 'Audit the identity of internal users associated with denied outgoing communications traffic posing a threat to external systems.', - 'CCI-002401': - 'Defines the authorized sources from which the system will allow incoming communications.', - 'CCI-002402': - 'Defines the authorized destinations for routing inbound communications.', - 'CCI-002403': - 'Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.', - 'CCI-002404': - 'Defines the host-based boundary protection mechanisms that are to be implemented at organization-defined system components.', - 'CCI-002405': - 'Defines the system components at which organization-defined host-based boundary protection mechanisms will be implemented.', - 'CCI-002406': - 'Implement organization-defined host-based boundary protection mechanisms at organization-defined system components.', - 'CCI-002407': - 'Defines the managed interfaces at which protect against unauthorized physical connections.', - 'CCI-002408': - 'Defines the communication clients that are independently configured by end users and external service providers which will block both inbound and outbound communications traffic.', - 'CCI-002409': - 'Block inbound and outbound communications traffic between organization-defined communication clients that are independently configured by end users and external service providers.', - 'CCI-002410': - 'Defines system components that are to be dynamically isolated from other system components.', - 'CCI-002411': - 'Provide the capability to dynamically isolate organization-defined system components from other system components.', - 'CCI-002412': - 'The organization defines the information system components supporting organization-defined missions and/or business functions that are to be separated using boundary protection mechanisms.', - 'CCI-002413': - 'Defines the system components supporting organization-defined missions and/or business functions that are to be isolated using boundary protection mechanisms.', - 'CCI-002414': - 'Defines the missions and/or business functions for which boundary protection mechanisms will be employed to isolate the supporting organization-defined system components.', - 'CCI-002415': - 'Employ boundary protection mechanisms to isolate organization-defined system components supporting organization-defined missions and/or business functions.', - 'CCI-002416': - 'Implement separate network addresses to connect to systems in different security domains.', - 'CCI-002417': - 'Disable feedback to senders on protocol format validation failure.', - 'CCI-002418': - 'Protect the confidentiality and/or integrity of transmitted information.', - 'CCI-002419': - 'The organization defines the alternative physical safeguards to be employed when cryptographic mechanisms are not implemented to protect information during transmission.', - 'CCI-002420': - 'Maintain the confidentiality and/or integrity of information during preparation for transmission.', - 'CCI-002421': - 'Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.', - 'CCI-002422': - 'Maintain the confidentiality and/or integrity of information during reception.', - 'CCI-002423': - 'Implement cryptographic mechanisms to protect message externals unless otherwise protected by organization-defined alternative physical controls.', - 'CCI-002424': - 'Defines the alternative physical controls to be employed when cryptographic mechanisms to conceal or randomize communication patterns are not implemented.', - 'CCI-002425': - 'Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by organization-defined alternative physical controls.', - 'CCI-002426': - 'Provide a trusted communications path that is irrefutably distinguishable from other communications paths.', - 'CCI-002427': - 'Defines the alternative physical controls to be employed to protect message externals when cryptographic mechanisms are not implemented.', - 'CCI-002428': - 'Defines the requirements for cryptographic key generation to be employed within the system.', - 'CCI-002429': - 'Defines the requirements for cryptographic key distribution to be employed within the system.', - 'CCI-002430': - 'Defines the requirements for cryptographic key storage to be employed within the system.', - 'CCI-002431': - 'Defines the requirements for cryptographic key access to be employed within the system.', - 'CCI-002432': - 'Defines the requirements for cryptographic key destruction to be employed within the system.', - 'CCI-002433': - 'Establish cryptographic keys when cryptography is employed within the system in accordance with organization-defined requirements for key generation.', - 'CCI-002434': - 'Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution.', - 'CCI-002435': - 'Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage.', - 'CCI-002436': - 'Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access.', - 'CCI-002437': - 'Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction.', - 'CCI-002438': - 'Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key generation.', - 'CCI-002439': - 'Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution.', - 'CCI-002440': - 'Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage.', - 'CCI-002441': - 'Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access.', - 'CCI-002442': - 'Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction.', - 'CCI-002443': - 'Produce symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.', - 'CCI-002444': - 'Control symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.', - 'CCI-002445': - 'Distribute symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.', - 'CCI-002446': - "Produce asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.", - 'CCI-002447': - "Control asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.", - 'CCI-002448': - "Distribute asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.", - 'CCI-002449': - 'Defines the cryptographic uses, and type of cryptography required for each use, to be implemented by the system.', - 'CCI-002450': - 'Implement organization-defined types of cryptography for each specified cryptography use.', - 'CCI-002451': - 'Defines the systems or system components from which collaborative computing devices and applications in organization-defined secure work areas are to be disabled or removed.', - 'CCI-002452': - 'Defines the online meetings and teleconferences for which the system provides an explicit indication of current participants.', - 'CCI-002453': - 'Provide an explicit indication of current participants in organization-defined online meetings and teleconferences.', - 'CCI-002454': - 'Defines the security attributes to associate with the information being exchanged between systems and between system components.', - 'CCI-002455': - 'Associate organization-defined security attributes with information exchanged between system components.', - 'CCI-002456': - 'Defines the certificate policy employed to issue public key certificates.', - 'CCI-002457': - 'Defines the corrective actions to be taken when organization-defined unacceptable mobile code is identified.', - 'CCI-002458': - 'Defines what constitutes unacceptable mobile code by using corrective actions.', - 'CCI-002459': - 'Defines the unacceptable mobile code to prevent download and execution.', - 'CCI-002460': - 'Enforce organization-defined actions prior to executing mobile code.', - 'CCI-002461': - 'Allow execution of permitted mobile code only in confined virtual machine environments.', - 'CCI-002462': - 'Provide additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.', - 'CCI-002463': - 'Provide data origin artifacts for internal name/address resolution queries.', - 'CCI-002464': - 'Provide data integrity protection artifacts for internal name/address resolution queries.', - 'CCI-002465': - 'Request data origin authentication verification on the name/address resolution responses the system receives from authoritative sources.', - 'CCI-002466': - 'Request data integrity verification on the name/address resolution responses the system receives from authoritative sources.', - 'CCI-002467': - 'Perform data integrity verification on the name/address resolution responses the system receives from authoritative sources.', - 'CCI-002468': - 'Perform data origin verification authentication on the name/address resolution responses the system receives from authoritative sources.', - 'CCI-002469': - 'Defines the certificate authorities allowed to be used for verification of the establishment of protected sessions.', - 'CCI-002470': - 'Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.', - 'CCI-002471': - 'Defines the system components, with minimal functionality and information storage, to be employed.', - 'CCI-002472': 'Defines the information at rest that is to be protected.', - 'CCI-002473': - 'Defines the information at rest for which cryptographic mechanisms will be implemented.', - 'CCI-002474': - 'Defines the system components which require the implementation of cryptographic mechanisms to prevent unauthorized disclosure and modification of organization-defined information at rest.', - 'CCI-002475': - 'Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined system components.', - 'CCI-002476': - 'Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.', - 'CCI-002477': - 'Defines the information to be removed from online storage and stored in an offline secure location.', - 'CCI-002478': 'Remove organization-defined information from online storage.', - 'CCI-002479': - 'Store organization-defined information in an offline secure location.', - 'CCI-002480': - 'Defines the system components for which a diverse set of information technologies are to be employed.', - 'CCI-002481': - 'Employ virtualization techniques to support the deployment of a diversity of applications that are changed per organization-defined frequency.', - 'CCI-002482': - 'Defines the concealment and misdirection techniques employed for organization-defined systems to confuse and mislead adversaries.', - 'CCI-002483': - 'Defines the systems for which organization-defined concealment and misdirection techniques are to be employed.', - 'CCI-002484': - 'Defines the time periods at which to employ organization-defined concealment and misdirection techniques on organization-defined systems.', - 'CCI-002485': - 'Employ organization-defined concealment and misdirection techniques for organization-defined systems at organization-defined time periods to confuse and mislead adversaries.', - 'CCI-002486': - 'Defines the techniques to be employed to introduce randomness into organizational operations and assets.', - 'CCI-002487': - 'Employ organization-defined techniques to introduce randomness into organizational operations.', - 'CCI-002488': - 'Employ organization-defined techniques to introduce randomness into organizational assets.', - 'CCI-002489': - 'Defines the processing and/or storage locations to be changed at random intervals or at an organization-defined frequency.', - 'CCI-002490': - 'Defines the frequency at which the location of organization-defined processing and/or storage changes.', - 'CCI-002491': - 'The organization changes the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.', - 'CCI-002492': - 'Change the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.', - 'CCI-002493': - 'Defines the system components in which it will employ realistic but misleading information regarding its security state or posture.', - 'CCI-002494': - 'Employ realistic, but misleading, information in organization-defined system components about its security state or posture.', - 'CCI-002495': - 'Defines the techniques to be employed to hide or conceal organization-defined system components.', - 'CCI-002496': 'Defines the system components to be hidden or concealed.', - 'CCI-002497': - 'Employ organization-defined techniques to hide or conceal organization-defined system components.', - 'CCI-002498': - 'Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert storage and/or timing channels.', - 'CCI-002499': - 'Estimate the maximum bandwidth of the covert storage and timing channels.', - 'CCI-002500': - 'Defines the maximum bandwidth values to which covert storage and/or timing channels are to be reduced.', - 'CCI-002501': - 'Reduce the maximum bandwidth for identified covert storage and/or timing channels to organization-defined values.', - 'CCI-002502': - 'Defines the subset of identified covert channels in the operational environment of the system that are to have the bandwidth measured.', - 'CCI-002503': - 'Measure the bandwidth of an organization-defined subset of identified covert channels in the operational environment of the information system.', - 'CCI-002504': - 'Defines the system components into which the system is partitioned.', - 'CCI-002505': - 'Defines the circumstances under which the system components are to be physically or logically separated to support partitioning.', - 'CCI-002506': - 'Partition the system into organization-defined system components residing in separate physical or logical domains or environments based on organization-defined circumstances for physical or logical separation of components.', - 'CCI-002507': - 'Control read-only media after information has been recorded onto the media.', - 'CCI-002508': - 'Defines the system firmware components for which hardware-based, write-protect is employed.', - 'CCI-002509': - 'Employ hardware-based, write-protect for organization-defined information system firmware components.', - 'CCI-002510': - 'Defines the individuals authorized to manually disable hardware-based, write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.', - 'CCI-002511': - 'Implement specific procedures for organization-defined authorized individuals to manually disable hardware-based, write-protect for firmware modifications.', - 'CCI-002512': - 'Implement specific procedures for organization-defined authorized individuals to manually re-enable hardware write-protect prior to returning to operational mode.', - 'CCI-002513': - 'Defines the processing that is to be distributed across multiple physical locations or logical domains.', - 'CCI-002514': - 'Defines the storage components that is to be distributed across multiple physical locations or logical domains.', - 'CCI-002515': - 'Distributes organization-defined processing across multiple physical locations or logical domains.', - 'CCI-002516': - 'Distributes organization-defined storage components across multiple physical locations or logical domains.', - 'CCI-002517': - 'Defines the distributed processing components that are to be polled to identify potential faults, errors, or compromises.', - 'CCI-002518': - 'Defines the distributed storage components that are to be polled to identify potential faults, errors, or compromises.', - 'CCI-002519': - 'Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed processing components.', - 'CCI-002520': - 'Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed storage components.', - 'CCI-002521': - 'Defines the out-of-band channels to be employed for the physical delivery or electronic transmission of organization-defined information, system components, or devices.', - 'CCI-002522': - 'Defines the information, system components, or devices that are to be electronically transmitted or physically delivered via organization-defined out-of-band channels.', - 'CCI-002523': - 'Defines the individuals or systems authorized to be recipients of organization-defined information, system components, or devices to be delivered by employing organization-defined out-of-band channels for electronic transmission or physical delivery.', - 'CCI-002524': - 'Employ organization-defined out-of-band channels for the physical delivery or electronic transmission of organization-defined information, system components, or devices to organization-defined individuals or systems.', - 'CCI-002525': - 'Defines the controls to be employed to ensure only organization-defined individuals or systems receive organization-defined information, system components, or devices.', - 'CCI-002526': - 'Defines the information, system components, or devices which are to be received only by organization-defined individuals or systems.', - 'CCI-002527': - 'Employ organization-defined controls to ensure only organization-defined individuals or systems receive the organization-defined information, system components, or devices.', - 'CCI-002528': - 'Defines the operations security controls to be employed to protect key organizational information throughout the system development life cycle.', - 'CCI-002529': - 'Employ organization-defined operations security controls to protect key organizational information throughout the system development life cycle.', - 'CCI-002530': - 'Maintain a separate execution domain for each executing system process.', - 'CCI-002531': - 'Implement hardware separation mechanisms to facilitate process isolation.', - 'CCI-002532': - 'Defines the multi-threaded processing in which a separate execution domain is maintained by the system for each thread.', - 'CCI-002533': - 'Maintain a separate execution domain for each thread in organization-defined multi-threaded processing.', - 'CCI-002534': - 'Defines types of signal parameter attacks or references to sources for such attacks from which the system protects organization-defined wireless links.', - 'CCI-002535': - 'Defines the external and internal wireless links the system is to protect from organization-defined types of signal parameter attacks or references to sources for such attacks.', - 'CCI-002536': - 'Protect organization-defined external and internal wireless links from organization-defined types of signal parameter attacks or references to sources for such attacks.', - 'CCI-002537': - 'Defines the level of protection against the effects of intentional electromagnetic interference to be achieved by implemented cryptographic mechanisms.', - 'CCI-002538': - 'Implement cryptographic mechanisms that achieve an organization-defined level of protection against the effects of intentional electromagnetic interference.', - 'CCI-002539': - 'Defines the level of reduction the system is to implement to reduce the detection potential of wireless links.', - 'CCI-002540': - 'Implement cryptographic mechanisms to reduce the detection potential of wireless links to an organization-defined level of reduction.', - 'CCI-002541': - 'Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.', - 'CCI-002542': - 'Defines the wireless transmitters that are to have cryptographic mechanisms implemented to prevent the identification of the wireless transmitters.', - 'CCI-002543': - 'Implement cryptographic mechanisms to prevent the identification of organization-defined wireless transmitters by using the transmitter signal parameters.', - 'CCI-002544': - 'Defines the systems or system components on which organization-defined connection ports or input/output devices are to be physically or logically disabled or removed.', - 'CCI-002545': - 'Defines the connection ports or input/output devices that are to be physically or logically disabled or removed from organization-defined systems or system components.', - 'CCI-002546': - 'Physically or logically disable or remove organization-defined connection ports or input/output devices on organization-defined systems or system components.', - 'CCI-002547': - 'Defines the exceptions where remote activation of sensors is allowed.', - 'CCI-002548': - 'Prohibit the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems; and/or the remote activation of environmental sensing capabilities on organizational systems or system components except for the organization-defined exceptions where remote activation of sensors is allowed.', - 'CCI-002549': - 'Defines the class of users to receive explicit indication of sensor use.', - 'CCI-002550': - 'Provide an explicit indication of sensor use to the organization-defined class of users.', - 'CCI-002551': - 'Defines the sensors to be configured so that collected data or information is reported only to authorized individuals or roles.', - 'CCI-002552': - 'Verify that the system is configured so that data or information collected by the organization-defined sensors is only reported to authorized individuals or roles.', - 'CCI-002553': - 'Defines the measures to be employed to ensure data or information collected by organization-defined sensors is used only for authorized purposes.', - 'CCI-002554': - 'Defines the sensors that are to collect data or information for authorized purposes.', - 'CCI-002555': - 'Employ organization-defined measures, so that data or information collected by organization-defined sensors is only used for authorized purposes.', - 'CCI-002556': - 'Defines the environmental sensing capabilities prohibited on devices used in organization-defined facilities, areas, or systems.', - 'CCI-002557': - 'Defines the facilities, areas, or systems where devices processing organization-defined environmental sensing capabilities are prohibited.', - 'CCI-002558': - 'The organization prohibits the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems.', - 'CCI-002559': - 'Defines the system components for which usage restrictions and implementation guidance are to be established.', - 'CCI-002560': - 'Establish usage restrictions and implementation guidance for organization-defined system components based on the potential to cause damage to the system if used maliciously.', - 'CCI-002561': - 'Authorize the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.', - 'CCI-002562': - 'Monitor the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.', - 'CCI-002563': - 'Control the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.', - 'CCI-002564': - 'Defines the system, system component, or location where a detonation chamber capability is employed.', - 'CCI-002565': - 'Employ a detonation chamber capability within an organization-defined system, system component, or location.', - 'CCI-002566': - 'Defines personnel or roles to whom a media protection policy and procedures will be disseminated.', - 'CCI-002567': 'Review and approve media sanitization.', - 'CCI-002568': 'Track and document media sanitization.', - 'CCI-002569': 'Verify media sanitization.', - 'CCI-002570': 'Review and approve media disposal actions.', - 'CCI-002571': 'Track and document media disposal actions.', - 'CCI-002572': 'Verify media disposal actions.', - 'CCI-002573': - 'Enforce dual authorization for the sanitization of organization-defined system media.', - 'CCI-002574': - 'Defines the system media that dual authorization is enforced for sanitization.', - 'CCI-002575': - 'Defines systems or system components from which information is purged or wiped, either remotely or under the organization-defined conditions.', - 'CCI-002576': - 'Defines conditions under which information from organization-defined systems or system components are to be purged or wiped.', - 'CCI-002577': - 'Provide the capability to purge or wipe information from organization-defined systems, system components either remotely or under organization-defined conditions.', - 'CCI-002578': - 'Defines system media to sanitize prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures.', - 'CCI-002579': - 'Defines the sanitization techniques and procedures to be used to sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse.', - 'CCI-002580': - 'Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.', - 'CCI-002581': - 'Defines the types of system media to restrict or prohibit on organization-defined systems or system components using organization-defined controls.', - 'CCI-002582': - 'Defines the systems or system components on which to restrict or prohibit the use of organization-defined types of system media using organization-defined controls.', - 'CCI-002583': - 'Defines the controls to use for restricting or prohibiting the use of organization-defined types of system media on organization-defined systems or system components.', - 'CCI-002584': - 'Restrict or prohibit the use of organization-defined types of system media on organization-defined systems or system components using organization-defined controls.', - 'CCI-002585': - 'Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.', - 'CCI-002586': - 'Prohibit the use of sanitization-resistant media in organizational systems.', - 'CCI-002587': 'Document system media downgrading actions.', - 'CCI-002588': - 'The organization employs organization-defined tests of downgrading equipment in accordance with organization-defined frequency.', - 'CCI-002589': - 'The organization employs procedures to verify correct performance of organization-defined tests of downgrading equipment in accordance with organization-defined frequency.', - 'CCI-002590': - 'The organization defines tests to employ for downgrading equipment.', - 'CCI-002591': - 'Defines the frequency with which to test downgrading equipment and procedures to ensure correct performance.', - 'CCI-002592': - 'The organization defines Controlled Unclassified Information (CUI).', - 'CCI-002593': - 'Downgrade system media containing Controlled Unclassified Information (CUI) prior to public release.', - 'CCI-002594': - 'Downgrade system media containing classified information prior to release to individuals without required access authorizations.', - 'CCI-002595': - 'The organization establishes an organization-defined information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.', - 'CCI-002596': - 'The organization establishes and defines an information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.', - 'CCI-002597': - 'The organization defines strength and integrity for downgrading mechanisms to establish an organization-defined information system media downgrading process.', - 'CCI-002598': - 'The organization ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information.', - 'CCI-002599': - 'The organization defines and identifies the information system media requiring downgrading.', - 'CCI-002600': - 'Downgrade the identified system media using the established process.', - 'CCI-002601': - 'Defines the personnel or roles to whom the system and information integrity policy and procedures are to be disseminated.', - 'CCI-002602': - 'Test firmware updates related to flaw remediation for effectiveness before installation.', - 'CCI-002603': - 'Test firmware updates related to flaw remediation for potential side effects before installation.', - 'CCI-002604': - 'Defines the time period following the release of updates within which security-related software updates are to be installed.', - 'CCI-002605': - 'Install security-relevant software updates within an organization-defined time period of the release of the updates.', - 'CCI-002606': - 'Defines the time period following the release of updates within which security-related firmware updates are to be installed.', - 'CCI-002607': - 'Install security-relevant firmware updates within an organization-defined time period of the release of the updates.', - 'CCI-002608': - 'Establish organization-defined benchmarks for the time taken to apply corrective actions after flaw identification.', - 'CCI-002609': - 'Defines the system components on which organization-defined security-relevant software updates will be automatically installed.', - 'CCI-002610': - 'Defines the system components on which organization-defined security-relevant firmware updates will be automatically installed.', - 'CCI-002611': - 'Defines the security-relevant software updates to be automatically installed on organization-defined system components.', - 'CCI-002612': - 'Defines the security-relevant firmware updates to be automatically installed on organization-defined system components.', - 'CCI-002613': - 'Install organization-defined security-relevant software updates automatically to organization-defined system components.', - 'CCI-002614': - 'Install organization-defined security-relevant firmware updates automatically to organization-defined system components.', - 'CCI-002615': - 'Defines the software components to remove previous versions after updated versions have been installed.', - 'CCI-002616': - 'Defines the firmware components to remove previous versions after updated versions have been installed.', - 'CCI-002617': - 'Remove previous versions of organization-defined software components after updated versions have been installed.', - 'CCI-002618': - 'Remove previous versions of organization-defined firmware components after updated versions have been installed.', - 'CCI-002619': - 'The organization employs malicious code protection mechanisms at information system entry points to detect malicious code.', - 'CCI-002620': - 'The organization employs malicious code protection mechanisms at information system exit points to detect malicious code.', - 'CCI-002621': - 'The organization employs malicious code protection mechanisms at information system entry points to eradicate malicious code.', - 'CCI-002622': - 'The organization employs malicious code protection mechanisms at information system exit points to eradicate malicious code.', - 'CCI-002623': - 'Defines the frequency for performing periodic scans of the system for malicious code.', - 'CCI-002624': - 'Configure malicious code protection mechanisms to perform real-time scans of files from external sources at endpoint; and/or network entry and exit points as the files are downloaded, opened, or executed in accordance with organizational policy.', - 'CCI-002625': - 'When testing malicious code protection mechanisms, verify the detection of the code.', - 'CCI-002626': - 'When testing malicious code protection mechanisms, verify the associated incident reporting of the code occurs.', - 'CCI-002627': - 'The information system implements nonsignature-based malicious code detection mechanisms.', - 'CCI-002628': - 'Defines the unauthorized operating system commands that are to be detected through the kernel application programming interface on organization-defined system hardware components.', - 'CCI-002629': - 'Defines the system hardware components that are to detect organization-defined unauthorized operating system commands through the kernel programming application interface.', - 'CCI-002630': - 'Detect organization-defined unauthorized operating system commands through the kernel application programming interface at organization-defined system hardware components.', - 'CCI-002631': - 'Issue a warning; audit the command execution; and/or prevent the execution of the command when organization-defined unauthorized operating system commands are detected.', - 'CCI-002632': - 'The organization defines the remote commands that are to be authenticated using organization-defined safeguards for malicious code protection.', - 'CCI-002633': - 'The organization defines the security safeguards to be implemented to authenticate organization-defined remote commands for malicious code protection.', - 'CCI-002634': - 'Defines the tools to be employed to analyze the characteristics and behavior of malicious code.', - 'CCI-002635': - 'Defines the techniques to be employed to analyze the characteristics and behavior of malicious code.', - 'CCI-002636': - 'Employ organization-defined tools to analyze the characteristics and behavior of malicious code.', - 'CCI-002637': - 'The information system implements organization-defined security safeguards to authenticate organization-defined remote commands for malicious code protection.', - 'CCI-002638': - 'Employ organization-defined techniques to analyze the characteristics and behavior of malicious code.', - 'CCI-002639': - 'Incorporate the results from malicious code analysis into organizational incident response processes.', - 'CCI-002640': - 'Incorporate the results from malicious code analysis into organizational flaw remediation processes.', - 'CCI-002641': - 'Monitor the system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives.', - 'CCI-002642': 'Monitor the system to detect unauthorized local connections.', - 'CCI-002643': - 'Monitor the system to detect unauthorized network connections.', - 'CCI-002644': 'Monitor the system to detect unauthorized remote connections.', - 'CCI-002645': - 'Defines the techniques and methods to be used to identify unauthorized use of the system.', - 'CCI-002646': - 'Identify unauthorized use of the system through organization-defined techniques and methods.', - 'CCI-002647': - 'The organization protects information obtained from intrusion-monitoring tools from unauthorized access.', - 'CCI-002648': - 'The organization protects information obtained from intrusion-monitoring tools from unauthorized modification.', - 'CCI-002649': - 'The organization protects information obtained from intrusion-monitoring tools from unauthorized deletion.', - 'CCI-002650': - 'Defines the system monitoring information that is to be provided the organization-defined personnel or roles.', - 'CCI-002651': - 'Defines the personnel or roles that are to be provided organization-defined system monitoring information.', - 'CCI-002652': - 'Defines the frequency at which the organization will provide the organization-defined system monitoring information to organization-defined personnel or roles.', - 'CCI-002653': - 'The organization provides organization-defined information system monitoring information to organization-defined personnel or roles as needed or per organization-defined frequency.', - 'CCI-002654': - 'Provide organization-defined system monitoring information to organization-defined personnel or roles as needed, and/or per organization-defined frequency.', - 'CCI-002655': - 'Connect individual intrusion detection tools into a system-wide intrusion detection system.', - 'CCI-002656': - 'Configure individual intrusion detection tools into a system-wide intrusion detection system.', - 'CCI-002657': - 'Employ automated tools to integrate intrusion detection tools into access control mechanisms.', - 'CCI-002658': - 'Employ automated tools to integrate intrusion detection tools into flow control mechanisms.', - 'CCI-002659': - 'Defines the frequency on which it will monitor inbound communications for unusual or unauthorized activities or conditions.', - 'CCI-002660': - 'Defines the frequency on which it will monitor outbound communications for unusual or unauthorized activities or conditions.', - 'CCI-002661': - 'Monitor inbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions.', - 'CCI-002662': - 'Monitor outbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions.', - 'CCI-002663': - 'Defines the personnel or roles to receive alerts when organization-defined indicators of compromise or potential compromise occur.', - 'CCI-002664': - 'Alert organization-defined personnel or roles when organization-defined compromise indicators generate the occurrence of a compromise or a potential compromise.', - 'CCI-002665': - 'Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring tools.', - 'CCI-002666': - 'Defines the system monitoring tools that will have visibility into organization-defined encrypted communications traffic.', - 'CCI-002667': - 'Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring tools.', - 'CCI-002668': - 'Defines the interior points within the system where outbound communications will be analyzed to discover anomalies.', - 'CCI-002669': - 'Use the traffic and event profiles in tuning system-monitoring devices.', - 'CCI-002670': - 'Defines the interior points within the system where outbound communications will be analyzed to detect covert exfiltration of information.', - 'CCI-002671': - 'Analyze outbound communications traffic at the external interfaces of the system to detect covert exfiltration of information.', - 'CCI-002672': - 'Analyze outbound communications traffic at organization-defined interior points within the system to detect covert exfiltration of information.', - 'CCI-002673': - 'Defines the additional monitoring to be implemented for individuals identified as posing an increased level of risk.', - 'CCI-002674': - 'Defines the sources that may be used to identify individuals who pose an increased level of risk.', - 'CCI-002675': - 'Implement organization-defined additional monitoring of individuals who have been identified by organization-defined sources as posing an increased level of risk.', - 'CCI-002676': - 'Defines additional monitoring to be implemented for privileged users.', - 'CCI-002677': - 'Implement organization-defined additional monitoring of privileged users.', - 'CCI-002678': - 'Defines additional monitoring to be implemented for individuals during an organization-defined probationary period.', - 'CCI-002679': - 'Defines the probationary period during which additional monitoring will be implemented for individuals.', - 'CCI-002680': - 'Implement organization-defined additional monitoring of individuals during an organization-defined probationary period.', - 'CCI-002681': - 'Defines the authorization or approval process for network services.', - 'CCI-002682': - 'Defines the personnel or roles to be alerted when unauthorized or unapproved network services are detected.', - 'CCI-002683': - 'Detect network services that have not been authorized or approved by the organization-defined authorization or approval processes.', - 'CCI-002684': - 'Audit and/or alert organization-defined personnel when unauthorized network services are detected.', - 'CCI-002685': - 'Defines the host-based monitoring mechanisms to be implemented at organization-defined system components.', - 'CCI-002686': - 'Defines the system components at which organization-defined host-based monitoring mechanisms are to be implemented.', - 'CCI-002687': - 'Implement organization-defined host-based monitoring mechanisms at organization-defined system components.', - 'CCI-002688': 'Discover indicators of compromise.', - 'CCI-002689': 'Collect indicators of compromise.', - 'CCI-002690': - 'Distribute indicators of compromise provided by organization-defined sources, to organization-defined personnel or roles.', - 'CCI-002691': 'The information system uses indicators of compromise.', - 'CCI-002692': - 'Defines the external organizations from which it receives information system security alerts, advisories, and directives.', - 'CCI-002693': - 'Defines the elements within the organization to whom the organization will disseminate security alerts, advisories, and directives.', - 'CCI-002694': - 'Defines the external organizations to which the organization will disseminate security alerts, advisories, and directives.', - 'CCI-002695': - 'Defines the security functions that require verification of correct operation.', - 'CCI-002696': - 'Verify correct operation of organization-defined security functions.', - 'CCI-002697': - 'Defines the frequency at which it will verify correct operation of organization-defined security functions.', - 'CCI-002698': - 'Defines the system transitional states when the system will verify correct operation of organization-defined security functions.', - 'CCI-002699': - 'Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.', - 'CCI-002700': - 'Defines the personnel or roles to be notified when security verification tests fail.', - 'CCI-002701': - 'Defines alternative action(s) to be taken when anomalies in the operation of organization-defined security functions are discovered.', - 'CCI-002702': - 'Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.', - 'CCI-002703': - 'Defines the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes.', - 'CCI-002704': - 'Employ integrity verification tools to detect unauthorized changes to organization-defined software, firmware, and information.', - 'CCI-002705': - 'Defines the software on which integrity checks will be performed.', - 'CCI-002706': - 'Defines the firmware on which integrity checks will be performed.', - 'CCI-002707': - 'Defines the information on which integrity checks will be performed.', - 'CCI-002708': - 'Defines the transitional state or security-relevant events when performing integrity checks on software, firmware, and information.', - 'CCI-002709': - 'Defines the frequency at which integrity checks of software, firmware, and information will be performed.', - 'CCI-002710': - 'Perform an integrity check of organization-defined software at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.', - 'CCI-002711': - 'Perform an integrity check of organization-defined firmware at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.', - 'CCI-002712': - 'Perform an integrity check of organization-defined information at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.', - 'CCI-002713': - 'Defines the personnel or roles to be notified when discrepancies are discovered during integrity verification.', - 'CCI-002714': - 'Defines the controls that are to be employed when integrity violations are discovered.', - 'CCI-002715': - 'Automatically shut the system down, restart the system, and/or implement organization-defined controls when integrity violations are discovered.', - 'CCI-002716': - 'Implement cryptographic mechanisms to detect unauthorized changes to software.', - 'CCI-002717': - 'Implement cryptographic mechanisms to detect unauthorized changes to firmware.', - 'CCI-002718': - 'Implement cryptographic mechanisms to detect unauthorized changes to information.', - 'CCI-002719': - 'Defines the unauthorized security-relevant changes to the system that are to be incorporated into the organizational incident response capability.', - 'CCI-002720': - 'Incorporate the detection of organization-defined security-relevant unauthorized changes into the organizational incident response capability.', - 'CCI-002721': - 'Defines the personnel or roles that are to be alerted when a potential integrity violation is detected.', - 'CCI-002722': - 'Defines other actions that can be taken when a potential integrity violation is detected.', - 'CCI-002723': - 'Upon detection of a potential integrity violation, provides the capability to audit the event.', - 'CCI-002724': - 'Upon detection of a potential integrity violation, initiate one or more of the following actions: generate an audit record; alert the current user; alert organization-defined personnel or roles; and/or organization-defined other actions.', - 'CCI-002725': - 'Defines the system component which will have the integrity of the boot process verified.', - 'CCI-002726': - 'Verify the integrity of the boot process of organization-defined system components.', - 'CCI-002727': - 'Defines the mechanisms to be implemented to protect the integrity of the boot firmware in organization-defined system components.', - 'CCI-002728': - 'Defines the system components on which organization-defined mechanisms will be implemented to protect the integrity of the boot firmware.', - 'CCI-002729': - 'Implement organization-defined mechanisms to protect the integrity of boot firmware in organization-defined system components.', - 'CCI-002730': - 'The organization defines the user-installed software that is to be executed in a confined physical or virtual machine environment with limited privileges.', - 'CCI-002731': - 'The organization requires that organization-defined user-installed software execute in a confined physical or virtual machine environment with limited privileges.', - 'CCI-002732': - 'Defines the user-installed software that is to have its integrity verified prior to execution.', - 'CCI-002733': - 'Require that the integrity of organization-defined user-installed software be verified prior to execution.', - 'CCI-002734': - 'Defines the personnel or roles which have the authority to explicitly approve binary or machine-executable code.', - 'CCI-002735': - 'The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only in confined physical or virtual machine environments.', - 'CCI-002736': - 'The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only with the explicit approval of organization-defined personnel or roles.', - 'CCI-002737': - 'The organization prohibits the use of binary or machine-executable code from sources with limited or no warranty and without the provision of source code.', - 'CCI-002738': - 'The organization provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.', - 'CCI-002739': - 'Defines the software or firmware components on which cryptographic mechanisms are to be implemented to support authentication prior to installation.', - 'CCI-002740': - 'Implement cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation.', - 'CCI-002741': - 'Employ spam protection mechanisms at system entry points to detect and take action on unsolicited messages.', - 'CCI-002742': - 'Employ spam protection mechanisms at system exit points to detect and take action on unsolicited messages.', - 'CCI-002743': - 'Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.', - 'CCI-002744': - 'Defines the inputs on which the system is to conduct validity checks.', - 'CCI-002745': - 'Defines the inputs defined in base control (SI-10), which provide a manual override capability for input validation.', - 'CCI-002746': - 'Provide a manual override capability for input validation of organization-defined inputs defined in base control (SI-10).', - 'CCI-002747': - 'Defines the individuals who have the authorization to use the manual override capability for input validation.', - 'CCI-002748': - 'Restrict the use of the manual override capability to only organization-defined authorized individuals.', - 'CCI-002749': 'Audit the use of the manual override capability.', - 'CCI-002750': - 'Defines the time-period within which input validation errors are to be reviewed.', - 'CCI-002751': - 'Defines the time-period within which input validation errors are to be resolved.', - 'CCI-002752': - 'Review input validation errors within an organization-defined time period.', - 'CCI-002753': - 'Resolve input validation errors within an organization-defined time period.', - 'CCI-002754': - 'Verify that the system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.', - 'CCI-002755': - 'Account for timing interactions among system components in determining appropriate responses for invalid inputs.', - 'CCI-002756': - 'Defines the trusted sources to which the usage of information inputs will be restricted (e.g., whitelisting).', - 'CCI-002757': - 'Defines the acceptable formats to which information inputs are restricted.', - 'CCI-002758': - 'Restrict the use of information inputs to organization-defined trusted sources and/or organization-defined formats.', - 'CCI-002759': - 'Defines the personnel or roles to whom error messages are to be revealed.', - 'CCI-002760': - 'Determines mean time to failure (MTTF) for organization-defined system components in specific environments of operation.', - 'CCI-002761': - 'Defines the system components in specific environments of operation for which the mean time to failure (MTTF) is to be determined.', - 'CCI-002762': - 'Defines the mean time to failure (MTTF) substitution criteria to be employed as a means to determine the need to exchange active and standby components.', - 'CCI-002763': - 'Provide a means to exchange active and standby components in accordance with the organization-defined mean time to failure (MTTF) substitution criteria.', - 'CCI-002764': - 'Defines non-persistent system components and services to be implemented.', - 'CCI-002765': - 'Defines the frequency at which the organization-defined non-persistent system components and services will be terminated.', - 'CCI-002766': - 'Implement organization-defined non-persistence system components and services that are initiated in a known state.', - 'CCI-002767': - 'Implement organization-defined non-persistence system components and services that are terminated upon end of session of use and/or periodically at an organization-defined frequency.', - 'CCI-002768': - 'Defines the trusted sources from which it obtains software and data employed during the refreshing of non-persistent system components and services.', - 'CCI-002769': - 'Obtain software and data employed during non-persistent system component and service refreshes are obtained from organization-defined trusted sources.', - 'CCI-002770': - 'Defines the software programs and/or applications from which the system is to validate the information output to ensure the information is consistent with expected content.', - 'CCI-002771': - 'Validate information output from organization-defined software programs and/or applications to ensure that the information is consistent with the expected content.', - 'CCI-002772': - "The organization defines the security safeguards to be implemented to protect the information system's memory from unauthorized code execution.", - 'CCI-002773': - 'Defines the fail-safe procedures to be implemented when organization-defined failure conditions occur.', - 'CCI-002774': - 'Defines the failure conditions which, when they occur, will result in the information system implementing organization-defined fail-safe procedures.', - 'CCI-002775': - 'Implement organization-defined fail-safe procedures when organization-defined failure conditions occur.', - 'CCI-002776': - 'Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level incident response policy is disseminated.', - 'CCI-002777': - 'Defines the personnel or roles to whom the incident response procedures are disseminated.', - 'CCI-002778': - 'Defines the time period in which system users who assume an incident response role or responsibility receive incident response training.', - 'CCI-002779': - 'Provide incident response training to system users consistent with assigned roles and responsibilities when required by system changes.', - 'CCI-002780': - 'Coordinate incident response testing with organizational elements responsible for related plans.', - 'CCI-002781': - 'Defines the system components for dynamic reconfiguration as part of the incident response capability.', - 'CCI-002782': - 'Implement an incident handling capability for incidents involving insider threats.', - 'CCI-002783': - 'The organization coordinates an incident handling capability for insider threats across organization-defined components or elements of the organization.', - 'CCI-002784': - 'The organization defines components or elements of the organization across which an incident handling capability for insider threats will be coordinated.', - 'CCI-002785': - 'Coordinate with organization-defined external organizations to correlate and share organization-defined incident information to achieve a cross-organization perspective on incident awareness and more effective incident responses.', - 'CCI-002786': - 'Defines external organizations with which to correlate and share organization-defined incident information.', - 'CCI-002787': - 'Defines incident information to correlate and share with organization-defined external organizations.', - 'CCI-002788': - 'Employ organization-defined dynamic response capabilities to effectively respond to incidents.', - 'CCI-002789': - 'Defines dynamic response capabilities to effectively respond to incidents.', - 'CCI-002790': - 'Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.', - 'CCI-002791': 'Defines authorities to whom incident information is reported.', - 'CCI-002792': - 'Defines personnel or roles to whom system vulnerabilities associated with reported incident information are reported.', - 'CCI-002793': - 'Provide incident information to other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.', - 'CCI-002794': 'Develop an incident response plan.', - 'CCI-002795': - 'Develop an incident response plan that provides the organization with a roadmap for implementing its incident response capability.', - 'CCI-002796': - 'Develop an incident response plan that describes the structure and organization of the incident response capability.', - 'CCI-002797': - 'Develop an incident response plan that provides a high-level approach for how the incident response capability fits into the overall organization.', - 'CCI-002798': - 'Develop an incident response plan that meets the unique requirements of the organization, which relate to mission, size, structure, and functions.', - 'CCI-002799': - 'Develop an incident response plan that defines reportable incidents.', - 'CCI-002800': - 'Develop an incident response plan that provides metrics for measuring the incident response capability within the organization.', - 'CCI-002801': - 'Develop an incident response plan that defines the resources and management support needed to effectively maintain and mature an incident response capability.', - 'CCI-002802': - 'Defines personnel or roles to review and approve the incident response plan.', - 'CCI-002803': - 'Defines incident response personnel (identified by name and/or by role) and organizational elements to whom incident response plan changes will be communicated.', - 'CCI-002804': - 'Protect the incident response plan from unauthorized disclosure and modification.', - 'CCI-002805': - 'Respond to information spills by identifying the specific information involved in the system contamination.', - 'CCI-002806': - 'Respond to information spills by alerting organization-defined personnel or roles of the information spill using a method of communication not associated with the spill.', - 'CCI-002807': - 'Defines the personnel or roles to be alerted of information spills using a method of communication not associated with the spill.', - 'CCI-002808': - 'Respond to information spills by isolating the contaminated system or system component.', - 'CCI-002809': - 'Respond to information spills by eradicating the information from the contaminated system or component.', - 'CCI-002810': - 'Respond to information spills by identifying other systems or system components that may have been subsequently contaminated.', - 'CCI-002811': - 'Respond to information spills by performing additional organization-defined actions.', - 'CCI-002812': - 'Defines additional actions required to respond to information spills.', - 'CCI-002813': - 'The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.', - 'CCI-002814': - 'The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.', - 'CCI-002815': - 'The organization defines personnel or roles to whom responsibility for responding to information spills will be assigned.', - 'CCI-002816': - 'Provide information spillage response training according to an organization-defined frequency.', - 'CCI-002817': - 'Defines the frequency with which to provide information spillage response training.', - 'CCI-002818': - 'Implement organization-defined procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.', - 'CCI-002819': - 'Defines the procedures to be implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.', - 'CCI-002820': - 'Employ organization-defined controls for personnel exposed to information not within assigned access authorizations.', - 'CCI-002821': - 'Defines the controls to be employed for personnel exposed to information not within assigned access authorizations.', - 'CCI-002822': - 'The organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.', - 'CCI-002823': - 'Defines the controls to be implemented to protect the system memory from unauthorized code execution.', - 'CCI-002824': - 'Implement organization-defined controls to protect the system memory from unauthorized code execution.', - 'CCI-002825': - 'Defines the personnel or roles to whom the organizational-level; mission/business process-level; and/or system-level contingency planning policy is to be disseminated.', - 'CCI-002826': - 'Defines personnel or roles to whom the contingency planning procedures are disseminated.', - 'CCI-002827': - 'Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.', - 'CCI-002828': - 'Identify critical system assets supporting all or essential mission functions.', - 'CCI-002829': - 'Identify critical system assets supporting all or essential business functions.', - 'CCI-002830': - 'Defines the personnel or roles who review and approve the contingency plan for the system.', - 'CCI-002831': - 'Defines a list of key contingency personnel (identified by name and/or by role) and organizational elements to whom contingency plan changes are to be communicated.', - 'CCI-002832': - 'Protects the contingency plan from unauthorized disclosure and modification.', - 'CCI-002833': - 'Defines the time period that contingency training is to be provided to system users consistent with assigned roles and responsibilities within assuming a contingency role or responsibility.', - 'CCI-002834': - 'Provide contingency training to system users consistent with assigned roles and responsibilities when required by system changes.', - 'CCI-002835': - 'Test the contingency plan at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.', - 'CCI-002836': - 'Ensure that the alternate storage site provides security controls equivalent to that of the primary site.', - 'CCI-002837': - 'Plan for circumstances that preclude returning to the primary processing site.', - 'CCI-002838': - 'Prepare for circumstances that preclude returning to the primary processing site.', - 'CCI-002839': - 'Defines system operations that are permitted to transfer and resume at an alternate processing site for essential missions/business functions when the primary processing capabilities are unavailable.', - 'CCI-002840': - 'Defines the system operations to be resumed for essential mission functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.', - 'CCI-002841': - 'Defines the system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.', - 'CCI-002842': - 'Review provider contingency plans to ensure that the plans meet organizational contingency requirements.', - 'CCI-002843': - 'Defines the frequency with which to obtain evidence of contingency testing by providers.', - 'CCI-002844': - 'Defines the frequency with which to obtain evidence of contingency training by providers.', - 'CCI-002845': - 'Obtain evidence of contingency testing by providers in accordance with organization-defined frequency.', - 'CCI-002846': - 'Obtain evidence of contingency training by providers in accordance with organization-defined frequency.', - 'CCI-002847': - 'Defines the frequency with which to test alternate telecommunication services.', - 'CCI-002848': - 'Test alternate telecommunication services per organization-defined frequency.', - 'CCI-002849': - 'Defines critical system software and other security-related information, of which backup copies must be stored in a separate facility or in a fire-rated container.', - 'CCI-002850': - 'Store backup copies of organization-defined critical system software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the operational system.', - 'CCI-002851': - 'Defines the backup information that requires dual authorization for deletion or destruction.', - 'CCI-002852': - 'Enforce dual authorization for the deletion or destruction of organization-defined backup information.', - 'CCI-002853': - 'Provide the capability to employ organization-defined alternative communications protocols in support of maintaining continuity of operations.', - 'CCI-002854': - 'Defines the alternative communications protocols the system must be capable of providing in support of maintaining continuity of operations.', - 'CCI-002855': - 'When organization-defined conditions are detected, enters a safe mode of operation with organization-defined restrictions of safe mode of operation.', - 'CCI-002856': - 'Defines the conditions that, when detected, the system enters a safe mode of operation with organization-defined restrictions of safe mode of operation.', - 'CCI-002857': - 'Defines the restrictions of the safe mode of operation that the system will enter when organization-defined conditions are detected.', - 'CCI-002858': - 'Employ organization-defined alternative or supplemental security mechanisms for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.', - 'CCI-002859': - 'Defines the alternative or supplemental security mechanisms that will be employed for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.', - 'CCI-002860': - 'Defines the security functions that must be satisfied when the primary means of implementing the security function is unavailable or compromised.', - 'CCI-002861': - 'Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level maintenance policy is disseminated.', - 'CCI-002862': - 'Defines the personnel or roles to whom system maintenance procedures are to be disseminated.', - 'CCI-002863': - 'The organization employs automated mechanisms to schedule, conduct, and document repairs.', - 'CCI-002864': - 'Produce up-to date, accurate, and complete records of all maintenance requested, scheduled, in process, and completed.', - 'CCI-002865': - 'Produce up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed.', - 'CCI-002866': - 'Schedule maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-002867': - 'The organization performs maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-002868': - 'Document records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-002869': - 'Review records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-002870': - 'Schedule repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-002871': - 'The organization performs repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-002872': - 'Document repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-002873': - 'Review records of repairs on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-002874': - 'Defines the personnel or roles who can explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repairs or replacement.', - 'CCI-002875': - 'Include organization-defined information in organizational maintenance records.', - 'CCI-002876': - 'Defines the information to include in organizational maintenance records.', - 'CCI-002877': - 'The organization prevents the unauthorized removal of maintenance equipment containing organizational information by verifying that there is no organizational information contained on the equipment.', - 'CCI-002878': - 'The organization prevents the unauthorized removal of maintenance equipment containing organizational information by sanitizing or destroying the equipment.', - 'CCI-002879': - 'The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.', - 'CCI-002880': - 'The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.', - 'CCI-002881': - 'The organization prevents the unauthorized removal of maintenance equipment containing organizational information by obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.', - 'CCI-002882': - 'Defines the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility.', - 'CCI-002883': - 'Restrict the use of maintenance tools to authorized personnel only.', - 'CCI-002884': - 'Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.', - 'CCI-002885': - 'Defines the audit events for logged for nonlocal maintenance and diagnostic sessions.', - 'CCI-002886': - 'Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.', - 'CCI-002887': - 'Defines the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions.', - 'CCI-002888': - 'Defines the personnel or roles authorized to approve each nonlocal maintenance session.', - 'CCI-002889': - 'Notify organization-defined personnel or roles of the date and time of planned nonlocal maintenance.', - 'CCI-002890': - 'Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.', - 'CCI-002891': - 'Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.', - 'CCI-002892': - 'The organization develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.', - 'CCI-002893': - 'Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorization.', - 'CCI-002894': - 'Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations.', - 'CCI-002895': - 'Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.', - 'CCI-002896': - 'Defines the system components for which it obtains maintenance support and/or spare parts.', - 'CCI-002897': - 'Defines a time period for obtaining maintenance support and/or spare parts for organization-defined system components after a failure.', - 'CCI-002898': - 'Perform preventive maintenance on organization-defined information system components at organization-defined time intervals.', - 'CCI-002899': - 'Defines system components on which to perform preventive maintenance.', - 'CCI-002900': - 'Defines time intervals at which to perform preventive maintenance on organization-defined system components.', - 'CCI-002901': - 'Perform predictive maintenance on organization-defined system components at organization-defined intervals.', - 'CCI-002902': - 'Defines system components on which to perform predictive maintenance.', - 'CCI-002903': - 'Defines time intervals at which to perform predictive maintenance on organization-defined system components.', - 'CCI-002904': - 'Transfer predictive maintenance data to a maintenance management system using organization-defined automated mechanisms.', - 'CCI-002905': - 'The organization employs automated mechanisms to schedule, conduct, and document maintenance.', - 'CCI-002906': - 'Defines the vulnerability scanning activities in which the system implements privileged access authorization to organization-identified system components.', - 'CCI-002907': - 'Defines the system mode to be invoked, such as a full system shutdown, a partial system shutdown, or a degraded operational mode with limited mission or business functionality available, in the event of organization-defined audit logging failures.', - 'CCI-002908': - 'Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy is disseminated.', - 'CCI-002909': - 'Defines the personnel or roles to whom the physical and environmental protection procedures are disseminated.', - 'CCI-002910': - 'Approve a list of individuals with authorized access to the facility where the system resides.', - 'CCI-002911': - 'Maintain a list of individuals with authorized access to the facility where the system resides.', - 'CCI-002912': - 'Defines a list of acceptable forms of identification for visitor access to the facility where the system resides.', - 'CCI-002913': - 'Restrict unescorted access to the facility where the system resides to personnel with one or more of the following: security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; organization-defined physical access authorizations.', - 'CCI-002914': - 'Defines the credentials required for personnel to have unescorted access to the facility where the system resides.', - 'CCI-002915': - 'Defines the entry and exit points to the facility where the system resides.', - 'CCI-002916': - 'Defines the physical access control systems or devices or guards that control ingress and egress to the facility where the system resides.', - 'CCI-002917': - 'Maintain physical access audit logs for organization-defined entry/exit points to the facility where the system resides.', - 'CCI-002918': - 'Defines entry and exit points to the facility where the system resides that require physical access audit logs be maintained.', - 'CCI-002919': - 'Control access to areas within the facility designated as publicly accessible by implementing organization-defined access controls.', - 'CCI-002920': - 'Defines physical access controls to control access to areas within the facility designated as publicly accessible.', - 'CCI-002921': - 'Escort visitors in the facility where the system resides during organization-defined circumstances requiring visitor escorts.', - 'CCI-002922': - 'Defines circumstances requiring visitor escorts in the facility where the system resides.', - 'CCI-002923': - 'Monitor visitor activity in the facility where the system resides during organization-defined circumstances requiring visitor monitoring.', - 'CCI-002924': - 'Define circumstances requiring visitor monitoring in the facility where the system resides.', - 'CCI-002925': 'Defines the physical access devices to inventory.', - 'CCI-002926': - 'Defines the physical spaces containing one or more components of the system that require physical access authorizations and controls at the facility where the system resides.', - 'CCI-002927': - 'Defines the frequency with which to perform security checks at the physical boundary of the facility or system for exfiltration of information or removal of system components.', - 'CCI-002928': - 'Defines anti-tamper technologies to detect and prevent physical tampering or alteration of organization-defined hardware components within the system.', - 'CCI-002929': - 'Defines hardware components within the system for which to employ organization-defined security safeguards to detect and prevent physical tampering or alteration.', - 'CCI-002930': - 'Defines system distribution and transmission lines within organizational facilities to control physical access to using organization-defined security controls.', - 'CCI-002931': - 'Defines security controls to control physical access to organization-defined system distribution and transmission lines within organizational facilities.', - 'CCI-002932': - 'The organization controls physical access to output from organization-defined output devices.', - 'CCI-002933': - 'The organization defines output devices for which physical access to output is controlled.', - 'CCI-002934': - 'The organization ensures that only authorized individuals receive output from organization-defined output devices.', - 'CCI-002935': - 'The information system controls physical access to output from organization-defined output devices.', - 'CCI-002936': - 'The information system links individual identity to receipt of output from organization-defined output devices.', - 'CCI-002937': - 'The organization marks organization-defined information system output devices indicating the appropriate security marking of the information permitted to be output from the device.', - 'CCI-002938': - 'The organization defines the information system output devices marked indicating the appropriate security marking of the information permitted to be output from the device.', - 'CCI-002939': - 'Monitor physical access to the facility where the system resides to detect and respond to physical security incidents.', - 'CCI-002940': - 'Review physical access logs upon occurrence of organization-defined events or potential indications of events.', - 'CCI-002941': - 'Defines events or potential indications of events requiring review of physical access logs.', - 'CCI-002942': - 'Recognize organization-defined classes or types of intrusions, using organization-defined automated mechanisms.', - 'CCI-002943': - 'Defines the classes or types of intrusions to recognize using automated mechanisms.', - 'CCI-002944': - 'Initiate organization-defined response actions to organization-defined classes or types of intrusions, using organization-defined automated mechanisms.', - 'CCI-002945': - 'Defines the response actions to initiate when organization-defined classes or types of intrusions are recognized.', - 'CCI-002946': - 'Employ video surveillance of organization-defined operational areas.', - 'CCI-002947': - 'Defines the operational areas in which to employ video surveillance.', - 'CCI-002948': - 'Retain video surveillance recordings for an organization-defined time period.', - 'CCI-002949': - 'Defines the time period to retain video surveillance recordings.', - 'CCI-002950': - 'Monitor physical access to the system in addition to the physical access monitoring of the facility as organization-defined physical spaces containing one or more components of the system.', - 'CCI-002951': - 'Defines physical spaces containing one or more components of the system in which physical access is monitored.', - 'CCI-002952': - 'Defines the time period to maintain visitor access records to the facility where the system resides.', - 'CCI-002953': - 'Employ redundant power cabling paths that are physically separated by an organization-defined distance.', - 'CCI-002954': - 'Defines the distance by which to physically separate redundant power cabling paths.', - 'CCI-002955': - 'Provide an uninterruptible power supply to facilitate an orderly shutdown of the system, and/or transition of the system to long-term alternate power in the event of a primary power source loss.', - 'CCI-002956': - 'Provide an alternate power supply for the system that is activated manually or automatically and that is self-contained.', - 'CCI-002957': - 'Provide an alternate power supply for the system that is activated manually or automatically and that is not reliant on external power generation.', - 'CCI-002958': - 'Provide an alternate power supply for the system that is activated manually or automatically and that is capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source.', - 'CCI-002959': - 'Provide emergency lighting for all areas within the facility supporting essential mission functions.', - 'CCI-002960': - 'Provide emergency lighting for all areas within the facility supporting essential business functions.', - 'CCI-002961': - 'Employ fire detection systems for the system that activate automatically.', - 'CCI-002962': - 'Employ fire detection systems for the system that automatically activate to notify organization-defined personnel or roles and organization-defined emergency responders in the event of a fire.', - 'CCI-002963': - 'Defines the personnel or roles to be notified in the event of a fire.', - 'CCI-002964': - 'Defines the emergency responders to be notified in the event of a fire.', - 'CCI-002965': - 'Employ fire suppression systems that activate automatically and notify organization-defined personnel or roles and organization-defined emergency responders.', - 'CCI-002966': - 'Defines the personnel or roles to be automatically notified of any activation of fire suppression systems.', - 'CCI-002967': - 'Defines the emergency responders to be automatically notified of any activation of fire suppression systems.', - 'CCI-002968': - 'Ensure that the facility undergoes, on an organization-defined frequency, fire protection inspections by authorized and qualified inspectors.', - 'CCI-002969': - 'Defines a frequency with which the facility undergoes fire protection inspections.', - 'CCI-002970': - 'Ensure the identified deficiencies are resolved within an organization-defined time period.', - 'CCI-002971': - 'Defines the time period within which to resolve deficiencies identified during facility fire protection inspections.', - 'CCI-002972': - 'The organization employs automated mechanisms to detect the presence of water in the vicinity of the information system and alerts organization-defined personnel or roles.', - 'CCI-002973': - 'Defines the personnel or roles to be alerted when automated mechanisms detect the presence of water near the system.', - 'CCI-002974': - 'Defines types of system components to authorize and control entering and exiting the facility and to maintain records.', - 'CCI-002975': 'Defines controls to employ at alternate work sites.', - 'CCI-002976': - 'Defines physical and environmental hazards that could cause potential damage to system components within the facility.', - 'CCI-002977': - 'The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards.', - 'CCI-002978': - 'The organization considers the physical and environmental hazards in its risk mitigation strategy for existing facilities.', - 'CCI-002979': - 'Employ organization-defined asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.', - 'CCI-002980': - 'Defines asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.', - 'CCI-002981': - 'Defines the assets within the organization-defined controlled areas which are to be tracked and monitored for their location and movement.', - 'CCI-002982': - 'Defines controlled areas where the location and movement of organization-defined assets are tracked and monitored.', - 'CCI-002983': - 'The organization ensures that asset location technologies are employed in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance.', - 'CCI-002984': - 'Develop an organization-wide information security program plan that reflects the coordination among organizational entities responsible for information security.', - 'CCI-002985': - 'Disseminate an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.', - 'CCI-002986': - 'Disseminate an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-002987': - 'Disseminate an organization-wide information security plan that reflects the coordination among organizational entities responsible for information security.', - 'CCI-002988': - 'Disseminate an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.', - 'CCI-002989': - 'Protect the information security program plan from unauthorized disclosure.', - 'CCI-002990': - 'Protect the information security program plan from unauthorized modification.', - 'CCI-002991': - 'Implement a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed.', - 'CCI-002992': - 'The organization implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems are reported in accordance with OMB FISMA reporting requirements.', - 'CCI-002993': - 'Review plans of action and milestones for the security program and associated organization systems for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.', - 'CCI-002994': - 'Review and update the risk management strategy in accordance with organization-defined frequency or as required, to address organizational changes.', - 'CCI-002995': - 'Defines the frequency with which to review and update the risk management strategy to address organizational changes.', - 'CCI-002996': - 'Implement an insider threat program that includes a cross-discipline insider threat incident handling team.', - 'CCI-002997': - 'Establish a security workforce development and improvement program.', - 'CCI-002998': - 'Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are developed.', - 'CCI-002999': - 'Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are maintained.', - 'CCI-003000': - 'Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are developed.', - 'CCI-003001': - 'Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are maintained.', - 'CCI-003002': - 'Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems are developed.', - 'CCI-003003': - 'Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems are maintained.', - 'CCI-003004': - 'Implement a process for ensuring that organizational plans for conducting security testing associated with organizational systems continue to be executed.', - 'CCI-003005': - 'Implement a process for ensuring that organizational plans for conducting security training associated with organizational systems continue to be executed.', - 'CCI-003006': - 'Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems continue to be executed.', - 'CCI-003007': - 'Review testing plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.', - 'CCI-003008': - 'Review training plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.', - 'CCI-003009': - 'Review monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.', - 'CCI-003010': - 'Establish and institutionalize contact with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel.', - 'CCI-003011': - 'Establish and institutionalize contact with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies.', - 'CCI-003012': - 'Establish and institutionalize contact with selected groups and associations within the security community to share current security information including threats, vulnerabilities, and incidents.', - 'CCI-003013': - 'Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.', - 'CCI-003014': - 'Enforce organization-defined mandatory access control policies over all subjects and objects.', - 'CCI-003015': - 'Specifies that organization-defined subjects may explicitly be granted organization-defined privileges such that they are not limited by any defined subset (or all) of the above constraints.', - 'CCI-003016': - 'The organization, upon termination of individual employment, notifies organization-defined personnel or roles within an organization-defined time period.', - 'CCI-003017': - 'Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level personnel security policy is disseminated.', - 'CCI-003018': - 'Defines the personnel or roles to whom the personnel security procedures are disseminated.', - 'CCI-003019': - 'Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties.', - 'CCI-003020': - 'Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy organization-defined additional personnel screening criteria.', - 'CCI-003021': - 'Defines additional personnel screening criteria that individuals accessing a system processing, storing, or transmitting information requiring protection must satisfy.', - 'CCI-003022': - 'Defines the time period within which to disable system access upon termination of individual employment.', - 'CCI-003023': - 'Upon termination of individual employment, terminate or revoke any authenticators and credentials associated with the individual.', - 'CCI-003024': - 'Defines information security topics to be discussed while conducting exit interviews.', - 'CCI-003025': - 'The organization defines personnel or roles to notify upon termination of individual employment.', - 'CCI-003026': - 'The organization defines the time period within which to notify organization-defined personnel or roles upon termination of individual employment.', - 'CCI-003027': - 'Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information.', - 'CCI-003028': - 'Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.', - 'CCI-003029': - 'Use organization-defined automated mechanisms to notify organization-defined personnel or roles of individual termination actions; and/or disable access to system resources.', - 'CCI-003030': - 'Defines the personnel or roles to be notified by automated mechanism of individual termination actions, and/or disable access to system resources.', - 'CCI-003031': - 'Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.', - 'CCI-003032': - 'Notify organization-defined personnel or roles within an organization-defined time period when individuals are transferred or reassigned to other positions within the organization.', - 'CCI-003033': - 'Defines personnel or roles to be notified when individuals are transferred or reassigned to other positions within the organization.', - 'CCI-003034': - 'Defines the time period within which organization-defined personnel or roles are to be notified when individuals are transferred or reassigned to other positions within the organization.', - 'CCI-003035': - 'Develop and document access agreements for organizational systems.', - 'CCI-003036': - 'The organization ensures that individuals requiring access to organizational information and information systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.', - 'CCI-003037': - 'The organization defines the frequency for individuals requiring access to organization information and information systems to re-sign access agreements.', - 'CCI-003038': - 'Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information.', - 'CCI-003039': - 'Require individuals to sign an acknowledgement of legally binding post-employment requirements for protection of organizational information, if applicable, as part of granting initial access to covered information.', - 'CCI-003040': - 'The organization requires third-party providers to comply with personnel security policies and procedures established by the organization.', - 'CCI-003041': - 'Require external providers to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within an organization-defined time period.', - 'CCI-003042': - 'Defines personnel or roles whom external providers are to notify when external personnel who possess organizational credentials and /or badges or who have system privileges are transferred or terminated.', - 'CCI-003043': - 'Defines the time period for external providers to notify organization-defined personnel or roles when external personnel who possess organizational credentials and/or badges, or who have system privileges are transferred or terminated.', - 'CCI-003044': - 'Notify organization-defined personnel or roles within an organization-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.', - 'CCI-003045': - 'Defines personnel or roles who are to be notified when a formal employee sanctions process is initiated.', - 'CCI-003046': - 'Defines the time period within which to notify organization-defined personnel or roles when a formal employee sanctions process is initiated.', - 'CCI-003047': - 'Defines the personnel or roles to whom the planning policy is disseminated.', - 'CCI-003048': - 'Defines the personnel or roles to whom the planning procedures are disseminated.', - 'CCI-003049': 'Develop security and privacy plans for the system.', - 'CCI-003050': - "Develop security and privacy plans for the system that are consistent with the organization's enterprise architecture.", - 'CCI-003051': - 'Develop security and privacy plans for the system that explicitly defines the authorization boundary for the system.', - 'CCI-003052': - 'Develop security and privacy plans for the system that describes the operational context of the system in terms of missions and business processes.', - 'CCI-003053': - 'Develop security and privacy plans for the system that provide the security categorization of the system, including supporting rationale.', - 'CCI-003054': - 'Develop security and privacy plans for the system that describe the operational environment for the system and any dependencies on or connections to, other systems or system components.', - 'CCI-003055': - 'Develop security and privacy plans for the system that provide an overview of the security and privacy requirements for the system.', - 'CCI-003056': - 'Develop security and privacy plans for the system that identify any relevant control baselines or overlays, if applicable.', - 'CCI-003057': - 'Develop security and privacy plans for the system that describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions.', - 'CCI-003058': - 'The organization distributes copies of the security plan to organization-defined personnel or roles.', - 'CCI-003059': - 'Distribute copies of the plans to organization-defined personnel or roles.', - 'CCI-003060': - 'Defines the personnel or roles to whom copies of the plans are distributed.', - 'CCI-003061': - 'Communicate subsequent changes to the plans to organization-defined personnel or roles.', - 'CCI-003062': - 'Defines the personnel or roles to whom changes to the plans are communicated.', - 'CCI-003063': 'Protect the plans from unauthorized disclosure.', - 'CCI-003064': 'Protect the plans from unauthorized modification.', - 'CCI-003065': - 'The organization plans and coordinates security-related activities affecting the information system with organization-defined individuals or groups before conducting such activities in order to reduce the impact on other organizational entities.', - 'CCI-003066': - 'The organization defines the individuals or groups with whom security-related activities are planned and coordinated.', - 'CCI-003067': - 'The organization defines the individuals or groups with whom security-related activities are planned and coordinated.', - 'CCI-003068': - 'Review and update the rules of behavior in accordance with organization-defined frequency.', - 'CCI-003069': - 'Defines the frequency with which to review and update the rules of behavior.', - 'CCI-003070': - 'Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge, on an organization-defined frequency, and/or when the rules of behavior are revised or updated.', - 'CCI-003071': - 'Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security.', - 'CCI-003072': 'Develop security architectures for the system.', - 'CCI-003073': - 'Develop security architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.', - 'CCI-003074': - 'Develop security architectures for the system that describe how the architectures are integrated into and support the enterprise architecture.', - 'CCI-003075': - 'Develop security architectures for the system that describe any assumptions about, and dependencies on, external systems and services.', - 'CCI-003076': - 'Review and update the architectures in accordance with organization-defined frequency to reflect updates in the enterprise architecture.', - 'CCI-003077': - 'Defines the frequency with which to review and update the system architecture.', - 'CCI-003078': - 'Reflect planned security architecture changes in the security plans.', - 'CCI-003079': - 'Reflect planned security architecture changes in the security Concept of Operations (CONOPS).', - 'CCI-003080': - 'Reflect planned security architecture changes in the security organizational procurements and acquisitions.', - 'CCI-003081': - 'Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations.', - 'CCI-003082': - 'Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers.', - 'CCI-003083': - 'Defines the controls to be allocated to organization-defined locations for the security architecture.', - 'CCI-003084': - 'Defines the controls to be allocated to organization-defined architectural layers.', - 'CCI-003085': - 'Defines the locations to which the system allocates organization-defined controls in the security architecture.', - 'CCI-003086': - 'Defines the architectural layers to which the system allocates organization-defined controls in the security architecture.', - 'CCI-003087': - 'Design the security architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.', - 'CCI-003088': - 'Require that organization-defined controls allocated to organization-defined locations and architectural layers be obtained from different suppliers.', - 'CCI-003089': - 'Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level system and services acquisition policy is disseminated.', - 'CCI-003090': - 'Defines the personnel or roles to whom procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are disseminated.', - 'CCI-003091': - 'Determine the high-level information security requirements for the system or system service in mission and business process planning.', - 'CCI-003092': - 'Defines a system development life cycle that is used to manage the system.', - 'CCI-003093': - 'Integrate the organizational information security risk management process into system development life cycle activities.', - 'CCI-003094': - 'Include the security functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the system, system component, or system service.', - 'CCI-003095': - 'Include the strength of mechanism requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-003096': - 'Include the security assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-003097': - 'Include the security documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-003098': - 'Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-003099': - 'Include the description of the system development environment and environment in which the system is intended to operate, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-003100': - 'Include the acceptance criteria, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-003101': - 'Require the developer of the system, system component, or system service to provide design information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined design information at an organization-defined level of detail.', - 'CCI-003102': - 'Require the developer of the system, system component, or system service to provide implementation information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined implementation information at an organization-defined level of detail.', - 'CCI-003103': - 'Defines the design information that the developer of the system, system component, or system service is required to provide for the controls to be designed.', - 'CCI-003104': - 'Defines the implementation information that the developer of the system, system component, or system service is required to provide for the security controls to be implemented.', - 'CCI-003105': - 'Defines the level of detail for the design information of the controls that is required to be provided by the developer of the information system, system component, or information system services.', - 'CCI-003106': - 'Defines the level of detail for the implementation information of the security controls that is required to be provided by the developer of the information system, system component, or information system services.', - 'CCI-003107': - 'The organization requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes organization-defined state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes.', - 'CCI-003108': - 'The organization defines the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service is required to include when demonstrating the use of a system development life cycle.', - 'CCI-003109': - 'Require the developer of the system, system component, or system service to deliver the system, component, or service with organization-defined security configurations implemented.', - 'CCI-003110': - 'Defines the security configurations required to be implemented when the developer delivers the system, system component, or system service.', - 'CCI-003111': - 'Requires the developer of the system, system component, or system service to use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade.', - 'CCI-003112': - 'Require the developer of the system, system component, or system service to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.', - 'CCI-003113': - 'The organization defines the level of detail to be contained in the plan for the continuous monitoring of security control effectiveness that the developer of the information system, system component, or information system services is required to produce.', - 'CCI-003114': - 'Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.', - 'CCI-003115': - 'The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.', - 'CCI-003116': - 'Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.', - 'CCI-003117': - 'Centrally manage organization-defined controls and related processes.', - 'CCI-003118': - 'Defines the controls and related processes to be centrally managed.', - 'CCI-003119': - 'Employ a technical surveillance countermeasures survey at organization-defined locations on an organization-defined frequency or when organization-defined events or indicators occur.', - 'CCI-003120': - 'Defines the locations where technical surveillance countermeasures surveys are to be employed.', - 'CCI-003121': - 'Defines the frequency on which to employ technical surveillance countermeasures surveys.', - 'CCI-003122': - 'Defines the events or indicators upon which technical surveillance countermeasures surveys are to be employed.', - 'CCI-003123': - 'Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.', - 'CCI-003124': - 'Obtain or develop administrator documentation for the system, system component, or system service that describes secure configuration of the system, component, or service.', - 'CCI-003125': - 'Obtain or develop administrator documentation for the system, system component, or system service that describes secure installation of the system, component, or service.', - 'CCI-003126': - 'Obtain or develop administrator documentation for the system, system component, or system service that describes secure operation of the system, component, or service.', - 'CCI-003127': - 'Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of security functions and mechanisms.', - 'CCI-003128': - 'Obtain or develop administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding configuration and use of administrative or privileged functions.', - 'CCI-003129': - 'Obtain or develop user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms and how to effectively use those functions and mechanisms.', - 'CCI-003130': - 'Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to use the system, component, or service in a more secure manner.', - 'CCI-003131': - 'Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the security of the system, component, or service.', - 'CCI-003132': - 'Take organization-defined actions in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service.', - 'CCI-003133': - 'Defines actions to be taken in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service.', - 'CCI-003134': - 'The organization protects information system, system component, or information system service documentation as required, in accordance with the risk management strategy.', - 'CCI-003135': - 'Distribute system, system component, or system service documentation to organization-defined personnel or roles.', - 'CCI-003136': - 'Defines the personnel or roles to whom system, system component, or system service documentation is to be distributed.', - 'CCI-003137': - 'The organization defines security controls that providers of external information system services employ in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.', - 'CCI-003138': - 'Employ organization-defined processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis.', - 'CCI-003139': - 'Defines processes, methods, and techniques to employ to monitor control compliance by external service providers on an ongoing basis.', - 'CCI-003140': - 'Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services.', - 'CCI-003141': - 'Verify that the acquisition or outsourcing of dedicated information security services is approved by organization-defined personnel or roles.', - 'CCI-003142': - 'Defines the personnel or roles authorized to approve the acquisition or outsourcing of dedicated information security services.', - 'CCI-003143': - 'Require providers of organization-defined external system services to identify the functions, ports, protocols, and other services required for the use of such services.', - 'CCI-003144': - 'Defines the external system services for which the providers are required to identify the functions, ports, protocols, and other services required for the use of such services.', - 'CCI-003145': - 'Establish trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.', - 'CCI-003146': - 'Document trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.', - 'CCI-003147': - 'Maintain trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.', - 'CCI-003148': - 'Defines security requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.', - 'CCI-003149': - 'Take organization-defined actions to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests.', - 'CCI-003150': - 'Defines the actions taken to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests.', - 'CCI-003151': - 'Defines external service providers whose interests are consistent with and reflect organizational interests.', - 'CCI-003152': - 'Restrict the location of information processing, information or data, and/or system services to organization-defined locations based on organization-defined requirements or conditions.', - 'CCI-003153': - 'Defines the locations for which to restrict information processing, information or data, and/or system services based on organization-defined requirements or conditions.', - 'CCI-003154': - 'Defines the requirements or conditions on which to base restricting the location of information processing, information or data, and/or system services to organization-defined locations.', - 'CCI-003155': - 'Require the developer of the system, system component, or system service to perform configuration management during system, component, or service design, development, implementation, operation and/or disposal.', - 'CCI-003156': - 'Require the developer of the system, system component, or system service to document the integrity of changes to organization-defined configuration items under configuration management.', - 'CCI-003157': - 'Require the developer of the system, system component, or system service to manage the integrity of changes to organization-defined configuration items under configuration management.', - 'CCI-003158': - 'Require the developer of the system, system component, or system service to control the integrity of changes to organization-defined configuration items under configuration management.', - 'CCI-003159': - 'Defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.', - 'CCI-003160': - 'Require the developer of the system, system component, or system service to document the potential security impacts of approved changes to the system, component, or service.', - 'CCI-003161': - 'Require the developer of the system, system component, or system service to track security flaws within the system, component, or service.', - 'CCI-003162': - 'Require the developer of the system, system component, or system service to track flaw resolution within the system, component, or service.', - 'CCI-003163': - 'Require the developer of the system, system component, or system service to report findings of security flaws and flaw resolution within the system, component, or service to organization-defined personnel.', - 'CCI-003164': - 'Defines the personnel to whom security flaw findings and flaw resolution within the system, component, or service are reported.', - 'CCI-003165': - 'Require the developer of the system, system component, or system service to enable integrity verification of hardware components.', - 'CCI-003166': - 'Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions.', - 'CCI-003167': - 'Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of source code with previous versions.', - 'CCI-003168': - 'Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of object code with previous versions.', - 'CCI-003169': - 'Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.', - 'CCI-003170': - 'Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.', - 'CCI-003171': - 'Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing security control assessment.', - 'CCI-003172': - 'Require the developer of the system, system component, or system service to implement a plan for ongoing security control assessment.', - 'CCI-003173': - 'Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency, at an organization-defined depth and coverage.', - 'CCI-003174': - 'Defines the depth and coverage at which to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency.', - 'CCI-003175': - 'Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce evidence of the execution of the assessment plan.', - 'CCI-003176': - 'Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce the results of the testing and evaluation.', - 'CCI-003177': - 'Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to implement a verifiable flaw remediation process.', - 'CCI-003178': - 'Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to correct flaws identified during testing/evaluation.', - 'CCI-003179': - 'Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws.', - 'CCI-003180': - 'Require the developer of the system, system component, or system service to document the results of static code analysis.', - 'CCI-003181': - 'Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development.', - 'CCI-003182': - 'Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analysis during subsequent testing and evaluation of the system, component, or service.', - 'CCI-003183': - 'Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer security assessment plan.', - 'CCI-003184': - 'Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during security testing and evaluation.', - 'CCI-003185': - 'Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing and evaluation.', - 'CCI-003186': - 'Verify that the independent agent either is provided with sufficient information to complete the verification process or has been granted the authority to obtain such information.', - 'CCI-003187': - 'Require the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code using organization-defined processes, procedures, and/or techniques.', - 'CCI-003188': - 'Defines the specific code for which the developer of the system, system component, or system service is required to perform a manual code review using organization-defined process, procedures, and/or techniques.', - 'CCI-003189': - 'Defines the processes, procedures, and/or techniques to be used by the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code.', - 'CCI-003190': - 'The organization requires the developer of the information system, system component, or information system service to perform penetration testing at an organization-defined breadth/depth and with organization-defined constraints.', - 'CCI-003191': - 'Defines the breadth and depth at which the developer of the system, system component, or system service is required to perform penetration testing.', - 'CCI-003192': - 'Defines the constraints on penetration testing performed by the developer of the system, system component, or system service.', - 'CCI-003193': - 'Require the developer of the system, system component, or system service to perform attack surface reviews.', - 'CCI-003194': - 'Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of required controls at an organization-defined depth of testing and evaluation.', - 'CCI-003195': - 'Defines the depth of testing and evaluation to which the developer of the system, system component, or system service is required to verify that the scope of security testing and evaluation provides complete coverage of the required controls.', - 'CCI-003196': - 'Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws.', - 'CCI-003197': - 'Require the developer of the system, system component, or system service to document the results of the dynamic code analysis.', - 'CCI-003198': - 'The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.', - 'CCI-003199': - 'The organization defines tailored acquisition strategies, contract tools, and procurement methods to employ for the purchase of the information system, system component, or information system service from suppliers.', - 'CCI-003200': - 'The organization conducts a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service.', - 'CCI-003201': - 'The organization employs organization-defined security safeguards to limit harm from potential adversaries identifying and targeting the organizational supply chain.', - 'CCI-003202': - 'The organization defines security safeguards to employ to limit harm from potential adversaries identifying and targeting the organizational supply chain.', - 'CCI-003203': - 'The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update.', - 'CCI-003204': - 'The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update.', - 'CCI-003205': - 'The organization uses all-source intelligence analysis of suppliers and potential suppliers of the information system, system component, or information system service.', - 'CCI-003206': - 'The organization employs organization-defined Operations Security (OPSEC) safeguards in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.', - 'CCI-003207': - 'The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.', - 'CCI-003208': - 'The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.', - 'CCI-003209': - 'The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.', - 'CCI-003210': - 'The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.', - 'CCI-003211': - 'The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.', - 'CCI-003212': - 'The organization employs organization-defined security safeguards to validate that the information system or system component received is genuine and has not been altered.', - 'CCI-003213': - 'The organization defines the security safeguards to be employed to validate that the information system or system component received is genuine and has not been altered.', - 'CCI-003214': - 'The organization employs organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of organization-defined supply chain elements, processes, and actors associated with the information system, system component, or information system service.', - 'CCI-003215': - 'The organization defines the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing.', - 'CCI-003216': - 'The organization establishes inter-organizational agreements with entities involved in the supply chain for the information system, system component, or information system service.', - 'CCI-003217': - 'The organization establishes inter-organizational procedures with entities involved in the supply chain for the information system, system component, or information system service.', - 'CCI-003218': - 'The organization employs organization-defined security safeguards to ensure an adequate supply of organization-defined critical information system components.', - 'CCI-003219': - 'The organization defines the security safeguards to be employed to ensure an adequate supply of organization-defined critical information system components.', - 'CCI-003220': - 'The organization defines the critical information system components for which organization-defined security safeguards are employed to ensure adequate supply.', - 'CCI-003221': - 'The organization establishes unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service.', - 'CCI-003222': - 'The organization retains unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service.', - 'CCI-003223': - 'The organization defines the supply chain elements, processes, and actors for the information system, system component, or information system service to establish and retain unique identification.', - 'CCI-003224': - 'The organization establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements.', - 'CCI-003225': - 'The organization describes the trustworthiness required in the organization-defined information system, information system component, or information system service supporting its critical missions/business functions.', - 'CCI-003226': - 'The organization defines the information system, information system component, or information system service supporting its critical missions/business functions in which the trustworthiness must be described.', - 'CCI-003227': - 'The organization implements an organization-defined assurance overlay to achieve trustworthiness required to support its critical missions/business functions.', - 'CCI-003228': - 'The organization defines an assurance overlay to be implemented to achieve trustworthiness required to support its critical missions/business functions.', - 'CCI-003229': - 'The organization identifies critical information system components by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle.', - 'CCI-003230': - 'The organization identifies critical information system functions by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle.', - 'CCI-003231': - 'The organization defines the information systems, information system components, or information system services for which the organization identifies critical information system components and functions for criticality analysis.', - 'CCI-003232': - 'The organization defines the decision points in the system development life cycle at which to perform a criticality analysis to identify critical information system components and functions for organization-defined information systems, information system components, or information system services.', - 'CCI-003233': - 'Require the developer of the system, system component, or system service to follow a documented development process.', - 'CCI-003234': - 'Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses security requirements.', - 'CCI-003235': - 'Require the developer of the system, system component, or system service to follow a documented development process that identifies the standards used in the development process.', - 'CCI-003236': - 'Require the developer of the system, system component, or system service to follow a documented development process that identifies the tools used in the development process.', - 'CCI-003237': - 'Require the developer of the system, system component, or system service to follow a documented development process that documents the specific tool options and tool configurations used in the development process.', - 'CCI-003238': - 'Require the developer of the system, system component, or system service to follow a documented development process that documents changes to the process and/or tools used in development.', - 'CCI-003239': - 'Require the developer of the system, system component, or system service to follow a documented development process that manages changes to the process and/or tools used in development.', - 'CCI-003240': - 'Require the developer of the system, system component, or system service to follow a documented development process that ensures the integrity of changes to the process and/or tools used in development.', - 'CCI-003241': - 'Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined security requirements.', - 'CCI-003242': - 'Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined security requirements.', - 'CCI-003243': - 'Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined security requirements.', - 'CCI-003244': - 'Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined security requirements.', - 'CCI-003245': - 'Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined security requirements.', - 'CCI-003246': - 'Defines the security requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations.', - 'CCI-003247': - 'Require the developer of the system, system component, or system service to define quality metrics at the beginning of the development process.', - 'CCI-003248': - 'Require the developer of the system, system component, or system service to provide evidence of meeting the quality metrics in accordance with organization-defined frequency, organization-defined program review milestones, and/or upon delivery.', - 'CCI-003249': - 'Defines the frequency on which the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics.', - 'CCI-003250': - 'Defines the program review milestones at which the developer of the information system, system component, or information system service is required to provide evidence of meeting the quality metrics.', - 'CCI-003251': - 'Require the developer of the system, system component, or system service to select a security tracking tool for use during the development process.', - 'CCI-003252': - 'Require the developer of the system, system component, or system service to employ a security tracking tool for use during the development process.', - 'CCI-003253': - 'The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at an organization-defined breadth/depth and at organization-defined decision points in the system development life cycle.', - 'CCI-003254': - 'Defines the breadth/depth of criticality analysis at which the developer of the system, system component, or system service is required to perform a criticality analysis.', - 'CCI-003255': - 'Defines decision points in the system development life cycle at which the developer of the system, system component, or system service is required to perform a criticality analysis.', - 'CCI-003256': - 'The organization requires that developers perform threat modeling for the information system at an organization-defined breadth/depth.', - 'CCI-003257': - 'The organization requires that developers perform a vulnerability analysis for the information system at an organization-defined breadth/depth.', - 'CCI-003258': - 'The organization defines the breadth/depth at which threat modeling for the information system must be performed by developers.', - 'CCI-003259': - 'The organization defines the breadth/depth at which vulnerability analysis for the information system must be performed by developers.', - 'CCI-003260': - 'Threat modeling performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.', - 'CCI-003261': - 'Vulnerability analysis performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.', - 'CCI-003262': - 'The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform threat modeling for the information system by the developer.', - 'CCI-003263': - 'The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform a vulnerability analysis for the information system by the developer.', - 'CCI-003264': - 'The organization requires the threat modeling performed by the developers employ organization-defined tools and methods.', - 'CCI-003265': - 'The organization requires the vulnerability analysis performed by the developers employ organization-defined tools and methods.', - 'CCI-003266': - 'The organization defines tools and methods to be employed to perform threat modeling for the information system by the developer.', - 'CCI-003267': - 'The organization defines tools and methods to be employed to perform a vulnerability analysis for the information system by the developer.', - 'CCI-003268': - 'The organization requires that developers performing threat modeling for the information system produce evidence that meets organization-defined acceptance criteria.', - 'CCI-003269': - 'The organization requires that developers performing vulnerability analysis for the information system produce evidence that meets organization-defined acceptance criteria.', - 'CCI-003270': - 'The organization defines the acceptance criteria that must be met when threat modeling of the information system is performed by the developer.', - 'CCI-003271': - 'The organization defines the acceptance criteria that must be met when vulnerability analysis of the information system is performed by the developer.', - 'CCI-003272': - 'Require the developer of the system, system component, or system service to reduce attack surfaces to organization-defined thresholds.', - 'CCI-003273': - 'Defines the thresholds to which the developer of the system, system component, or system service is required to reduce attack surfaces.', - 'CCI-003274': - 'Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.', - 'CCI-003275': - 'Require the developer of the system, system component, or system services, on an organization-defined frequency, to perform an automated vulnerability analysis using organization-defined tools.', - 'CCI-003276': - 'Defines the tools the developer of the system, system component, or system services uses to perform an automated vulnerability analysis.', - 'CCI-003277': - 'Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine the exploitation potential for discovered vulnerabilities.', - 'CCI-003278': - 'Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine potential risk mitigations for delivered vulnerabilities.', - 'CCI-003279': - 'Require the developer of the system, system component, or system services, on an organization-defined frequency, to deliver the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles.', - 'CCI-003280': - 'Defines the personnel or roles to whom the outputs of the tools and results of the vulnerability analysis are delivered.', - 'CCI-003281': - 'Require the developer of the system, system component, or system service to use threat modeling from similar systems, components, or services to inform the current development process.', - 'CCI-003282': - 'Require the developer of the system, system component, or system service to use vulnerability analysis from similar systems, components, or services to inform the current development process.', - 'CCI-003283': - 'The organization approves the use of live data in development environments for the information system, system component, or information system service.', - 'CCI-003284': - 'The organization approves the use of live data in test environments for the information system, system component, or information system service.', - 'CCI-003285': - 'The organization documents the use of live data in development environments for the information system, system component, or information system service.', - 'CCI-003286': - 'The organization documents the use of live data in test environments for the information system, system component, or information system service.', - 'CCI-003287': - 'The organization controls the use of live data in development environments for the information system, system component, or information system service.', - 'CCI-003288': - 'The organization controls the use of live data in test environments for the information system, system component, or information system service.', - 'CCI-003289': - 'Require the developer of the system, system component, or system service to provide an incident response plan.', - 'CCI-003290': - 'Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review.', - 'CCI-003291': - 'Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented security functions, controls, and/or mechanisms.', - 'CCI-003292': - 'Defines the training the developer of the system, system component, or system service is required to provide on the correct use and operation of the implemented security functions, controls, and/or mechanisms.', - 'CCI-003293': - 'Require the developer of the system, system component, or system service to produce a design specification and security architecture.', - 'CCI-003294': - "Require the developer of the system, system component, or system service to produce a design specification and security architecture that is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture.", - 'CCI-003295': - 'Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the required security functionality.', - 'CCI-003296': - 'Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the allocation of security controls among physical and logical components.', - 'CCI-003297': - 'Require the developer of the system, system component, or system service to produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.', - 'CCI-003298': - 'Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational security policy to be enforced.', - 'CCI-003299': - 'Defines the elements of organizational security policy to be described in the formal policy model for enforcement on the system, system component, or system service.', - 'CCI-003300': - 'Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.', - 'CCI-003301': - 'Require the developer of the system, system component, or system service to define security-relevant hardware.', - 'CCI-003302': - 'The organization requires the developer of the information system, system component, or information system service to define security-relevant hardware.', - 'CCI-003303': - 'Require the developer of the system, system component, or system service to define security-relevant software.', - 'CCI-003304': - 'Require the developer of the system, system component, or system service to define security-relevant firmware.', - 'CCI-003305': - 'Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant hardware is complete.', - 'CCI-003306': - 'Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant software is complete.', - 'CCI-003307': - 'Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant firmware is complete.', - 'CCI-003308': - 'Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.', - 'CCI-003309': - 'Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.', - 'CCI-003310': - 'Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.', - 'CCI-003311': - 'Require the developer of the system, system component, or system service to show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model.', - 'CCI-003312': - 'Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware.', - 'CCI-003313': - 'Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant software.', - 'CCI-003314': - 'Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant firmware.', - 'CCI-003315': - 'Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware.', - 'CCI-003316': - 'Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant software.', - 'CCI-003317': - 'Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant firmware.', - 'CCI-003318': - 'Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware.', - 'CCI-003319': - 'Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant software.', - 'CCI-003320': - 'Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant firmware.', - 'CCI-003321': - 'Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.', - 'CCI-003322': - 'Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.', - 'CCI-003323': - 'Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.', - 'CCI-003324': - 'Require the developer of the system, system component, or system service to show via informal demonstration or convincing argument with formal methods as feasible that the descriptive top-level specification is consistent with the formal policy model.', - 'CCI-003325': - 'Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware.', - 'CCI-003326': - 'Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant software.', - 'CCI-003327': - 'Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant firmware.', - 'CCI-003328': - 'Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware.', - 'CCI-003329': - 'Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant software.', - 'CCI-003330': - 'Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware.', - 'CCI-003331': - 'Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware.', - 'CCI-003332': - 'Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant software.', - 'CCI-003333': - 'Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant firmware.', - 'CCI-003334': - 'Require the developer of the system, system component, or system service to design and structure the security-relevant hardware to use a complete, conceptually simple protection mechanism with precisely defined semantics.', - 'CCI-003335': - 'Require the developer of the system, system component, or system service to design and structure the security-relevant software to use a complete, conceptually simple protection mechanism with precisely defined semantics.', - 'CCI-003336': - 'Require the developer of the system, system component, or system service to design and structure the security-relevant firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.', - 'CCI-003337': - 'Require the developer of the system, system component, or system service to internally structure the security-relevant hardware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.', - 'CCI-003338': - 'Require the developer of the system, system component, or system service to internally structure the security-relevant software with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.', - 'CCI-003339': - 'Require the developer of the system, system component, or system service to internally structure the security-relevant firmware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.', - 'CCI-003340': - 'Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate testing.', - 'CCI-003341': - 'Require the developer of the system, component, or system service to structure security-relevant software to facilitate testing.', - 'CCI-003342': - 'Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate testing.', - 'CCI-003343': - 'Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate controlling access with least privilege.', - 'CCI-003344': - 'Require the developer of the system, component, or system service to structure security-relevant software to facilitate controlling access with least privilege.', - 'CCI-003345': - 'Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate controlling access with least privilege.', - 'CCI-003346': - 'The organization implements a tamper protection program for the information system, system component, or information system service.', - 'CCI-003347': - 'The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including design.', - 'CCI-003348': - 'The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including development.', - 'CCI-003349': - 'The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including integration.', - 'CCI-003350': - 'The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including operations.', - 'CCI-003351': - 'The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including maintenance.', - 'CCI-003352': - 'The organization inspects organization-defined information systems, system components, or devices at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.', - 'CCI-003353': - 'The organization defines the information systems, system components, or devices to inspect at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.', - 'CCI-003354': - 'The organization defines the frequency on which to inspect organization-defined information systems, system components, or devices to detect tampering.', - 'CCI-003355': - 'The organization defines indications of need for inspection to detect tampering during inspections of organization-defined information systems, system components, or devices.', - 'CCI-003356': - 'The organization develops an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.', - 'CCI-003357': - 'The organization develops an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.', - 'CCI-003358': - 'The organization develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.', - 'CCI-003359': - 'The organization develops anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.', - 'CCI-003360': - 'The organization implements an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.', - 'CCI-003361': - 'The organization implements an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.', - 'CCI-003362': - 'The organization implements anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.', - 'CCI-003363': - 'The organization implements anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.', - 'CCI-003364': - 'The organization reports counterfeit information system components to the source of the counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles.', - 'CCI-003365': - 'The organization defines the external reporting organizations to which counterfeit information system components are to be reported.', - 'CCI-003366': - 'The organization defines the personnel or roles to whom counterfeit information system components are to be reported.', - 'CCI-003367': - 'The organization trains organization-defined personnel or roles to detect counterfeit information system components (including hardware, software, and firmware).', - 'CCI-003368': - 'The organization defines the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware).', - 'CCI-003369': - 'The organization maintains configuration control over organization-defined information system components awaiting service/repair.', - 'CCI-003370': - 'The organization defines the information system components awaiting service/repair over which configuration control must be maintained.', - 'CCI-003371': - 'The organization maintains configuration control over serviced/repaired components awaiting return to service.', - 'CCI-003372': - 'Define the support from external providers to be provided for alternative sources for continued support for unsupported system components.', - 'CCI-003373': - 'Provide in-house support and/or organization-defined support from external providers for alternative sources for continued support for unsupported components.', - 'CCI-003374': - 'The organization documents approval for the continued use of unsupported system components required to satisfy mission/business needs.', - 'CCI-003375': - 'The organization provides justification for the continued use of unsupported system components required to satisfy mission/business needs.', - 'CCI-003376': - 'Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.', - 'CCI-003377': - 'The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied.', - 'CCI-003378': - 'The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied.', - 'CCI-003379': - 'The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required screening criteria are satisfied.', - 'CCI-003380': - 'The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required access authorizations are satisfied.', - 'CCI-003381': - 'Defines additional personnel screening criteria that must be satisfied by the developer of an organization-defined system, system component, or system service.', - 'CCI-003382': - 'Require that the developer of an organization-defined system, system component, or system service satisfies organization-defined additional personnel screening criteria.', - 'CCI-003383': - 'Defines the official government duties to be assigned to the developer of an organization-defined system, system component, or system service.', - 'CCI-003384': - 'Defines the system, system component, or system service which requires the system developer to have appropriate access authorizations, satisfy additional personnel screening criteria, and provide information that the access authorizations and screening criteria are satisfied.', - 'CCI-003385': - 'Require that the developer of an organization-defined system, system component, or system service has appropriate access authorizations as determined by assigned organization-defined official government duties.', - 'CCI-003386': - 'Defines the critical system components to re-implement or custom develop.', - 'CCI-003387': - 'Re-implement or custom develops organization-defined critical system components.', - 'CCI-003388': - 'The organization defines the frequency on which to scan for counterfeit information system components.', - 'CCI-003389': - 'The organization scans for counterfeit information system components in accordance with organization-defined frequency.', - 'CCI-003390': - 'The organization defines the techniques and methods used to dispose of information system components.', - 'CCI-003391': - 'The organization disposes of information system components using organization-defined techniques and methods.', - 'CCI-003392': - 'The organization determines and documents the legal authority that permits the collection of personally identifiable information (PII), either generally or in support of a specific program or information system need.', - 'CCI-003393': - 'The organization determines and documents the legal authority that permits the use of personally identifiable information (PII), either generally or in support of a specific program or information system need.', - 'CCI-003394': - 'The organization determines and documents the legal authority that permits the maintenance of personally identifiable information (PII), either generally or in support of a specific program or information system need.', - 'CCI-003395': - 'The organization determines and documents the legal authority that permits the sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need.', - 'CCI-003396': - 'The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is collected.', - 'CCI-003397': - 'The organization appoints a Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) accountable for developing, implementing, and maintaining an organization-wide governance and privacy program to ensure compliance with all applicable laws and regulations regarding the collection, use, maintenance, sharing, and disposal of personally identifiable information (PII) by programs and information systems.', - 'CCI-003398': - 'The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is used.', - 'CCI-003399': - 'The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is maintained.', - 'CCI-003400': - 'The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is shared.', - 'CCI-003401': - 'The organization monitors federal privacy laws and policy for changes that affect the privacy program.', - 'CCI-003402': - 'The organization defines the allocation of budget resources sufficient to implement and operate the organization-wide privacy program.', - 'CCI-003403': - 'The organization defines the allocation of staffing resources sufficient to implement and operate the organization-wide privacy program.', - 'CCI-003404': - 'The organization allocates sufficient organization-defined budget resources to implement and operate the organization-wide privacy program.', - 'CCI-003405': - 'The organization allocates sufficient organization-defined staffing resources to implement and operate the organization-wide privacy program.', - 'CCI-003406': - 'The organization develops a strategic organizational privacy plan for implementing applicable privacy controls, policies, and procedures.', - 'CCI-003407': - 'The organization develops operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).', - 'CCI-003408': - 'The organization disseminates operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).', - 'CCI-003409': - 'The organization implements operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).', - 'CCI-003410': - 'The organization develops operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).', - 'CCI-003411': - 'The organization disseminates operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).', - 'CCI-003412': - 'The organization implements operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).', - 'CCI-003413': - 'The organization defines the frequency, minimally biennially, on which the privacy plan, policies, and procedures are to be updated.', - 'CCI-003414': - 'The organization updates the privacy plan per organization-defined frequency.', - 'CCI-003415': - 'The organization updates the privacy policies per organization-defined frequency.', - 'CCI-003416': - 'The organization updates the privacy procedures per organization-defined frequency.', - 'CCI-003417': - 'The organization documents a privacy risk management process which assesses the privacy risk to individuals.', - 'CCI-003418': - 'The organization implements a privacy risk management process which assesses the privacy risk to individuals.', - 'CCI-003419': - "The organization's privacy risk management process assesses the privacy risk to individuals resulting from the collection of personally identifiable information (PII).", - 'CCI-003420': - "The organization's privacy risk management process assesses the privacy risk to individuals resulting from the sharing of personally identifiable information (PII).", - 'CCI-003421': - "The organization's privacy risk management process assesses the privacy risk to individuals resulting from the storing of personally identifiable information (PII).", - 'CCI-003422': - "The organization's privacy risk management process assesses the privacy risk to individuals resulting from the transmitting of personally identifiable information (PII).", - 'CCI-003423': - "The organization's privacy risk management process assesses the privacy risk to individuals resulting from the use of personally identifiable information (PII).", - 'CCI-003424': - "The organization's privacy risk management process assesses the privacy risk to individuals resulting from the disposal of personally identifiable information (PII).", - 'CCI-003425': - 'The organization conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.', - 'CCI-003426': 'The organization establishes privacy roles for contractors.', - 'CCI-003427': - 'The organization establishes privacy responsibilities for contractors.', - 'CCI-003428': - 'The organization establishes access requirements for contractors.', - 'CCI-003429': - 'The organization establishes privacy roles for service providers.', - 'CCI-003430': - 'The organization establishes privacy responsibilities for service providers.', - 'CCI-003431': - 'The organization establishes access requirements for service providers.', - 'CCI-003432': 'The organization includes privacy requirements in contracts.', - 'CCI-003433': - 'The organization includes privacy requirements in other acquisition-related documents.', - 'CCI-003434': - 'The organization defines the frequency for monitoring privacy controls and internal privacy policy to ensure effective implementation.', - 'CCI-003435': - 'The organization defines the frequency for auditing privacy controls and internal privacy policy to ensure effective implementation.', - 'CCI-003436': - 'The organization monitors privacy controls, per organization-defined frequency, to ensure effective implementation.', - 'CCI-003437': - 'The organization monitors internal privacy policy to ensure effective implementation.', - 'CCI-003438': - 'The organization audits privacy controls, per organization-defined frequency, to ensure effective implementation.', - 'CCI-003439': - 'The organization audits internal privacy policy, per organization-defined frequency, to ensure effective implementation.', - 'CCI-003440': - 'The organization develops a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.', - 'CCI-003441': - 'The organization implements a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.', - 'CCI-003442': - 'The organization updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.', - 'CCI-003443': - 'The organization defines the frequency, minimally annually, for administering its basic privacy training.', - 'CCI-003444': - 'The organization defines the frequency, minimally annually, for administering the targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII.', - 'CCI-003445': - 'The organization administers basic privacy training per the organization-defined frequency.', - 'CCI-003446': - 'The organization administers, per organization-defined frequency, targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII.', - 'CCI-003447': - 'The organization defines the frequency, minimally annually, on which personnel certify acceptance of responsibilities for privacy requirements.', - 'CCI-003448': - 'The organization ensures personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements per organization-defined frequency.', - 'CCI-003449': - 'The organization develops reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.', - 'CCI-003450': - 'The organization disseminates reports to the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.', - 'CCI-003451': - 'The organization updates reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.', - 'CCI-003452': - 'The organization develops reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.', - 'CCI-003453': - 'The organization disseminates reports to senior management and other personnel with responsibility for monitoring privacy program progress and compliance.', - 'CCI-003454': - 'The organization updates reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.', - 'CCI-003455': - 'The organization designs information systems to support privacy by automating privacy controls.', - 'CCI-003456': - 'The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the date of each disclosure of a record.', - 'CCI-003457': - 'The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the nature of each disclosure of a record.', - 'CCI-003458': - 'The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the purpose of each disclosure of a record.', - 'CCI-003459': - 'The organization keeps an accurate accounting of disclosures of Privacy Act information held in each system of records under its control.', - 'CCI-003460': - 'The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the name and address of the person or agency to which the disclosure was made.', - 'CCI-003461': - 'The organization retains the accounting of disclosures for the life of the record or five years after the disclosure is made, whichever is longer.', - 'CCI-003462': - 'The organization makes the accounting of disclosures available to the person named in the record upon request.', - 'CCI-003463': - 'The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the accuracy of that information.', - 'CCI-003464': - 'The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the relevancy of that information.', - 'CCI-003465': - 'The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the timeliness of that information.', - 'CCI-003466': - 'The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the completeness of that information.', - 'CCI-003467': - 'The organization collects personally identifiable information (PII) directly from the individual to the greatest extent practicable.', - 'CCI-003468': - 'The organization defines the frequency on which it will check for, and correct as necessary, inaccurate or outdated personally identifiable information (PII) used by its programs or systems.', - 'CCI-003469': - 'The organization checks for, and corrects as necessary, any inaccurate or outdated personally identifiable information (PII) used by its programs or systems on an organization-defined frequency.', - 'CCI-003470': - 'The organization issues guidelines ensuring the quality of disseminated Privacy Act information.', - 'CCI-003471': - 'The organization issues guidelines ensuring the utility of disseminated Privacy Act information.', - 'CCI-003472': - 'The organization issues guidelines ensuring the objectivity of disseminated Privacy Act information.', - 'CCI-003473': - 'The organization issues guidelines ensuring the integrity of disseminated Privacy Act information.', - 'CCI-003474': - 'The organization issues guidelines maximizing the quality of disseminated Privacy Act information.', - 'CCI-003475': - 'The organization issues guidelines maximizing the utility of disseminated Privacy Act information.', - 'CCI-003476': - 'The organization issues guidelines maximizing the objectivity of disseminated Privacy Act information.', - 'CCI-003477': - 'The organization issues guidelines maximizing the integrity of disseminated Privacy Act information.', - 'CCI-003478': - "The organization requests the individual or individual's authorized representative validate personally identifiable information (PII) during the collection process.", - 'CCI-003479': - "The organization defines the frequency on which it will request the individual, or individual's authorized representative, revalidate that personally identifiable information (PII) collected is still accurate.", - 'CCI-003480': - "On an organization-defined frequency, the organization requests the individual, or individual's authorized representative, revalidate that personally identifiable information (PII) collected is still accurate.", - 'CCI-003481': - 'The organization documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls.', - 'CCI-003482': - 'The organization, when appropriate, establishes a Data Integrity Board.', - 'CCI-003483': - "The organization's Data Integrity Board oversees the organizational Computer Matching Agreements.", - 'CCI-003484': - "The organization's Data Integrity Board ensures the Computer Matching Agreements comply with the computer matching provisions of the Privacy Act.", - 'CCI-003485': - 'The organization publishes Computer Matching Agreements on its public website.', - 'CCI-003486': - 'The organization identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection.', - 'CCI-003487': - 'The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes described in the published privacy notice.', - 'CCI-003488': - 'The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes which the individual has provided consent.', - 'CCI-003489': - 'The organization defines the frequency, minimally annually, for conducting reviews of its personally identifiable information (PII) holdings.', - 'CCI-003490': - 'The organization conducts an initial evaluation of personally identifiable information (PII) holdings.', - 'CCI-003491': - 'The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained.', - 'CCI-003492': - 'The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained.', - 'CCI-003493': - 'The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose.', - 'CCI-003494': - 'The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose.', - 'CCI-003495': - 'The organization, where feasible and within the limits of technology, locates and removes/redacts specified personally identifiable information (PII).', - 'CCI-003496': - 'The organization, where feasible and within the limits of technology, uses anonymization and de-identification techniques to permit use of the retained Privacy Act information while reducing its sensitivity and reducing the risk resulting from disclosure.', - 'CCI-003497': - 'The organization defines the time period for retaining each collection of personally identifiable information (PII) that is required to fulfill the purpose(s) identified in the published privacy notice or required by law.', - 'CCI-003498': - 'The organization retains each collection of personally identifiable information (PII) for the organization-defined time period to fulfill the purpose(s) identified in the published privacy notice or as required by law.', - 'CCI-003499': - 'The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in accordance with a NARA-approved record retention schedule.', - 'CCI-003500': - 'The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in a manner that prevents loss, theft, misuse, or unauthorized access.', - 'CCI-003501': - 'The organization defines the techniques or methods to be employed to ensure the secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records).', - 'CCI-003502': - 'The organization uses organization-defined techniques or methods to ensure secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records).', - 'CCI-003503': - 'The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is collected, created, or updated.', - 'CCI-003504': - 'The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is created.', - 'CCI-003505': - 'The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is updated.', - 'CCI-003506': - 'The organization, where feasible, configures its information systems to record when personally identifiable information (PII) is to be deleted or archived under an approved record retention schedule.', - 'CCI-003507': - 'The organization develops policies that minimize the use of personally identifiable information (PII) for testing.', - 'CCI-003508': - 'The organization develops policies that minimize the use of personally identifiable information (PII) for training.', - 'CCI-003509': - 'The organization develops policies that minimize the use of personally identifiable information (PII) for research.', - 'CCI-003510': - 'The organization develops procedures that minimize the use of personally identifiable information (PII) for testing.', - 'CCI-003511': - 'The organization develops procedures that minimize the use of personally identifiable information (PII) for training.', - 'CCI-003512': - 'The organization develops procedures that minimize the use of personally identifiable information (PII) for research.', - 'CCI-003513': - 'The organization implements controls to protect personally identifiable information (PII) used for testing.', - 'CCI-003514': - 'The organization implements controls to protect personally identifiable information (PII) used for training.', - 'CCI-003515': - 'The organization implements controls to protect personally identifiable information (PII) used for research.', - 'CCI-003516': - 'The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for research.', - 'CCI-003517': - 'The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for testing.', - 'CCI-003518': - 'The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for training.', - 'CCI-003519': - 'The organization provides means, where feasible and appropriate, for individuals to authorize the collection of personally identifiable information (PII) prior to its collection.', - 'CCI-003520': - 'The organization provides means, where feasible and appropriate, for individuals to authorize the use of personally identifiable information (PII) prior to its collection.', - 'CCI-003521': - 'The organization provides means, where feasible and appropriate, for individuals to authorize the maintaining of personally identifiable information (PII) prior to its collection.', - 'CCI-003522': - 'The organization provides means, where feasible and appropriate, for individuals to authorize sharing of personally identifiable information (PII) prior to its collection.', - 'CCI-003523': - 'The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection of personally identifiable information (PII).', - 'CCI-003524': - 'The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the use of personally identifiable information (PII).', - 'CCI-003525': - 'The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the dissemination of personally identifiable information (PII).', - 'CCI-003526': - 'The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the retention of personally identifiable information (PII).', - 'CCI-003527': - 'The organization obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected personally identifiable information (PII).', - 'CCI-003528': - 'The organization ensures that individuals are aware of all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII.', - 'CCI-003529': - 'The organization ensures that individuals, where feasible, consent to all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII.', - 'CCI-003530': - 'The organization implements mechanisms to support itemized or tiered consent for specific uses of personally identifiable information (PII) data.', - 'CCI-003531': - 'The organization provides individuals the ability to have access to their personally identifiable information (PII) maintained in its system(s) of records.', - 'CCI-003532': - 'The organization publishes rules and regulations governing how individuals may request access to records maintained in a Privacy Act system of records.', - 'CCI-003533': - 'The organization publishes regulations governing how individuals may request access to records maintained in a Privacy Act system of records.', - 'CCI-003534': - 'The organization publishes access procedures for Privacy Act systems of records in System of Records Notices (SORNs).', - 'CCI-003535': - 'The organization adheres to Privacy Act requirements for the proper processing of Privacy Act requests.', - 'CCI-003536': - 'The organization adheres to OMB policies and guidance for the proper processing of Privacy Act requests.', - 'CCI-003537': - 'The organization provides a process for individuals to have inaccurate personally identifiable information (PII) maintained by the organization corrected or amended, as appropriate.', - 'CCI-003538': - 'The organization establishes a process for disseminating corrections or amendments of the personally identifiable information (PII) to other authorized users of the PII, such as external information-sharing partners.', - 'CCI-003539': - 'The organization establishes a process, where feasible and appropriate, to notify affected individuals that their personally identifiable information (PII) information has been corrected or amended.', - 'CCI-003540': - 'The organization implements a process for receiving complaints, concerns, or questions from individuals about the organizational privacy practices.', - 'CCI-003541': - 'The organization implements a process for responding to complaints, concerns, or questions from individuals about the organizational privacy practices.', - 'CCI-003542': - 'The organization defines the time period within which it must respond to complaints, concerns, or questions from individuals about the organizational privacy practices.', - 'CCI-003543': - 'The organization responds to complaints, concerns, or questions from individuals about the organizational privacy practices within the organization-defined time period.', - 'CCI-003544': - 'The organization defines the frequency on which it will update the inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).', - 'CCI-003545': - 'The organization establishes an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).', - 'CCI-003546': - 'The organization establishes an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).', - 'CCI-003547': - 'The organization maintains an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).', - 'CCI-003548': - 'The organization maintains an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).', - 'CCI-003549': - 'The organization updates, per organization-defined frequency, an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).', - 'CCI-003550': - 'The organization updates, per organization-defined frequency, an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).', - 'CCI-003551': - 'The organization defines the frequency for providing each update of the personally identifiable information (PII) inventory to the CIO or information security official.', - 'CCI-003552': - 'The organization provides each update of the personally identifiable information (PII) inventory to the CIO or information security official, per organization-defined frequency, to support the establishment of information security requirements for all new or modified information systems containing PII.', - 'CCI-003553': 'The organization develops a Privacy Incident Response Plan.', - 'CCI-003554': 'The organization implements a Privacy Incident Response Plan.', - 'CCI-003555': - 'The organization provides an organized and effective response to privacy incidents in accordance with the organizational Privacy Incident Response Plan.', - 'CCI-003556': - 'The organization provides effective notice to the public regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).', - 'CCI-003557': - 'The organization provides effective notice to individuals regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).', - 'CCI-003558': - 'The organization provides effective notice to the public regarding its authority for collecting personally identifiable information (PII).', - 'CCI-003559': - 'The organization provides effective notice to individuals regarding its authority for collecting personally identifiable information (PII).', - 'CCI-003560': - 'The organization provides effective notice to the public regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII).', - 'CCI-003561': - 'The organization provides effective notice to individuals regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII).', - 'CCI-003562': - 'The organization provides effective notice to the public regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII).', - 'CCI-003563': - 'The organization provides effective notice to individuals regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII).', - 'CCI-003564': - 'The organization provides effective notice to the public regarding the ability of individuals to access personally identifiable information (PII).', - 'CCI-003565': - 'The organization provides effective notice to individuals regarding the ability to access personally identifiable information (PII).', - 'CCI-003566': - 'The organization provides effective notice to the public regarding the ability to have personally identifiable information (PII) amended or corrected if necessary.', - 'CCI-003567': - 'The organization provides effective notice to individuals regarding the ability to have personally identifiable information (PII) amended or corrected if necessary.', - 'CCI-003568': - 'The organization describes the personally identifiable information (PII) the organization collects.', - 'CCI-003569': - 'The organization describes the purpose(s) for which it collects the personally identifiable information (PII).', - 'CCI-003570': - 'The organization describes how the organization uses personally identifiable information (PII) internally.', - 'CCI-003571': - 'The organization describes whether the organization shares personally identifiable information (PII) with external entities.', - 'CCI-003572': - 'The organization describes the categories of those external entities with whom personally identifiable information (PII) is shared.', - 'CCI-003573': - 'The organization describes the purposes for sharing personally identifiable information (PII) with external entities.', - 'CCI-003574': - 'The organization describes whether individuals have the ability to consent to specific uses or sharing of personally identifiable information (PII).', - 'CCI-003575': - 'The organization describes how individuals may exercise their consent regarding specific uses or sharing of personally identifiable information (PII).', - 'CCI-003576': - 'The organization describes how individuals may obtain access to personally identifiable information (PII).', - 'CCI-003577': - 'The organization describes how the personally identifiable information (PII) will be protected.', - 'CCI-003578': - 'The organization revises its public notices to reflect changes in practice or policy that affect personally identifiable information (PII), before or as soon as practicable after the change.', - 'CCI-003579': - 'The organization revises its public notices to reflect changes in practice or policy that impact privacy, before or as soon as practicable after the change.', - 'CCI-003580': - 'The organization provides real-time notice and/or layered notice when it collects personally identifiable information (PII).', - 'CCI-003581': - 'The organization publishes System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII).', - 'CCI-003582': - 'The organization keeps System of Records Notices (SORNs) current.', - 'CCI-003583': - 'The organization includes Privacy Act Statements on its forms that collect personally identifiable information (PII), or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected.', - 'CCI-003584': - 'The organization publishes System of Records Notices (SORNs) on its public website.', - 'CCI-003585': - 'The organization ensures the public has access to information about its privacy activities.', - 'CCI-003586': - 'The organization ensures the public is able to communicate with its Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO).', - 'CCI-003587': - 'The organization ensures its privacy practices are publicly available through organizational websites or otherwise.', - 'CCI-003588': - 'The organization uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices.', - 'CCI-003589': - 'The organization shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes.', - 'CCI-003590': - 'The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the personally identifiable information (PII) covered.', - 'CCI-003591': - 'The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically enumerate the purposes for which the personally identifiable information (PII) may be used.', - 'CCI-003592': - 'The organization monitors its staff on the authorized sharing of personally identifiable information (PII) with third parties.', - 'CCI-003593': - 'The organization audits its staff on the authorized sharing of personally identifiable information (PII) with third parties.', - 'CCI-003594': - 'The organization trains its staff on the authorized sharing of personally identifiable information (PII) with third parties.', - 'CCI-003595': - 'The organization trains its staff on the consequences of unauthorized use or sharing of personally identifiable information (PII).', - 'CCI-003596': - 'The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether the sharing is authorized.', - 'CCI-003597': - 'The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether additional or new public notice is required.', - 'CCI-003598': - 'The organization defines the individuals or information systems to be the only recipients of organization-defined information, information system components, or devices, by employing organization-defined security safeguards.', - 'CCI-003599': - 'The organization defines the individuals or information systems to be the only recipients of organization-defined information, information system components, or devices, by employing organization-defined security safeguards.', - 'CCI-003601': - 'Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-003602': - 'Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-003603': - 'Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines to organization-defined personnel or roles.', - 'CCI-003604': - 'Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and the associated access control.', - 'CCI-003605': - 'Designate an organization-defined official to manage the development and documentation of the access control policy and procedures.', - 'CCI-003606': - 'Designate an organization-defined official to manage the dissemination of the access control policy and procedures.', - 'CCI-003607': - 'Defines the official designated to manage the development, documentation, and dissemination of the access control policy and procedures.', - 'CCI-003608': - 'Review and update the current access control policy following organization-defined events.', - 'CCI-003609': - 'Defines the events following reviewing and updating the current access control policy.', - 'CCI-003610': - 'Review and update the current access control procedures following organization-defined events.', - 'CCI-003611': - 'Defines the events following reviewing and updating the current access control procedures.', - 'CCI-003612': - 'Define and document the types of accounts allowed and specifically prohibited for use within the system.', - 'CCI-003613': - 'Require organization-defined prerequisites and criteria for group membership.', - 'CCI-003614': - 'Require organization-defined prerequisites and criteria for role membership.', - 'CCI-003615': - 'Defines the prerequisites and criteria for group and role membership.', - 'CCI-003616': 'Defines the attributes (as required) for each account.', - 'CCI-003617': - 'Create, enable, modify, disable, and remove system accounts in accordance with organization-defined policy.', - 'CCI-003618': - 'Create, enable, modify, disable, and remove system accounts in accordance with organization-defined criteria.', - 'CCI-003619': - 'Create, enable, modify, disable, and remove system accounts in accordance with organization-defined prerequisites.', - 'CCI-003620': - 'Defines the policy to be employed when creating, enabling, modifying, disabling, and removing information system accounts.', - 'CCI-003621': - 'Defines the prerequisites to be employed when creating, enabling, modifying, disabling, and removing information system accounts.', - 'CCI-003622': - 'Defines the criteria to be employed when creating, enabling, modifying, disabling, and removing information system accounts.', - 'CCI-003623': - 'Defines the personnel or roles of whom to notify when accounts are no longer required; when users are terminated or transferred; and when system usage or need-to-know changes for an individual.', - 'CCI-003624': - 'Defines the time period of when to notify account managers for each situation.', - 'CCI-003625': - 'Defines the attributes (as required) for authorizing access to the system.', - 'CCI-003626': - 'Align account management processes with personnel termination and transfer processes.', - 'CCI-003627': 'Disable accounts when the accounts have expired.', - 'CCI-003628': - 'Disable accounts when the accounts are no longer associated to a user.', - 'CCI-003629': - 'Disable accounts when the accounts are in violation of organizational policy.', - 'CCI-003630': 'Monitor changes to roles or attributes.', - 'CCI-003631': - 'Defines the system accounts that can be dynamically activated.', - 'CCI-003632': 'Activate organization-defined system accounts dynamically.', - 'CCI-003633': 'Defines the system accounts that can be dynamically managed.', - 'CCI-003634': 'Manage organization-defined system accounts dynamically.', - 'CCI-003635': - 'Defines the system accounts that can be dynamically deactivated.', - 'CCI-003636': 'Deactivate organization-defined system accounts dynamically.', - 'CCI-003637': - 'Defines the significant risks that may be discovered requiring disabled accounts of individuals.', - 'CCI-003638': - 'Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects.', - 'CCI-003639': - 'Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects.', - 'CCI-003640': - "Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system's components.", - 'CCI-003641': - 'Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects.', - 'CCI-003642': - 'Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change the rules governing access control.', - 'CCI-003643': - 'Defines the organization-defined roles for which it will employ an audited override of automated access control mechanisms.', - 'CCI-003644': - 'Restrict direct access to data repositories containing organization-defined information types.', - 'CCI-003645': - 'Defines the information types of which to restrict direct access to data repositories.', - 'CCI-003646': - 'Require applications to assert, as part of the installation process, the access needed to the organization-defined system applications and functions.', - 'CCI-003647': - 'Defines the organization-defined system applications and functions as required of the applications as part of the installation process.', - 'CCI-003648': - 'Require applications to provide an enforcement mechanism to prevent other-than-asserted access.', - 'CCI-003649': - 'Approve access changed after initial installations of the application.', - 'CCI-003650': - 'Enforce attribute-based access control policy over defined subjects and objects based upon organization-defined attributes to assume access permissions.', - 'CCI-003651': - 'Defines the attributes to assume access permissions for enforcing attribute-based access control policy.', - 'CCI-003652': - 'Enforce attribute-based control access over defined subjects and objects based upon organization-defined attributes to assume access permissions.', - 'CCI-003653': - 'Defines the attributes to assume access permissions for enforcing attribute-based control access.', - 'CCI-003654': - 'Provide organization-defined mechanisms to enable individuals to have access to the following elements of their personally identifiable information: organization-defined elements.', - 'CCI-003655': - 'Defines the mechanisms to be provided for access to elements of personally identifiable information.', - 'CCI-003656': 'Defines the elements of personally identifiable information.', - 'CCI-003657': - 'Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy.', - 'CCI-003658': - 'Defines the mandatory access control policies that are to be enforced over all subjects and objects.', - 'CCI-003659': - 'Enforce organization-defined discretionary access control policy over the set of covered subjects and objects specified in the policy.', - 'CCI-003660': - 'Defines the discretionary access control policies the system is to enforce over subjects and objects.', - 'CCI-003661': - 'Defines the privacy attributes to be used to enforce organization-defined information flow control policies.', - 'CCI-003662': - 'Defines the information flow control mechanisms to prevent the bypassing of encrypted information.', - 'CCI-003663': - 'Enforce information flow control using organization-defined privacy policy filters as a basis for flow control decisions for organization-defined information flows.', - 'CCI-003664': - 'Enforce information flow control using block; strip; modify and/or quarantine data after a filter processing failure in accordance with organization-defined security or privacy policy.', - 'CCI-003665': - 'Defines the security or privacy policy to be enforced using block; strip; modify and/or quarantine data after a filter processing failure.', - 'CCI-003666': - 'Defines the security or privacy policy filters implemented when transferring information between security domains.', - 'CCI-003667': - 'When transferring information between security domains, modify non-releasable information by implementing organization-defined modification action.', - 'CCI-003668': - 'Defines the modification action when transferring information between different security domains.', - 'CCI-003669': - 'When transferring information between different security domains, parse incoming data into an internal normalized format.', - 'CCI-003670': - 'When transferring information between different security domains, regenerate the data to be consistent with its intended specification.', - 'CCI-003671': - 'When transferring information between different security domains, sanitize data to minimize delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography encoded data; spillage of sensitive information in accordance with organization-defined policy.', - 'CCI-003672': - 'Defines the policy when transferring information between different security domains.', - 'CCI-003673': - 'When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.', - 'CCI-003674': - 'When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.', - 'CCI-003675': - 'When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.', - 'CCI-003676': - 'When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering mechanisms successfully complete execution without errors.', - 'CCI-003677': - 'When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering actions occur in the correct order and comply with organization-defined policy.', - 'CCI-003678': - 'When transferring information between different security domains, implement content filtering mechanisms using multiple processes.', - 'CCI-003679': - 'When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.', - 'CCI-003680': - 'When transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content.', - 'CCI-003681': - 'When transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata.', - 'CCI-003682': - 'When transferring information between different security domains, the process that transfers information between filter pipelines ensures the content associated with the filtering metadata has successfully completed filtering.', - 'CCI-003683': - 'When transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.', - 'CCI-003684': - 'Identify and document organization-defined duties of individuals requiring separation.', - 'CCI-003685': - 'Defines the individuals or roles who authorize access to organization-defined security functions.', - 'CCI-003686': - 'Defines the individuals or roles who authorize access to organization-defined security-relevant information.', - 'CCI-003687': - 'Limit the number of unsuccessful biometric logon attempts to an organization-defined number.', - 'CCI-003688': - 'Defines the number of allowed unsuccessful biometric logon attempts.', - 'CCI-003689': - 'Allow the use of organization-defined authentication factors that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded.', - 'CCI-003690': - 'Defines the authentication factors after a number of organization-defined consecutive invalid logon attempts have been executed.', - 'CCI-003691': - 'Enforce a limit of organization-defined number consecutive invalid logon attempts through use of the alternative factors by a user during a organization-defined time period.', - 'CCI-003692': 'Defines the number enforced for logon attempts.', - 'CCI-003693': - 'Display an explicit message to users indicating that the session will end at an organization-defined time until end of session.', - 'CCI-003694': - 'Defines the time until end of session, indicating the session will end.', - 'CCI-003695': - 'Defines the user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.', - 'CCI-003696': - 'Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in storage.', - 'CCI-003697': - 'Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in process.', - 'CCI-003698': - 'Defines privacy attributes, having organization-defined types of privacy attribute values, which are associated with information in transmission.', - 'CCI-003699': - 'Defines privacy attribute values associated with organization-defined types of privacy attributes for information in storage.', - 'CCI-003700': - 'Defines privacy attribute values associated with organization-defined types of privacy attributes for information in process.', - 'CCI-003701': - 'Defines privacy attribute values associated with organization-defined types of privacy attributes for information in transmission.', - 'CCI-003702': - 'Ensure that the privacy attribute associations are made with the information.', - 'CCI-003703': - 'Ensure that the privacy attribute associations are restrained with the information.', - 'CCI-003704': - 'Establish the following permitted organization-defined privacy attributes defined in AC-16a for organization-defined systems.', - 'CCI-003705': - 'Defines the privacy attributes that are permitted for organization-defined systems.', - 'CCI-003706': - 'Defines the attribute values or ranges permitted for each of the established privacy attributes.', - 'CCI-003707': 'Audit changes to the attributes.', - 'CCI-003708': - 'Review organization-defined security attributes for applicability on an organization-defined frequency.', - 'CCI-003709': - 'Review organization-defined privacy attributes for applicability on an organization-defined frequency.', - 'CCI-003710': - 'Defines the security and privacy attributes to be reviewed for applicability.', - 'CCI-003711': - 'Defines the frequency of which the security and privacy attributes will be reviewed.', - 'CCI-003712': - 'Dynamically associate privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies as information is created and combined.', - 'CCI-003713': - 'Dynamically associate privacy attributes with organization-defined objects in accordance with organization-defined privacy policies as information is created and combined.', - 'CCI-003714': - 'Defines the privacy policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects.', - 'CCI-003715': - 'Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated privacy attributes.', - 'CCI-003716': - 'Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated privacy attributes.', - 'CCI-003717': - 'Defines the privacy attributes for which the association and integrity to organization-defined subjects and objects is maintained.', - 'CCI-003718': - 'Maintain the association of organization-defined privacy attributes to organization-defined subjects.', - 'CCI-003719': - 'Maintain the association of organization-defined privacy attributes to organization-defined objects.', - 'CCI-003720': - 'Maintain the integrity of organization-defined privacy attributes associated with organization-defined subjects.', - 'CCI-003721': - 'Maintain the integrity of organization-defined privacy attributes associated with organization-defined objects.', - 'CCI-003722': - 'Defines the subjects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals).', - 'CCI-003723': - 'Defines the objects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals).', - 'CCI-003724': - 'Defines the privacy attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.', - 'CCI-003725': - 'Provide the capability to associate organization-defined privacy attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).', - 'CCI-003726': - 'Provide the capability to associate organization-defined privacy attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).', - 'CCI-003727': - 'Displays privacy attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.', - 'CCI-003728': - 'Identifies special dissemination, handling, or distribution instructions for identifying privacy attributes on output.', - 'CCI-003729': - 'Identifies human-readable, standard naming conventions for identifying privacy attributes on output.', - 'CCI-003730': - 'Defines the privacy policies to be followed by personnel when associating organization-defined privacy attributes with organization-defined subjects and objects.', - 'CCI-003731': - 'Defines the privacy attributes which are to be associated with organization-defined subjects and objects.', - 'CCI-003732': - 'Defines the subjects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies.', - 'CCI-003733': - 'Defines the objects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies.', - 'CCI-003734': - 'Require personnel to associate organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies.', - 'CCI-003735': - 'Require personnel to associate organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies.', - 'CCI-003736': - 'Require personnel to maintain the association of organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies.', - 'CCI-003737': - 'Require personnel to maintain the association of organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies.', - 'CCI-003738': - 'Provide a consistent interpretation of privacy attributes transmitted between distributed system components.', - 'CCI-003739': - 'Defines the techniques and technologies to be implemented when associating security attributes to information.', - 'CCI-003740': - 'Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating privacy attributes to information.', - 'CCI-003741': - 'Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating privacy attributes to information.', - 'CCI-003742': - 'Change privacy attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.', - 'CCI-003743': - 'Provide authorized individuals the capability to define or change the type of privacy attributes available for association with subjects.', - 'CCI-003744': - 'Provide authorized individuals the capability to define or change the value of privacy attributes available for association with subjects.', - 'CCI-003745': - 'Provide authorized individuals the capability to define or change the type of privacy attributes available for association with objects.', - 'CCI-003746': - 'Provide authorized individuals the capability to define or change the value of privacy attributes available for association with objects.', - 'CCI-003747': - 'Implement organization-defined mechanisms to authenticate organization-defined remote commands.', - 'CCI-003748': - 'Defines the mechanisms used to authenticate organization-defined remote commands.', - 'CCI-003749': - 'Defines the remote commands used for implementing organization-defined mechanisms.', - 'CCI-003750': - 'Defines the terms and conditions for accessing the system from external systems.', - 'CCI-003751': - 'Defines the controls asserted to be implemented on external systems allowing individuals to access the system from external systems.', - 'CCI-003752': - 'Defines the terms and conditions for processing, storing, or transmitting organization-controlled information using external systems.', - 'CCI-003753': - 'Defines the controls asserted to be implemented on external systems allowing individuals to process, store, or transmit organization-controlled information using external systems.', - 'CCI-003754': - 'Prohibit the use of organizationally-defined types of external systems.', - 'CCI-003755': 'Defines the types of external systems that are prohibited.', - 'CCI-003756': - "Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's security policy and security plan.", - 'CCI-003757': - "Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's privacy policy and privacy plan.", - 'CCI-003758': - 'Defines the restrictions for the use of organization-controlled portable storage devices.', - 'CCI-003759': - 'Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.', - 'CCI-003760': - 'Defines the privacy attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.', - 'CCI-003761': - 'Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-003762': - 'Designate an organization-defined official to manage the development and documentation of the awareness and training policy.', - 'CCI-003763': - 'Designate an organization-defined official to manage the dissemination of the awareness and training policy.', - 'CCI-003764': - 'Designate an organization-defined official to manage the development and documentation of the awareness and training procedures.', - 'CCI-003765': - 'Designate an organization-defined official to manage the dissemination of the awareness and training procedures.', - 'CCI-003766': - 'Provide basic privacy awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events.', - 'CCI-003767': - 'Employ organization-defined awareness techniques to increase the security awareness of system users.', - 'CCI-003768': - 'Employ organization-defined awareness techniques to increase the privacy awareness of system users.', - 'CCI-003769': - 'Defines the awareness techniques for to increase security and privacy awareness of system uses.', - 'CCI-003770': - 'Update literacy training and awareness content on an organization-defined frequency.', - 'CCI-003771': - 'Update literacy training and awareness content following organization-defined event.', - 'CCI-003772': - 'Defines the frequency for updating literacy training and awareness content.', - 'CCI-003773': - 'Defines the events following updating literacy training and awareness content.', - 'CCI-003774': - 'Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.', - 'CCI-003775': - 'Provide literacy training on recognizing and reporting potential and actual instances of social engineering.', - 'CCI-003776': - 'Provide literacy training on recognizing and reporting potential and actual instances of social mining.', - 'CCI-003777': - 'Provide literacy training on recognize suspicious communications and anomalous behavior in organizational systems using organization-defined indicators of malicious code.', - 'CCI-003778': - 'Defines the indicators of malicious code used to recognize suspicious communications and anomalous behavior in organizational systems.', - 'CCI-003779': 'Provide literacy training on the advanced persistent threat.', - 'CCI-003780': 'Provide literacy training on the cyber threat environment.', - 'CCI-003781': - 'Reflect current cyber threat information in system operations.', - 'CCI-003782': - 'Defines the roles and responsibilities of the personnel providing role-based security and privacy training.', - 'CCI-003783': - 'Provide role-based privacy training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.', - 'CCI-003784': - 'Provide role-based privacy training to personnel with organization-defined roles and responsibilities when required by system changes.', - 'CCI-003785': - 'Update role-based training content on an organization-defined frequency.', - 'CCI-003786': - 'Defines the frequency of which the role-based training content is updated.', - 'CCI-003787': - 'Update role-based training content following organization-defined events.', - 'CCI-003788': - 'Defines the events following updating role-based training content.', - 'CCI-003789': - 'Incorporate lessons learned from internal or external security incidents or breaches into role-based training.', - 'CCI-003790': - 'Provide practical exercises in privacy training that reinforce training objectives.', - 'CCI-003791': - 'Defines the frequency for providing training in the employment and operation of personally identifiable information processing and transparency controls to personnel or roles.', - 'CCI-003792': - 'Provide organization-defined personnel or roles with initial training in the employment and operation of personally identifiable information processing and transparency controls.', - 'CCI-003793': - 'Defines the personnel or roles who are to be provided training in the employment and operation of personally identifiable information processing and transparency controls.', - 'CCI-003794': - 'Document individual privacy training activities, including privacy awareness training and specific system privacy training.', - 'CCI-003795': - 'Monitor individual information privacy training activities, including privacy awareness training and specific privacy training.', - 'CCI-003796': - 'Provide feedback on organizational training results to organization-defined personnel on an organization-defined frequency.', - 'CCI-003797': - 'Defines the frequency of which feedback is provided on organizational training results.', - 'CCI-003798': - 'Defines the organizational personnel or roles who provide feedback on organizational training results.', - 'CCI-003799': - 'Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-003800': - 'Designate an organization-defined official to manage the development and documentation of the audit and accountability policy.', - 'CCI-003801': - 'Designate an organization-defined official to manage the dissemination of the audit and accountability policy.', - 'CCI-003802': - 'Designate an organization-defined official to manage the development and documentation of the audit and accountability procedures.', - 'CCI-003803': - 'Designate an organization-defined official to manage the dissemination of the audit and accountability procedures.', - 'CCI-003804': - 'Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability policy.', - 'CCI-003805': - 'Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability procedures.', - 'CCI-003806': - 'Review and update the current audit and accountability policy following organization-defined events.', - 'CCI-003807': - 'Defines the events following reviewing and updating the current audit and accountability policy.', - 'CCI-003808': - 'Review and update the current audit and accountability procedures following organization-defined events.', - 'CCI-003809': - 'Defines the events following reviewing and updating the current audit and accountability procedures.', - 'CCI-003810': - 'Review and update the event types selected for logging on an organization-defined frequency.', - 'CCI-003811': - 'Defines the frequency at which the event types selected for logging will be reviewed and updated.', - 'CCI-003812': - 'Limit personally identifiable information contained in audit records to organization-defined elements identified in the privacy risk assessment.', - 'CCI-003813': - 'Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in audit records.', - 'CCI-003814': - 'Defines the time-period for the alert in the event of an audit process failure.', - 'CCI-003815': - 'Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements organization-defined alternate audit logging functionality.', - 'CCI-003816': - 'Defines the alternate audit logging functionality in the event of a failure in primary audit logging capability.', - 'CCI-003817': - 'Review and analyze the potential impact of the organization-defined inappropriate or unusual activity.', - 'CCI-003818': - 'Adjust the level of audit review and analysis within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.', - 'CCI-003819': - 'Adjust the level of audit reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.', - 'CCI-003820': - 'Defines the automated mechanisms for integrating audit record review, analysis, and reporting processes.', - 'CCI-003821': - 'Implement the capability to centrally review and analyze audit records from multiple components within the system.', - 'CCI-003822': - 'Implement an audit reduction capability that supports on-demand audit review and analysis.', - 'CCI-003823': - 'Implement an audit reduction capability that supports on-demand reporting requirements.', - 'CCI-003824': - 'Implement an audit reduction capability that supports after-the-fact investigations of incidents.', - 'CCI-003825': - 'Implement a report generation capability that supports on-demand audit review and analysis.', - 'CCI-003826': - 'Implement a report generation capability that supports on-demand reporting requirements.', - 'CCI-003827': - 'Implement a report generation capability that supports after-the-fact investigations of incidents.', - 'CCI-003828': - 'Implement an audit reduction capability that does not alter original content or time ordering of audit records.', - 'CCI-003829': - 'Implement a report generation capability that does not alter original content or time ordering of audit records.', - 'CCI-003830': - 'Implement the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.', - 'CCI-003831': - 'Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.', - 'CCI-003832': - 'Defines the personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information.', - 'CCI-003833': - 'Store audit information on a component running a different operating system than the system component being audited.', - 'CCI-003834': - 'Implement the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.', - 'CCI-003835': - 'Provide the capability for auditing the parameters of user query events for data sets containing personally identifiable information.', - 'CCI-003836': - 'Implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.', - 'CCI-003837': - 'If an information disclosure is discovered, notify organization-defined personnel or roles.', - 'CCI-003838': - 'Defines the personnel or roles to be notified if an information disclosure is discovered.', - 'CCI-003839': - 'If an information disclosure is discovered, take organization-defined additional actions.', - 'CCI-003840': - 'Defines the additional actions to be taken if an information disclosure is discovered.', - 'CCI-003841': - 'Monitor open-source information and information sites using organization-defined automated mechanisms.', - 'CCI-003842': - 'Defines the automated mechanisms for monitoring open-source information.', - 'CCI-003843': - 'Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.', - 'CCI-003844': - 'Implement the capability for organization-defined users or roles to select a user session to record; view; hear; and/or log the content of a user session under organization-defined circumstances.', - 'CCI-003845': - 'Defines users or roles who will provide and implement the capability to record; view; hear; and/or log the content of a user session under organization-defined circumstances.', - 'CCI-003846': - 'Defines the circumstances to record; view; hear; and/or log the content of a user session.', - 'CCI-003847': - 'Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-003848': - 'Implement the capability for authorized users to remotely view and hear content related to an established user session in real time.', - 'CCI-003849': - 'Disseminate an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-003850': - 'Defines the personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated.', - 'CCI-003851': - 'Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring policy.', - 'CCI-003852': - 'Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring procedures.', - 'CCI-003853': - 'Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring policy.', - 'CCI-003854': - 'Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring procedures.', - 'CCI-003855': - 'Review and update the current assessment, authorization, and monitoring policy following organization-defined events.', - 'CCI-003856': - 'Defines the events following reviewing and updating the current assessment, authorization, and monitoring policy.', - 'CCI-003857': - 'Review and update the current assessment and authorization procedures following organization-defined events.', - 'CCI-003858': - 'Defines the events following reviewing and updating the current assessment, authorization, and monitoring procedures.', - 'CCI-003859': - 'Select the appropriate assessor or assessment team for the type of assessment to be conducted.', - 'CCI-003860': - 'Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.', - 'CCI-003861': - 'Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the privacy requirements.', - 'CCI-003862': - 'Approve and manage the exchange of information between the system and other systems using interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreement; and/or nondisclosure agreements with an organization-defined type of agreement.', - 'CCI-003863': - 'Document, as part of each exchange agreement, the privacy requirements, controls and responsibilities for each system, and the impact level of the information communicated.', - 'CCI-003864': - 'Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.', - 'CCI-003865': - 'Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-3a.', - 'CCI-003866': - 'Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.', - 'CCI-003867': - 'Defines the automated mechanisms to ensure the accuracy, currency, and availability of the plan of actions and milestones.', - 'CCI-003868': - 'Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems.', - 'CCI-003869': - 'Ensure the authorizing official accepts the use of common controls inherited by the system, before commencing operations.', - 'CCI-003870': - 'Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems.', - 'CCI-003871': - 'Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.', - 'CCI-003872': - 'Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.', - 'CCI-003873': - 'Implement continuous monitoring in accordance with the organization-level continuous monitoring strategy.', - 'CCI-003874': 'Defines the system-level metrics to be monitored.', - 'CCI-003875': - 'Establish organization-defined frequencies for assessment of control effectiveness.', - 'CCI-003876': - 'Defines the frequencies for monitoring of control effectiveness.', - 'CCI-003877': - 'Defines the frequencies for assessment of control effectiveness.', - 'CCI-003878': - 'Develop ongoing control assessments in accordance with the continuous monitoring strategy.', - 'CCI-003879': - 'Implement a continuous monitoring program that includes reporting the privacy status to organization-defined personnel or roles on an organization-defined frequency.', - 'CCI-003880': - 'Defines the frequency with which to report the privacy status to organization-defined personnel or roles.', - 'CCI-003881': - 'Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes effectiveness monitoring.', - 'CCI-003882': - 'Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes compliance monitoring.', - 'CCI-003883': - 'Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes change monitoring.', - 'CCI-003884': - 'Employ organization-defined actions to validate that policies are established.', - 'CCI-003885': - 'Employ organization-defined actions to validate that implemented controls are operating in a consistent manner.', - 'CCI-003886': 'Defines the actions used to validate policies.', - 'CCI-003887': - 'Ensure the accuracy, currency, and availability of monitoring results for the system using organization-defined automated mechanisms.', - 'CCI-003888': - 'Defines the automated mechanisms for ensuring accuracy, currency, and availability of monitoring results.', - 'CCI-003889': - 'Employ a penetration testing process, on an organization-defined frequency, that includes announced or unannounced attempts to bypass or circumvent controls associated with physical access points to the facility.', - 'CCI-003890': - 'Defines the frequency the penetration testing process will be employed.', - 'CCI-003891': - 'Document, for each internal connection, the privacy requirements.', - 'CCI-003892': - 'Terminate internal system connections after organization-defined conditions.', - 'CCI-003893': - 'Defines the conditions for terminating internal system connections.', - 'CCI-003894': - 'Review on an organization-defined frequency the continued need for each internal connection.', - 'CCI-003895': 'Defines the frequency for reviewing each internal connection.', - 'CCI-003896': - 'Perform privacy compliance checks on constituent components prior to the establishment of the internal connection.', - 'CCI-003897': - 'Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-003898': - 'Defines the official to manage the development, documentation, and dissemination of the configuration management policy.', - 'CCI-003899': - 'Designate an organization-defined official to manage the development and documentation of the configuration management policy.', - 'CCI-003900': - 'Designate an organization-defined official to manage the dissemination of the configuration management policy.', - 'CCI-003901': - 'Defines the official to manage the development, documentation, and dissemination of the configuration management procedures.', - 'CCI-003902': - 'Designate an organization-defined official to manage the development and documentation of the configuration management procedures.', - 'CCI-003903': - 'Designate an organization-defined official to manage the dissemination of the configuration management procedures.', - 'CCI-003904': - 'Review and update the configuration management policy following organization-defined events.', - 'CCI-003905': - 'Defines the events for when the policy will be reviewed and updated.', - 'CCI-003906': - 'Review and update, on an organization-defined frequency, the current configuration management procedures.', - 'CCI-003907': - 'Review and update the configuration management procedures following organization-defined events.', - 'CCI-003908': - 'Defines the events for when the procedures will be reviewed and updated.', - 'CCI-003909': - 'Develop and document, under configuration control, a current baseline configuration of the system.', - 'CCI-003910': - 'Review and update the baseline configuration of the system when system components are installed or upgraded.', - 'CCI-003911': - 'Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the baseline configuration of the system.', - 'CCI-003912': - 'Approve or disapprove configuration-controlled changes to the system, with explicit consideration for privacy impact analyses.', - 'CCI-003913': - 'Defines the automated mechanisms for documenting proposed changes to the system.', - 'CCI-003914': - 'Defines the automated mechanisms for notifying approval authorities of proposed changes to the system and request change proposal.', - 'CCI-003915': - 'Defines the automated mechanisms for highlighting proposed changes to the system that have not been approved or disapproved within an organization-defined time period.', - 'CCI-003916': - 'Defines the automated mechanisms for prohibiting changes to the system until designated approvals are received.', - 'CCI-003917': - 'Defines the automated mechanisms for documenting all changes to the system.', - 'CCI-003918': - 'Defines the automated mechanisms for notifying organization-defined personnel when approved changes to the system are completed.', - 'CCI-003919': - 'Defines the automated mechanisms to implement changes to the current system baseline.', - 'CCI-003920': - 'Defines the automated mechanisms to deploy the updated baselines across the installed base.', - 'CCI-003921': - 'Require an organization-defined privacy representative to be a member of the organization-defined configuration change control element.', - 'CCI-003922': - 'Defines the security representatives required to be members of the configuration change control element.', - 'CCI-003923': - 'Defines the privacy representatives required to be members of the configuration change control element.', - 'CCI-003924': - 'Defines the configuration change control element required for security and privacy representatives.', - 'CCI-003925': - 'Review changes to the system on an organization-defined frequency or when there are organization-defined circumstances to determine whether unauthorized changes have occurred.', - 'CCI-003926': 'Defines the frequency for reviewing changes to the system.', - 'CCI-003927': - 'Defines the circumstances for determining whether unauthorized changes to the system have occurred.', - 'CCI-003928': - 'Prevent or restrict changes to the configuration of the system under organization-defined circumstances.', - 'CCI-003929': - 'Defines the circumstances for preventing or restricting changes to the configuration of the system.', - 'CCI-003930': - 'Analyze changes to the system to determine potential privacy impacts prior to change implementation.', - 'CCI-003931': - 'When analyzing changes to the system, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.', - 'CCI-003932': - 'After system changes, verify that the impacted controls are implemented correctly, meeting the privacy requirements for the system.', - 'CCI-003933': - 'After system changes, verify that the impacted controls are operating as intended, meeting the privacy requirements for the system.', - 'CCI-003934': - 'After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system.', - 'CCI-003935': - 'Define and document physical access restrictions associated with changes to the system.', - 'CCI-003936': - 'Define and document logical access restrictions associated with changes to the system.', - 'CCI-003937': - 'Defines the automated mechanisms to enforce access restrictions.', - 'CCI-003938': - 'Automatically generate audit records of the enforcement actions.', - 'CCI-003939': - 'Defines the frequency with which to review and reevaluate system privileges.', - 'CCI-003940': - 'Review and reevaluate system privileges per an organization-defined frequency.', - 'CCI-003941': - 'Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using organization-defined common secure configurations.', - 'CCI-003942': - 'Defines the common secure configurations for establishing and documenting configuration settings within the system, that reflect the most restrictive mode consistent with operational requirements.', - 'CCI-003943': - 'Monitor changes to the configuration settings in accordance with organizational policies.', - 'CCI-003944': - 'Monitor changes to the configuration settings in accordance with organizational procedures.', - 'CCI-003945': - 'Control changes to the configuration settings in accordance with organizational policies.', - 'CCI-003946': - 'Control changes to the configuration settings in accordance with organizational procedures.', - 'CCI-003947': - 'Defines the automated mechanisms for managing, applying, and verifying configuration settings.', - 'CCI-003948': - 'Defines the mission essential capabilities for configuring the system.', - 'CCI-003949': - 'Require that organization-defined user-installed software in a confined physical or virtual machine environment with limited privileges.', - 'CCI-003950': - 'Defines the user-installed software required for executing in a confined physical or virtual machine environment with limited privileges.', - 'CCI-003951': - 'Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is obtained from sources with limited or no warranty.', - 'CCI-003952': - 'Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is obtained from sources with limited or no warranty.', - 'CCI-003953': - 'Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is without the provision of source code.', - 'CCI-003954': - 'Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is without the provision of source code.', - 'CCI-003955': - 'Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code.', - 'CCI-003956': - 'Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.', - 'CCI-003957': - 'Identify organization-defined hardware components authorized for system use.', - 'CCI-003958': - 'Defines the hardware components to be identified for authorized system use.', - 'CCI-003959': - 'Prohibit the use or connection of unauthorized hardware components.', - 'CCI-003960': - 'Review and update the list of authorized hardware components on an organization-defined frequency.', - 'CCI-003961': - 'Defines the frequency the hardware components are reviewed and updated.', - 'CCI-003962': - 'Develop and document an inventory of system components that accurately reflects the system.', - 'CCI-003963': - 'Develop and document an inventory of system components that includes all components within the system.', - 'CCI-003964': - 'Develop and document an inventory of system components that does not include duplicate accounting of components or components assigned to any other system.', - 'CCI-003965': - 'Develop and document an inventory of system components that is at the level of granularity deemed necessary for tracking.', - 'CCI-003966': - 'Develop and document an inventory of system components that is at the level of granularity deemed necessary for reporting.', - 'CCI-003967': - 'Develop and document an inventory of system components that includes organization-defined information deemed necessary to achieve effective system component accountability.', - 'CCI-003968': - 'Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the inventory of the system components.', - 'CCI-003969': - 'Defines the automated mechanisms for detecting the presence of unauthorized hardware, software, and firmware components within the system.', - 'CCI-003970': - 'Defines the automated mechanisms for supporting the tracking of system components by geographic location.', - 'CCI-003971': - 'Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes.', - 'CCI-003972': - 'Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management procedures.', - 'CCI-003973': - 'Develop and document a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle.', - 'CCI-003974': - 'Develop and document a configuration management plan for the system that establishes a process for managing the configuration of the configuration items.', - 'CCI-003975': - 'Develop and document a configuration management plan for the system that defines the configuration items for the system.', - 'CCI-003976': - 'Develop and document a configuration management plan for the system that places the configuration items under configuration management.', - 'CCI-003977': - 'Develop and document a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles.', - 'CCI-003978': - 'Defines the personnel or roles for those who review and approve the configuration management plan.', - 'CCI-003979': - 'Implement a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles.', - 'CCI-003980': - 'Allow user installation of software only with explicit privileged status.', - 'CCI-003981': - 'Enforce and monitor compliance with software installation policies using organization-defined automated mechanisms.', - 'CCI-003982': - 'Identify and document the location of the organization-defined information on which the information is processed and stored.', - 'CCI-003983': - 'Identify and document the specific system components on which the organization-defined information is processed and stored.', - 'CCI-003984': - 'Defines the information on which the location and specific system components are processed and stored.', - 'CCI-003985': - 'Identify and document the users who have access to the system where the information is processed and stored.', - 'CCI-003986': - 'Identify and document the users who have access to the system components where the information is processed and stored.', - 'CCI-003987': - 'Document changes to the location (i.e., system or system components) where the information is processed and stored.', - 'CCI-003988': - 'Use automated tools to identify organization-defined information by information type on organization-defined components to ensure adequate controls are in place to protect organizational information.', - 'CCI-003989': - 'Defines the information by information type for identifying automated tools.', - 'CCI-003990': - 'Defines the system components used to ensure controls are in place to protect organizational information and individual privacy.', - 'CCI-003991': 'Develop and document a map of system data actions.', - 'CCI-003992': - 'Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.', - 'CCI-003993': - 'Defines the software and firmware for preventing installation without verification that the component has been digitally signed.', - 'CCI-003994': - 'Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-003995': - 'Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-003996': - 'Designate an organization-defined official to manage development and documentation of the contingency planning policy.', - 'CCI-003997': - 'Designate an organization-defined official to manage dissemination of the contingency planning policy.', - 'CCI-003998': - 'Defines the official designated to manage the development, documentation, and dissemination of the contingency policy.', - 'CCI-003999': - 'Designate an organization-defined official to manage the development and documentation of the contingency planning procedures.', - 'CCI-004000': - 'Designate an organization-defined official to manage the dissemination of the contingency procedures.', - 'CCI-004001': - 'Defines the official designated to manage the development, documentation, and dissemination of the contingency procedures.', - 'CCI-004002': - 'Review and update the current contingency planning policy following organization-defined events.', - 'CCI-004003': - 'Defines the events with which to review and update the current contingency planning policy.', - 'CCI-004004': - 'Review and update the current contingency planning procedures following organization-defined events.', - 'CCI-004005': - 'Defines the events with which to review and update the current contingency planning procedures.', - 'CCI-004006': - 'Develop a contingency plan for the system that addresses maintaining essential mission functions despite a system disruption, compromise, or failure.', - 'CCI-004007': - 'Develop a contingency plan for the system that addresses maintaining essential business functions despite a system disruption, compromise, or failure.', - 'CCI-004008': - 'Develop a contingency plan for the system that addresses the sharing of contingency information.', - 'CCI-004009': - 'Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training.', - 'CCI-004010': - 'Review and update contingency training content on an organization-defined frequency.', - 'CCI-004011': - 'Defines the frequency the contingency training content will be reviewed and updated.', - 'CCI-004012': - 'Review and update contingency training content following organization-defined events.', - 'CCI-004013': - 'Defines the events for which the contingency training content will be reviewed and updated.', - 'CCI-004014': - 'Defines the automated mechanisms to test the contingency plan.', - 'CCI-004015': - 'Employ organization-defined mechanisms to organization-defined system or system component to disrupt and adversely affect the system or system component.', - 'CCI-004016': - 'Defines the mechanisms employed to disrupt and adversely affect the system or system component.', - 'CCI-004017': - 'Defines the system or system component used to employ organization-defined mechanisms.', - 'CCI-004018': - 'Establish an alternate storage site, including necessary agreements to permit the retrieval of system backup information.', - 'CCI-004019': - 'Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.', - 'CCI-004020': - 'Defines the system components to conduct backups of user level information.', - 'CCI-004021': - 'Conduct backups of system documentation, including privacy-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.', - 'CCI-004022': 'Protect the confidentiality of backup information.', - 'CCI-004023': 'Protect integrity of backup information.', - 'CCI-004024': 'Protect the availability of backup information.', - 'CCI-004025': - 'Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined backup information.', - 'CCI-004026': - 'Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined backup information.', - 'CCI-004027': - 'Defines the backup information which is protected by cryptographic mechanisms preventing unauthorized disclosure and modification.', - 'CCI-004028': - 'Provide for the recovery and reconstitution of the system to a known state within an organization-defined time-period consistent with recovery time and recovery point objectives after a disruption, compromise, or failure.', - 'CCI-004029': - 'Defines the time-period consistent with recovery time and recovery point objectives for the recovery and reconstitution of the system.', - 'CCI-004030': - 'Protect system components used for recovery and reconstitution.', - 'CCI-004031': - 'Defines the personnel or roles the organization-level; mission/business process-level; and/or system-level identification and authorization policy is disseminated to.', - 'CCI-004032': - 'Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination, among organizational entities, and compliance.', - 'CCI-004033': - 'Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004034': - 'Develop and document the procedures to facilitate the implementation of the identification and authorization policy and the associated identification and authentication controls.', - 'CCI-004035': - 'Designate an organization-defined official to manage development and documentation of the identification and authentication policy.', - 'CCI-004036': - 'Designate an organization-defined official to manage dissemination of the identification and authentication policy.', - 'CCI-004037': - 'Designate an organization-defined official to manage development and documentation of the identification and authentication procedures.', - 'CCI-004038': - 'Designate an organization-defined official to manage dissemination of the identification and authentication procedures.', - 'CCI-004039': - 'Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication policy.', - 'CCI-004040': - 'Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication procedures.', - 'CCI-004041': - 'Review and update the current identification and authentication policy following organization-defined events.', - 'CCI-004042': - 'Defines the events following reviewing and updating the current identification and authentication policy.', - 'CCI-004043': - 'Review and update the current identification and authentication procedures following organization-defined events.', - 'CCI-004044': - 'Defines the events following reviewing and updating the current identification and authentication procedures.', - 'CCI-004045': - 'Require users to be individually authenticated before granting access to the shared accounts or resources.', - 'CCI-004046': - 'Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.', - 'CCI-004047': - 'Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.', - 'CCI-004048': - 'Defines the strength of mechanism requirements for implementing multi-factor authentication.', - 'CCI-004049': - 'Defines the dynamic identifier policy for managing individual identifiers dynamically.', - 'CCI-004050': 'Generate pairwise pseudonymous identifiers.', - 'CCI-004051': - 'Maintain the attributes for each uniquely identified individual, device, or service in organization-defined protected central storage.', - 'CCI-004052': - 'Defines the protected central storage for maintaining the attributes for each uniquely individual, device or service.', - 'CCI-004053': - 'Manage system authenticators by establishing administrative procedures for lost/compromised or damaged authenticators.', - 'CCI-004054': - 'Manage system authenticators by implementing administrative procedures for lost/compromised or damaged authenticators.', - 'CCI-004055': - 'Manage system authenticators by changing default authenticators prior to first use.', - 'CCI-004056': - 'Defines the events for when to change or refresh authenticators.', - 'CCI-004057': - 'Defines the frequency for updating commonly used, expected, or compromised passwords, when they are suspected of being compromised directly or indirectly.', - 'CCI-004058': - 'For password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.', - 'CCI-004059': - 'For password-based authentication, update the list of passwords on an organization-defined frequency.', - 'CCI-004060': - 'For password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.', - 'CCI-004061': - 'For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).', - 'CCI-004062': - 'For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.', - 'CCI-004063': - 'For password-based authentication, require immediate selection of a new password upon account recovery.', - 'CCI-004064': - 'For password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters.', - 'CCI-004065': - 'For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.', - 'CCI-004066': - 'For password-based authentication, enforce organization-defined composition and complexity rules.', - 'CCI-004067': 'Defines the composition and complexity rules to be enforced.', - 'CCI-004068': - 'For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.', - 'CCI-004069': - 'Ensure that the unencrypted static authenticators are not embedded in applications or other forms of static storage.', - 'CCI-004070': - 'Use organization-defined external organizations to federate credentials.', - 'CCI-004071': - 'Defines the external organizations used to federate credentials.', - 'CCI-004072': - 'Defines the binding rules for binding identities and authenticators.', - 'CCI-004073': - 'Use only General Services Administration-approved and validated products and services for identity, credential, and access management.', - 'CCI-004074': - 'Require that the issuance of organization-defined types of and/or specific authenticators be conducted in person or by a trusted external party before the organization-defined registration authority with authorization by organization-defined personnel or roles.', - 'CCI-004075': - 'Defines types of and/or specific authenticators to be conducted in person or by a trusted external party before the organization-defined registration authority.', - 'CCI-004076': - 'Defines the registration authority who conducts the issuance of organization-defined types of and/or specific authenticators.', - 'CCI-004077': - 'Defines the personnel or roles who authorize the issuance of organization-defined types of and/or specific authenticators.', - 'CCI-004078': - 'Employ presentation attack detection mechanisms for biometric-based authentication.', - 'CCI-004079': - 'Employ organization-defined password managers to generate and manage passwords.', - 'CCI-004080': - 'Defines the password managers employed to generate and manage passwords.', - 'CCI-004081': 'Protect the passwords using organization-defined controls.', - 'CCI-004082': 'Defines the controls for protecting the passwords.', - 'CCI-004083': 'Accept only external credentials that are NIST compliant.', - 'CCI-004084': - 'Document and maintain a list of accepted external authenticators.', - 'CCI-004085': - 'Conform to organization-defined identity management profiles for identity management.', - 'CCI-004086': - 'Defines the identity management profiles for conforming to the profiles for identity management.', - 'CCI-004087': - 'Defines the policy for accepting and verifying federated or PKI credentials.', - 'CCI-004088': - 'Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among individuals.', - 'CCI-004089': - 'Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among credential service providers.', - 'CCI-004090': - 'Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among relying parties.', - 'CCI-004091': - 'Defines the measures to be implemented to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties.', - 'CCI-004092': - 'Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards.', - 'CCI-004093': - 'Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable guidelines.', - 'CCI-004094': 'Resolve user identities to a unique individual.', - 'CCI-004095': 'Collect identity evidence.', - 'CCI-004096': 'Validate identity evidence.', - 'CCI-004097': 'Verify identity evidence.', - 'CCI-004098': - 'Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.', - 'CCI-004099': - 'Require evidence of individual identification be presented to the registration authority.', - 'CCI-004100': - 'Require that the presented identity evidence be validated through organizational defined methods of validation.', - 'CCI-004101': - 'Require that the presented identity evidence be verified through organizational defined methods of verification.', - 'CCI-004102': - 'Defines the methods of validation required for presenting identity evidence.', - 'CCI-004103': - 'Defines the methods of verification required for presenting identity evidence.', - 'CCI-004104': - 'Require that the validation of identity evidence be conducted in person before a designated registration authority.', - 'CCI-004105': - 'Require that the verification of identity evidence be conducted in person before a designated registration authority.', - 'CCI-004106': - 'Require that a registration code or notice of proofing be delivered through an out-of-band channel to verify the users address (physical or digital) of record.', - 'CCI-004107': - 'Accept externally-proofed identities at an organization-defined identity assurance level.', - 'CCI-004108': - 'Defines the identity assurance level by accepting externally-proofed identities.', - 'CCI-004109': - 'Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004110': - 'Designate an organization-defined official to manage the incident response policy.', - 'CCI-004111': - 'Designate an organization-defined official to manage the incident response procedures.', - 'CCI-004112': - 'Defines the official designated to manage the incident response policy and procedures.', - 'CCI-004113': - 'Review and update the current incident response policy following organization-defined events.', - 'CCI-004114': - 'Defines the events for reviewing and updating the current incident response policy.', - 'CCI-004115': - 'Review and update the current incident response procedures following organization-defined events.', - 'CCI-004116': - 'Defines the events for reviewing and updating the current incident response procedures.', - 'CCI-004117': - 'Defines the automated mechanisms to provide an incident response training environment.', - 'CCI-004118': - "Provide incident response training on how to identify and respond to a breach, including the organization's process for reporting a breach.", - 'CCI-004119': - 'Defines the automated mechanisms to test the incident response capability.', - 'CCI-004120': - 'Use qualitative data from testing to determine the effectiveness of incident response processes.', - 'CCI-004121': - 'Use quantitative data from testing to determine the effectiveness of incident response processes.', - 'CCI-004122': - 'Use qualitative data from testing to continuously improve incident response processes.', - 'CCI-004123': - 'Use quantitative data from testing to continuously improve incident response processes.', - 'CCI-004124': - 'Use qualitative data from testing to provide incident response measures and metrics that are accurate.', - 'CCI-004125': - 'Use quantitative data from testing to provide incident response measures and metrics that are accurate.', - 'CCI-004126': - 'Use qualitative data from testing to provide incident response measures and metrics that are consistent.', - 'CCI-004127': - 'Use quantitative data from testing to provide incident response measures and metrics that are consistent.', - 'CCI-004128': - 'Use qualitative data from testing to provide incident response measures and metrics that are in a reproducible format.', - 'CCI-004129': - 'Use quantitative data from testing to provide incident response measures and metrics that are in a reproducible format.', - 'CCI-004130': - 'Incorporate lessons learned from ongoing incident handling activities into incident response procedures.', - 'CCI-004131': - 'Incorporate lessons learned from ongoing incident handling activities into incident response training.', - 'CCI-004132': - 'Incorporate lessons learned from ongoing incident handling activities into incident response testing.', - 'CCI-004133': - 'Ensure the rigor of incident handling activities are comparable and predictable across the organization.', - 'CCI-004134': - 'Ensure the intensity of incident handling activities are comparable and predictable across the organization.', - 'CCI-004135': - 'Ensure the scope of incident handling activities are comparable and predictable across the organization.', - 'CCI-004136': - 'Ensure the results of incident handling activities are comparable and predictable across the organization.', - 'CCI-004137': - 'Defines the automated mechanisms for supporting the incident handling process.', - 'CCI-004138': - 'Defines the types of dynamic reconfiguration for system components.', - 'CCI-004139': - 'Defines the classes of incidents to identify actions in response to those incidents.', - 'CCI-004140': - 'Defines the actions to take in response to organization-defined classes of incidents to ensure continuation of organizational mission and business functions.', - 'CCI-004141': - 'Coordinate an incident handling capability for insider threats that includes organization-defined entities.', - 'CCI-004142': - 'Defines the organizational entities for coordinating an incident handling capability for insider threats.', - 'CCI-004143': - 'Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in an organization-defined time period.', - 'CCI-004144': - 'Defines the time period for establishing and maintaining an integrated incident response team that can be deployed to any location identified by the organization.', - 'CCI-004145': - 'Analyze malicious code and/or other residual artifacts remaining in the system after the incident.', - 'CCI-004146': - 'Analyze anomalous or suspected adversarial behavior in or related to organization-defined environments or resources.', - 'CCI-004147': - 'Defines the environments or resources for analyzing anomalous or suspected adversarial behavior.', - 'CCI-004148': 'Establish and maintain a security operations center.', - 'CCI-004149': 'Manage public relations associated with an incident.', - 'CCI-004150': 'Employ measures to repair the reputation of the organization.', - 'CCI-004151': - 'Track incidents using organization-defined automated mechanisms.', - 'CCI-004152': - 'Collect incident information using organization-defined automated mechanisms.', - 'CCI-004153': - 'Analyze incident information using organization-defined automated mechanisms.', - 'CCI-004154': - 'Defines the automated mechanisms to track, collect, and analyze incident information.', - 'CCI-004155': 'Defines the automated mechanisms for reporting incidents.', - 'CCI-004156': - 'Provide incident information to the provider of the product or service.', - 'CCI-004157': - 'Develop an incident response plan that addresses the sharing of incident information.', - 'CCI-004158': - 'Defines the frequency organization-defined personnel or roles will review and approve the incident response plan.', - 'CCI-004159': - 'Develop an incident response plan that explicitly designates responsibility for incident response to organization-defined entities, personnel, or roles.', - 'CCI-004160': - 'Include a process to determine if notice to individuals or other organizations, including oversight organizations, is needed, in the Incident Response Plan for breaches involving Personally Identifiable Information.', - 'CCI-004161': - 'Include an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms in the Incident Response Plan for breaches involving Personally Identifiable Information.', - 'CCI-004162': - 'Include identification of applicable privacy requirements in the Incident Response Plan for breaches involving Personally Identifiable Information.', - 'CCI-004163': - 'Respond to information spills by assigning organization-defined personnel or roles with responsibility for responding to information spills.', - 'CCI-004164': - 'Defines the personnel or roles who will respond to information spills.', - 'CCI-004165': - 'Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004166': - 'Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance policy.', - 'CCI-004167': - 'Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance procedures.', - 'CCI-004168': - 'Defines the official who will manage the development, documentation, and dissemination of the maintenance policy.', - 'CCI-004169': - 'Defines the official who will manage the development, documentation, and dissemination of the maintenance procedures.', - 'CCI-004170': - 'Review and update the current maintenance policy following organization-defined events.', - 'CCI-004171': - 'Defines the events following reviewing and updating the current maintenance policy.', - 'CCI-004172': - 'Review and update the current maintenance procedures following organization-defined events.', - 'CCI-004173': - 'Defines the events following reviewing and updating the current maintenance procedures.', - 'CCI-004174': - 'Schedule replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-004175': - 'Document replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-004176': - 'Review records of replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.', - 'CCI-004177': - 'Approve all maintenance activities, whether performed on site or remotely.', - 'CCI-004178': - 'Monitor all maintenance activities, whether performed on site or remotely.', - 'CCI-004179': - 'Approve all maintenance activities, whether the system or system components are serviced on site or removed to another location.', - 'CCI-004180': - 'Monitor all maintenance activities, whether the system or system components are serviced on site or removed to another location.', - 'CCI-004181': 'Defines the information to be removed from associated media.', - 'CCI-004182': - 'Schedule maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.', - 'CCI-004183': - 'Conduct maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.', - 'CCI-004184': - 'Document maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.', - 'CCI-004185': - 'Produce up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed.', - 'CCI-004186': - 'Review previously approved system maintenance tools on an organization-defined frequency.', - 'CCI-004187': - 'Defines the frequency for reviewing previously approved system maintenance tools.', - 'CCI-004188': - 'Monitor the use of maintenance tools that execute with increased privilege.', - 'CCI-004189': - 'Inspect the maintenance tools to ensure the latest software updates and patches are installed.', - 'CCI-004190': 'Terminate session when nonlocal maintenance is completed.', - 'CCI-004191': - 'Terminate network connection when nonlocal maintenance is completed.', - 'CCI-004192': - 'Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.', - 'CCI-004193': - 'Defines the cryptographic mechanisms for protecting the integrity and confidentiality of nonlocal maintenance and diagnostic communications.', - 'CCI-004194': - 'Develop organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.', - 'CCI-004195': - 'Implement organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.', - 'CCI-004196': - 'Defines alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.', - 'CCI-004197': - 'Defines the automated mechanisms for transferring predictive maintenance data to a maintenance system.', - 'CCI-004198': - 'Restrict or prohibit field maintenance on organization-defined systems or system components to organization-defined trusted maintenance facilities.', - 'CCI-004199': - 'Defines the systems or system components which restrict or prohibit field maintenance.', - 'CCI-004200': - 'Defines the trusted maintenance facilities which the systems or system components restrict or prohibit field maintenance.', - 'CCI-004201': - 'Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004202': - 'Designate an organization-defined official to manage the development and documentation of the media protection policy.', - 'CCI-004203': - 'Designate an organization-defined official to manage the dissemination of the media protection policy.', - 'CCI-004204': - 'Designate an organization-defined official to manage development and documentation of the media protection procedures.', - 'CCI-004205': - 'Designate an organization-defined official to manage dissemination of the media protection procedures.', - 'CCI-004206': - 'Defines the official designated to manage the development, documentation, and dissemination of the media protection policy and procedures.', - 'CCI-004207': - 'Review and update the current media protection policy following organization-defined events.', - 'CCI-004208': - 'Defines the events following reviewing and updating the current media policy.', - 'CCI-004209': - 'Review and update the current media protection procedures following organization-defined events.', - 'CCI-004210': - 'Defines the events following reviewing and updating the current media procedures.', - 'CCI-004211': - 'Physically control and securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas.', - 'CCI-004212': - 'Securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas.', - 'CCI-004213': - 'Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment.', - 'CCI-004214': - 'Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved techniques.', - 'CCI-004215': - 'Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved procedures.', - 'CCI-004216': - 'Defines the automated mechanisms which restrict access to media storage areas and log access attempts and access granted.', - 'CCI-004217': - 'Protect organization-defined types of system media during transport outside of controlled areas using organization-defined controls.', - 'CCI-004218': - 'Control organization-defined types of system media during transport outside of controlled areas using organization-defined controls.', - 'CCI-004219': - 'Test sanitization equipment in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved.', - 'CCI-004220': - 'Test sanitization procedures in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved.', - 'CCI-004221': - 'Establish an organization-defined system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.', - 'CCI-004222': - 'Defines the system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.', - 'CCI-004223': - 'Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed.', - 'CCI-004224': - 'Verify that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information.', - 'CCI-004225': - 'Identify organization-defined system media requiring downgrading.', - 'CCI-004226': 'Defines the system media requiring downgrading.', - 'CCI-004227': - 'Test downgrading equipment on an organization-defined frequency to ensure that intended downgrading actions are being achieved.', - 'CCI-004228': - 'Test downgrading procedures on an organization-defined frequency to ensure that intended downgrading actions are being achieved.', - 'CCI-004229': - 'Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004230': - 'Designate an organization-defined official to manage the development and documentation of the physical and environmental protection policy.', - 'CCI-004231': - 'Designate an organization-defined official to manage the dissemination of the physical and environmental protection policy.', - 'CCI-004232': - 'Designate an organization-defined official to manage development and documentation of the physical and environmental protection procedures.', - 'CCI-004233': - 'Designate an organization-defined official to manage dissemination of the physical and environmental protection procedures.', - 'CCI-004234': - 'Defines the official who will manage the physical and environmental policy.', - 'CCI-004235': - 'Defines the official who will manage the physical and environmental procedures.', - 'CCI-004236': - 'Review and update the current physical and environmental protection policy following organization-defined events.', - 'CCI-004237': - 'Defines the events following reviewing and updating the current physical and environmental protection policy.', - 'CCI-004238': - 'Review and update the current physical and environmental protection procedures following organization-defined events.', - 'CCI-004239': - 'Defines the events following reviewing and updating the current physical and environmental protection procedures.', - 'CCI-004240': - 'Enforce physical access authorizations at organization-defined entry points to the facility where the system resides.', - 'CCI-004241': - 'Enforce physical access authorizations at organization-defined exit points to the facility where the system resides.', - 'CCI-004242': - 'Control ingress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards.', - 'CCI-004243': - 'Control egress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards.', - 'CCI-004244': 'Limit access using physical barriers.', - 'CCI-004245': - 'Employ access control vestibules at organization-defined locations within the facility.', - 'CCI-004246': - 'Defines the locations within the facility where the access control vestibules are employed.', - 'CCI-004247': - 'Link individual identity to receipt of output from output devices.', - 'CCI-004248': - 'Defines the automated mechanisms for recognizing organization-defined classes or types of intrusions and initiating organization-defined response actions.', - 'CCI-004249': 'Review video recordings on an organization-defined frequency.', - 'CCI-004250': 'Defines the frequency with which to review video recordings.', - 'CCI-004251': - 'Report anomalies in visitor access records to organization-defined personnel.', - 'CCI-004252': - 'Defines the personnel who are to report anomalies in visitor access records.', - 'CCI-004253': - 'Defines the automated mechanisms for maintaining and reviewing visitor access records.', - 'CCI-004254': - 'Limit personally identifiable information contained in visitor access records to the organization-defined elements identified in the privacy risk assessment.', - 'CCI-004255': - 'Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in visitor access records.', - 'CCI-004256': - 'Defines the system or individual system components that provide the capability of shutting off power in emergency situations.', - 'CCI-004257': - 'Defines the automatic environmental controls for preventing potentially harmful fluctuations to the system.', - 'CCI-004258': - 'Defines the personnel or roles who employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.', - 'CCI-004259': 'Detect the presence of water near the system.', - 'CCI-004260': - 'Alert organization-defined personnel or roles of the presence of water near the system using organization-defined automated mechanisms.', - 'CCI-004261': - 'Defines the automated mechanisms for detecting the presence of water and alerting organization-defined personnel or roles.', - 'CCI-004262': - 'Determine and document the organization-defined alternate work sites allowed for use by employees.', - 'CCI-004263': - 'Provide a means for employees to communicate with information privacy personnel in case of incidents.', - 'CCI-004264': - 'Protect system components, associated data communications, and networks in accordance with national Emissions Security policies based on the security category or classification of the information.', - 'CCI-004265': - 'Protect system components, associated data communications, and networks in accordance with national Emissions Security procedures based on the security category or classification of the information.', - 'CCI-004266': - 'Employ organization-defined protective measures against electromagnetic pulse damage for organization-defined systems and system components.', - 'CCI-004267': - 'Defines the protective measure employed against electromagnetic pulse damage for organization-defined systems and system components.', - 'CCI-004268': - 'Defines the systems and system components in which organization-defined protective measures are employed against electromagnetic pulse damage.', - 'CCI-004269': - 'Mark organization-defined system hardware components indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.', - 'CCI-004270': - 'Defines the system hardware components which are marked, indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.', - 'CCI-004271': - 'Plan the location or site of the facility where the system resides considering physical and environmental hazards.', - 'CCI-004272': - 'For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy.', - 'CCI-004273': - 'Develop and document an organization-level; mission/business process-level; and or system-level planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004274': - 'Designate an organization-defined official to manage the development and documentation of the planning policy and procedures.', - 'CCI-004275': - 'Designate an organization-defined official to manage the dissemination of the planning policy and procedures.', - 'CCI-004276': - 'Review and update the current planning policy following organization-defined events.', - 'CCI-004277': - 'Review and update the current planning procedures following organization-defined events.', - 'CCI-004278': - 'Develop security and privacy plans for the system that identify the individuals that fulfill system roles and responsibilities.', - 'CCI-004279': - 'Develop security and privacy plans for the system that identify the information types processed, stored, and transmitted by the system.', - 'CCI-004280': - 'Develop security and privacy plans for the system that describe any specific threats to the system that are of concern to the organization.', - 'CCI-004281': - 'Develop security and privacy plans for the system that provide the results of a privacy risk assessment for the systems processing personally identifiable information.', - 'CCI-004282': - 'Develop security and privacy plans for the system that include risk determinations for security and privacy architecture and design decisions.', - 'CCI-004283': - 'Develop security and privacy plans for the system that include security- and privacy-related activities affecting the system that require planning and coordination with organization-defined individuals or groups.', - 'CCI-004284': - 'Establish the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system.', - 'CCI-004285': - 'Establish the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system.', - 'CCI-004286': - 'Provide the rules describing the responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system.', - 'CCI-004287': - 'Provide the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system.', - 'CCI-004288': - 'Provide the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system.', - 'CCI-004289': - 'Defines the frequency individuals are required to read and re-acknowledge the rules of behavior whenever the rules are revised or updated.', - 'CCI-004290': - 'Include in the rules of behavior, restrictions on use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.', - 'CCI-004291': - 'Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information privacy.', - 'CCI-004292': 'Develop privacy architectures for the system.', - 'CCI-004293': - 'Develop privacy architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.', - 'CCI-004294': - 'Develop security architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.', - 'CCI-004295': - 'Develop privacy architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.', - 'CCI-004296': - 'Develop privacy architectures for the system that describe how the architectures are integrated into and support the enterprise architecture.', - 'CCI-004297': - 'Develop privacy architectures for the system that describe any assumptions about, and dependencies on, external systems and services.', - 'CCI-004298': - 'Reflect planned privacy architecture changes in the privacy plans.', - 'CCI-004299': - 'Reflect planned privacy architecture changes in the privacy Concept of Operations (CONOPS).', - 'CCI-004300': - 'Reflect planned privacy architecture changes in the privacy organizational procurements and acquisitions.', - 'CCI-004301': - 'Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations.', - 'CCI-004302': - 'Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers.', - 'CCI-004303': - 'Defines the controls to be allocated to organization-defined locations for the privacy architecture.', - 'CCI-004304': - 'Defines the controls to be allocated to the organization-defined privacy architectural layers.', - 'CCI-004305': - 'Defines the locations to which the system allocates organization-defined controls in the privacy architecture.', - 'CCI-004306': - 'Defines the architectural layers to which the system allocates organization-defined controls in the privacy architecture.', - 'CCI-004307': - 'Design the privacy architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.', - 'CCI-004308': - 'Defines the controls that are allocated to the organization-defined locations and architectural layers.', - 'CCI-004309': - 'Defines the locations and architectural layers that are obtained from different suppliers.', - 'CCI-004310': 'Select a control baseline for the system.', - 'CCI-004311': - 'Tailor the selected control baseline by applying specified tailoring actions.', - 'CCI-004312': - 'Review and update the organization-wide information security program plan following organization-defined events.', - 'CCI-004313': - 'Defines the events for reviewing and updating the organization-wide information security program plan.', - 'CCI-004314': - 'Include the resources needed to implement the information security programs in capital planning and investment requests.', - 'CCI-004315': - 'Include the resources needed to implement the information privacy programs in capital planning and investment requests.', - 'CCI-004316': - 'Prepare documentation required for addressing information security programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.', - 'CCI-004317': - 'Prepare documentation required for addressing information privacy programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.', - 'CCI-004318': - 'Make available for expenditure, the planned information privacy resources.', - 'CCI-004319': - 'Implement a process to ensure that plans of action and milestones for the privacy program and the associated organizational systems are maintained.', - 'CCI-004320': - 'Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed.', - 'CCI-004321': - 'Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are maintained.', - 'CCI-004322': - 'Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are developed.', - 'CCI-004323': - 'Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document the remedial information privacy actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.', - 'CCI-004324': - 'Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document the remedial information supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.', - 'CCI-004325': - 'Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems are reported in accordance with established reporting requirements.', - 'CCI-004326': - 'Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are reported in accordance with established reporting requirements.', - 'CCI-004327': - 'Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are reported in accordance with established reporting requirements.', - 'CCI-004328': 'Develop an inventory of organizational systems.', - 'CCI-004329': - 'Update, on an organization-defined frequency, an inventory of organizational systems.', - 'CCI-004330': - 'Defines the frequency with which to update the inventory of organizational systems.', - 'CCI-004331': - 'Establish an inventory of all systems, applications, and projects that process personally identifiable information.', - 'CCI-004332': - 'Maintain an inventory of all systems, applications, and projects that process personally identifiable information.', - 'CCI-004333': - 'Update on an organization-defined frequency, an inventory of all systems, applications, and projects that process personally identifiable information.', - 'CCI-004334': - 'Defines the frequency of which an inventory of all systems, applications, and projects that process personally identifiable information will be updated.', - 'CCI-004335': - 'Develop the results of information privacy measures of performance.', - 'CCI-004336': - 'Monitor the results of information privacy measures of performance.', - 'CCI-004337': - 'Report on the results of information privacy measures of performance.', - 'CCI-004338': - 'Develop an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.', - 'CCI-004339': - 'Maintain an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.', - 'CCI-004340': - 'Maintain an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.', - 'CCI-004341': - 'Offload organization-defined non-essential functions or services to other systems, system components, or an external provider.', - 'CCI-004342': - 'Defines the non-essential functions or services to be offloaded to other systems, system components, or an external provider.', - 'CCI-004343': - 'Address information privacy issues in the development and documentation of a critical infrastructure and key resources protection plan.', - 'CCI-004344': - 'Address information privacy issues in the updating of a critical infrastructure and key resources protection plan.', - 'CCI-004345': - 'Develop a comprehensive strategy to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information.', - 'CCI-004346': - 'Manage the security state of organizational systems and the environments in which those systems operate through authorization processes.', - 'CCI-004347': - 'Manage the privacy state of organizational systems and the environments in which those systems operate through authorization processes.', - 'CCI-004348': - 'Define organizational mission and business processes with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.', - 'CCI-004349': - 'Determine personally identifiable information processing needs arising from the defined mission and business processes.', - 'CCI-004350': - 'Review and revise the mission and business processes on an organization-defined frequency.', - 'CCI-004351': - 'Defines the frequency at which the mission and business processes are reviewed and revised.', - 'CCI-004352': - 'Establish a privacy workforce development and improvement program.', - 'CCI-004353': - 'Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are developed.', - 'CCI-004354': - 'Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are maintained.', - 'CCI-004355': - 'Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are developed.', - 'CCI-004356': - 'Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are maintained.', - 'CCI-004357': - 'Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems are developed.', - 'CCI-004358': - 'Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational information systems are maintained.', - 'CCI-004359': - 'Implement a process for ensuring that organizational plans for conducting privacy testing associated with organizational systems continue to be executed.', - 'CCI-004360': - 'Implement a process for ensuring that organizational plans for conducting privacy training associated with organizational systems continue to be executed.', - 'CCI-004361': - 'Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems continue to be executed.', - 'CCI-004362': - 'Establish and institutionalize contact with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel.', - 'CCI-004363': - 'Establish and institutionalize contact with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies.', - 'CCI-004364': - 'Establish and institutionalize contact with selected groups and associations within the privacy community to share current privacy information including threats, vulnerabilities, and incidents.', - 'CCI-004365': - 'Employ automated means to maximize the effectiveness of sharing threat intelligence information.', - 'CCI-004366': - 'Establish policy to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.', - 'CCI-004367': - 'Establish procedures to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.', - 'CCI-004368': - 'Review and update the policy for Controlled Unclassified Information on an organization-defined frequency.', - 'CCI-004369': - 'Defines the frequency in which the policy for Controlled Unclassified information is reviewed and updated.', - 'CCI-004370': - 'Review and update the procedures for Controlled Unclassified Information on an organization-defined frequency.', - 'CCI-004371': - 'Defines the frequency in which the procedures for Controlled Unclassified information is reviewed and updated.', - 'CCI-004372': - "Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program.", - 'CCI-004373': - "Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program.", - 'CCI-004374': - "Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program.", - 'CCI-004375': - "Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program.", - 'CCI-004376': - "Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and provides an overview of the requirements for the privacy program.", - 'CCI-004377': - "Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and provides an overview of the requirements for the privacy program.", - 'CCI-004378': - "Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements.", - 'CCI-004379': - "Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements.", - 'CCI-004380': - "Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities.", - 'CCI-004381': - "Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities.", - 'CCI-004382': - "Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program.", - 'CCI-004383': - "Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program.", - 'CCI-004384': - "Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy.", - 'CCI-004385': - "Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy.", - 'CCI-004386': - "Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.", - 'CCI-004387': - "Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.", - 'CCI-004388': 'Update the plan on an organization-defined frequency.', - 'CCI-004389': - 'Update the plan to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.', - 'CCI-004390': - 'Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to coordinate applicable privacy requirements.', - 'CCI-004391': - 'Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to develop applicable privacy requirements.', - 'CCI-004392': - 'Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to implement applicable privacy requirements.', - 'CCI-004393': - 'Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to manage privacy risks through the organization-wide privacy program.', - 'CCI-004394': - "Maintain a central resource webpage on the organization's principle public website that serves as a central source of information about the organization's privacy plan.", - 'CCI-004395': - 'Ensure that the public has access to information about organizational privacy activities.', - 'CCI-004396': - 'Ensure that the public can communicate with its Senior Agency Official for Privacy.', - 'CCI-004397': - 'Ensure that organizational privacy practices and reports are publicly available.', - 'CCI-004398': - 'Employ publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.', - 'CCI-004399': - 'Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are written in plain language.', - 'CCI-004400': - 'Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are organized in a way that is easy to understand and navigate.', - 'CCI-004401': - 'Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that provide information needed by the public to make an informed about whether and how to interact with the organization.', - 'CCI-004402': - 'Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are updated whenever the organization makes a substantive change to the practices it describes.', - 'CCI-004403': - 'Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that includes a time/date stamp to inform the public of the date of the most recent changes.', - 'CCI-004404': - 'Develop an accurate accounting of disclosures of personally identifiable information.', - 'CCI-004405': - 'Maintain an accurate accounting of disclosures of personally identifiable information.', - 'CCI-004406': - 'Develop an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record.', - 'CCI-004407': - 'Maintain an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record.', - 'CCI-004408': - 'Develop an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made.', - 'CCI-004409': - 'Maintain an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made.', - 'CCI-004410': - 'Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.', - 'CCI-004411': - 'Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.', - 'CCI-004412': - 'Develop and document organization-wide policies for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle.', - 'CCI-004413': - 'Develop and document organization-wide procedures for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle.', - 'CCI-004414': - 'Develop and document organization-wide policies for correcting or deleting inaccurate or outdated personally identifiable information.', - 'CCI-004415': - 'Develop and document organization-wide procedures for correcting or deleting inaccurate or outdated personally identifiable information.', - 'CCI-004416': - 'Develop and document organization-wide policies for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.', - 'CCI-004417': - 'Develop and document organization-wide procedures for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.', - 'CCI-004418': - 'Develop and document organization-wide policies for appeals of adverse decisions on correction or deletion requests.', - 'CCI-004419': - 'Develop and document organization-wide procedures for appeals of adverse decisions on correction or deletion requests.', - 'CCI-004420': - 'Establish a Data Governance Body consisting of organization-defined roles with organization-defined responsibilities.', - 'CCI-004421': - 'Defines the roles that are established by the Data Governance Body.', - 'CCI-004422': - 'Defines the responsibilities the Data Governance Body establishes.', - 'CCI-004423': - 'Establish a Data Integrity Board to review proposals to conduct or participate in a matching program.', - 'CCI-004424': - 'Establish a Data Integrity Board to conduct an annual review of all matching programs in which the agency has participated.', - 'CCI-004425': - 'Develop and document policies that address the use of personally identifiable information for internal testing, training, and research.', - 'CCI-004426': - 'Develop and document procedures that address the use of personally identifiable information for internal testing, training, and research.', - 'CCI-004427': - 'Implement policies that address the use of personally identifiable information for internal testing, training, and research.', - 'CCI-004428': - 'Implement procedures that address the use of personally identifiable information for internal testing, training, and research.', - 'CCI-004429': - 'Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes.', - 'CCI-004430': - 'Authorize the use of personally identifiable information when such information is required for internal testing, training, and research.', - 'CCI-004431': - 'Review and update policies on an organization-defined frequency.', - 'CCI-004432': - 'Defines the frequency of which the policies should be reviewed and updated.', - 'CCI-004433': - 'Review and update procedures on an organization-defined frequency.', - 'CCI-004434': - 'Defines the frequency of which the procedures should be reviewed and updated.', - 'CCI-004435': - 'Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational security practices.', - 'CCI-004436': - 'Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational privacy practices.', - 'CCI-004437': 'Implement mechanisms that are easy to use.', - 'CCI-004438': - 'Implement mechanisms that are readily available by the public.', - 'CCI-004439': - 'Implement all information necessary for successfully filing complaints.', - 'CCI-004440': - 'Implement tracking mechanisms to ensure all complaints received are reviewed and appropriately addressed within an organization-defined time period.', - 'CCI-004441': - 'Defines the time period of which the tracking mechanisms to ensure all complaints received are reviewed and addressed.', - 'CCI-004442': - 'Implement acknowledgement of receipt of complaints, concerns, or questions from individuals within an organization-defined time period.', - 'CCI-004443': - 'Defines the time period for acknowledging the receipt of complaints, concerns, or questions from individuals.', - 'CCI-004444': - 'Implement response to complaints, concerns, or questions from individuals within an organization-defined time period.', - 'CCI-004445': - 'Defines the time period for response to complaints, concerns, or questions from individuals.', - 'CCI-004446': 'Develop organization-defined privacy reports.', - 'CCI-004447': 'Defines the privacy reports that are to be developed.', - 'CCI-004448': - 'Disseminate privacy reports to organization-defined oversight bodies to demonstrate accountability with statutory, regulatory, and policy privacy program mandates.', - 'CCI-004449': - 'Develop privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program progress and compliance.', - 'CCI-004450': - 'Disseminate privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program compliance.', - 'CCI-004451': - 'Defines the officials responsible for monitoring privacy program compliance.', - 'CCI-004452': - 'Review and update privacy reports on an organization-defined frequency.', - 'CCI-004453': - 'Defines the frequency of which the privacy reports are reviewed and updated.', - 'CCI-004454': - 'Identify and document assumptions affecting risk assessments, risk response, and risk monitoring.', - 'CCI-004455': - 'Identify and document constraints affecting risk assessments, risk response, and risk monitoring.', - 'CCI-004456': - 'Identify and document priorities and trade-offs considered by the organization for managing risk.', - 'CCI-004457': 'Identify and document the organizational risk tolerance.', - 'CCI-004458': - 'Distribute the results of risk framing activities to organization-defined personnel.', - 'CCI-004459': - 'Defines the personnel to distribute the results of risk framing activities.', - 'CCI-004460': - 'Review and update risk framing considerations on an organization-defined frequency.', - 'CCI-004461': - 'Defines the frequency for reviewing and updating risk framing considerations.', - 'CCI-004462': - 'Appoint a Senior Accountable Official for Risk Management to align organizational information security management processes with strategic, operational, and budgetary planning processes.', - 'CCI-004463': - 'Appoint a Senior Accountable Official for Risk Management to align organizational information privacy management processes with strategic, operational, and budgetary planning processes.', - 'CCI-004464': - 'Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective.', - 'CCI-004465': - 'Establish a Risk Executive (function) to ensure management of risk is consistent across the organization.', - 'CCI-004466': - 'Develop an organization-wide strategy for managing supply chain risks associated with the development of systems, system components, and system services.', - 'CCI-004467': - 'Develop an organization-wide strategy for managing supply chain risks associated with the acquisition of systems, system components, and system services.', - 'CCI-004468': - 'Develop an organization-wide strategy for managing supply chain risks associated with the maintenance of systems, system components, and system services.', - 'CCI-004469': - 'Develop an organization-wide strategy for managing supply chain risks associated with the disposal of systems, system components, and system services.', - 'CCI-004470': - 'Implement the supply chain risk management strategy consistently across the organization.', - 'CCI-004471': - 'Review and update the supply chain risk management strategy on an organization-defined frequency or as required, to address organizational changes.', - 'CCI-004472': - 'Defines the frequency of which the supply chain risk management strategy will be reviewed and updated.', - 'CCI-004473': - 'Develop an organization-wide continuous monitoring strategy establishing organization-defined metrics to be monitored.', - 'CCI-004474': - 'Implement continuous monitoring programs that include establishing organization-wide metrics to be monitored.', - 'CCI-004475': - 'Defines the metrics for developing and implementing continuous monitoring programs.', - 'CCI-004476': - 'Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for monitoring.', - 'CCI-004477': - 'Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for assessment of control effectiveness.', - 'CCI-004478': - 'Defines the frequencies for developing and implementing continuous monitoring programs for monitoring.', - 'CCI-004479': - 'Implement continuous monitoring programs that include establishing organization-wide frequencies for monitoring.', - 'CCI-004480': - 'Implement continuous monitoring programs that include establishing organization-wide frequencies for assessment of control effectiveness.', - 'CCI-004481': - 'Defines the frequencies for developing and implementing continuous monitoring programs for assessment of control effectiveness.', - 'CCI-004482': - 'Develop an organization-wide continuous monitoring strategy for ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy.', - 'CCI-004483': - 'Implement continuous monitoring programs that include ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy.', - 'CCI-004484': - 'Develop an organization-wide continuous monitoring strategy for correlation and analysis of information generated by control assessments and monitoring.', - 'CCI-004485': - 'Implement continuous monitoring programs that include correlation and analysis of information generated by control assessments and monitoring.', - 'CCI-004486': - 'Develop an organization-wide continuous monitoring strategy for response actions to address results of the analysis of control assessment and monitoring information.', - 'CCI-004487': - 'Implement continuous monitoring programs that include response actions to address results of the analysis of control assessment and monitoring information.', - 'CCI-004488': - 'Develop an organization-wide continuous monitoring strategy for reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.', - 'CCI-004489': - 'Develop an organization-wide continuous monitoring strategy for reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.', - 'CCI-004490': - 'Implement continuous monitoring programs that include reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.', - 'CCI-004491': - 'Implement continuous monitoring programs that include reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.', - 'CCI-004492': - 'Defines the personnel or roles for whom to report the security status of organizational systems.', - 'CCI-004493': - 'Defines the personnel or roles for whom to report the privacy status of organizational systems.', - 'CCI-004494': - 'Defines the frequency of reporting the security status of organizational systems to organization-defined personnel or roles.', - 'CCI-004495': - 'Defines the frequency of reporting the privacy status of organizational systems to organization-defined personnel or roles.', - 'CCI-004496': - 'Analyze organization-defined systems or system components supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.', - 'CCI-004497': - 'Defines the systems or system components that are used to analyze mission essential services or functions.', - 'CCI-004498': - 'Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004499': - 'Designate an organization-defined official to manage the development and documentation of the personnel security policy.', - 'CCI-004500': - 'Designate an organization-defined official to manage the dissemination of the personnel security policy.', - 'CCI-004501': - 'Defines the official who will manage the personnel security policy.', - 'CCI-004502': - 'Designate an organization-defined official to manage development and documentation of the personnel security procedures.', - 'CCI-004503': - 'Designate an organization-defined official to manage the dissemination of the personnel security procedures.', - 'CCI-004504': - 'Defines the official who will manage the personnel security procedures.', - 'CCI-004505': - 'Review and update the current personnel security policy following organization-defined events.', - 'CCI-004506': - 'Defines the events following reviewing and updating the current personnel security policy.', - 'CCI-004507': - 'Review and update the current personnel security procedures following organization-defined events.', - 'CCI-004508': - 'Defines the events following reviewing and updating the current personnel security procedures.', - 'CCI-004509': - 'Verify that individuals accessing a system processing, storing, or transmitting organization-defined information types meet organization-defined citizenship requirements.', - 'CCI-004510': - 'Defines the information types that meet the organization-defined citizenship requirement.', - 'CCI-004511': - 'Defines the citizenship requirements for individuals accessing a system, storing, or transmitting organization-defined information types.', - 'CCI-004512': - 'Defines the automated mechanisms for notifying organization-defined personnel or roles of individual termination actions; and/or disable access to system resources.', - 'CCI-004513': - 'Verify that individuals requiring access to organizational information sign appropriate access agreements prior to being granted access.', - 'CCI-004514': - 'Verify that individuals requiring access to organizational systems sign appropriate access agreements prior to being granted access.', - 'CCI-004515': - 'Verify that individuals requiring access to organizational information re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.', - 'CCI-004516': - 'Verify that individuals requiring access to organizational systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.', - 'CCI-004517': - 'Defines the frequency for individuals requiring access to organizational information to re-sign access agreements.', - 'CCI-004518': - 'Defines the frequency for individuals requiring access to organizational systems to re-sign access agreements.', - 'CCI-004519': - 'Require external providers to comply with personnel security policies established by the organization.', - 'CCI-004520': - 'Require external providers to comply with personnel security procedures established by the organization.', - 'CCI-004521': - 'Employ a formal sanctions process for individuals failing to comply with established information security policies.', - 'CCI-004522': - 'Employ a formal sanctions process for individuals failing to comply with established information security procedures.', - 'CCI-004523': - 'Incorporate security roles and responsibilities into organizational position descriptions.', - 'CCI-004524': - 'Incorporate privacy roles and responsibilities into organizational position descriptions.', - 'CCI-004525': - 'Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-004526': - 'Disseminate organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy to organization-defined personnel or roles.', - 'CCI-004527': - 'Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy is to be disseminated.', - 'CCI-004528': - 'Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004529': - 'Develop and document procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls.', - 'CCI-004530': - 'Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency policy.', - 'CCI-004531': - 'Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency procedures.', - 'CCI-004532': - 'Defines the official designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures.', - 'CCI-004533': - 'Review and update the current personally identifiable information processing and transparency policy on an organization-defined frequency.', - 'CCI-004534': - 'Review and update the current personally identifiable information processing and transparency policy following organization-defined events.', - 'CCI-004535': - 'Defines the events following reviewing and updating the current personally identifiable processing and transparency policy.', - 'CCI-004536': - 'Review and update the current personally identifiable information processing and transparency procedures on an organization-defined frequency.', - 'CCI-004537': - 'Review and update the current personally identifiable information processing and transparency procedures following organization-defined events.', - 'CCI-004538': - 'Defines the events following reviewing and updating the current personally identifiable processing and transparency procedures.', - 'CCI-004539': - 'Determine and document the organization-defined authority that permits the organization-defined processing of personally identifiable information.', - 'CCI-004540': - 'Defines the authority who will permit the organization-defined processing of personally identifiable information.', - 'CCI-004541': - 'Defines the processing of the personally identifiable information.', - 'CCI-004542': - 'Restrict the organization-defined processing of personally identifiable information to only that which is authorized.', - 'CCI-004543': - 'Defines the processing of the personally identifiable information to only that which is authorized.', - 'CCI-004544': - 'Attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information.', - 'CCI-004545': - 'Defines the authorized processing which will attach data tags to organization-defined elements of personally identifiable information.', - 'CCI-004546': - 'Defines the elements of personally identifiable information containing organization-defined authorized processing.', - 'CCI-004547': - 'Manage enforcement of the authorized processing of personally identifiable information using organization-defined automated mechanisms.', - 'CCI-004548': - 'Defines the automated mechanisms for managing enforcement of the authorized processing of personally identifiable information.', - 'CCI-004549': - 'Identify and document the organization-defined purpose(s) for processing personally identifiable information.', - 'CCI-004550': - 'Defines the purpose(s) of identifying and documenting personally identifiable information.', - 'CCI-004551': - 'Describe the purpose(s) in the public privacy notices and policies of the organization.', - 'CCI-004552': - 'Restrict the organization-defined processing of personally identifiable information to only that which is compatible with the identified purpose(s).', - 'CCI-004553': - 'Defines the processing of personally identifiable information to only that which is compatible with the identified purpose(s).', - 'CCI-004554': - 'Monitor changes in processing personally identifiable information.', - 'CCI-004555': - 'Implement organization-defined mechanisms to ensure that any changes are made in accordance with organization-defined requirements.', - 'CCI-004556': - 'Defines the mechanisms for ensuring any changes are made in accordance with organization-defined requirements.', - 'CCI-004557': - 'Defines the requirements for implementing organization-defined mechanisms.', - 'CCI-004558': - 'Attach data tags containing organization-defined processing purposes to organization-defined elements of personally identifiable information.', - 'CCI-004559': - 'Defines the elements of personally identifiable information containing organization-defined processing purposes.', - 'CCI-004560': - 'Track processing purposes of personally identifiable information using organization-defined automated mechanisms.', - 'CCI-004561': - "Implement organization-defined tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making.", - 'CCI-004562': - "Defines the tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making.", - 'CCI-004563': - 'Provide organization-defined mechanisms to allow individuals to tailor processing permissions to selected elements of personally identifiable information.', - 'CCI-004564': - 'Defines the mechanisms for allowing individuals to tailor processing permissions to selected elements of personally identifiable information.', - 'CCI-004565': - 'Present organization-defined consent mechanisms to individuals at an organization-defined frequency and in conjunction with organization-defined personally identifiable information processing.', - 'CCI-004566': - 'Defines the frequency for presenting organization-defined consent mechanisms to individuals.', - 'CCI-004567': - 'Defines the consent mechanisms needed by individuals on an organization-defined frequency, with organization-defined personally identifiable information processing.', - 'CCI-004568': - 'Defines the personally identifiable information processing needed for presenting organization-defined consent mechanisms to individuals.', - 'CCI-004569': - 'Implement organization-defined tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information.', - 'CCI-004570': - 'Defines the tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information.', - 'CCI-004571': - 'Provide notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization, and subsequently at an organization-defined frequency.', - 'CCI-004572': - 'Defines the frequency for providing notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization.', - 'CCI-004573': - 'Provide notice to individuals about the processing of personally identifiable information is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language.', - 'CCI-004574': - 'Provide notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information.', - 'CCI-004575': - 'Provide notice to individuals about the processing of personally identifiable information that identifies the purposes for which personally identifiable information is to be processes.', - 'CCI-004576': - 'Provide notice to individuals about the processing of personally identifiable information that includes organization-defined information.', - 'CCI-004577': - 'Defines the information that includes providing notice to individuals about the processing of personally identifiable information.', - 'CCI-004578': - 'Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action or organization-defined frequency.', - 'CCI-004579': - 'Defines the frequency for presenting notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action.', - 'CCI-004580': - 'Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.', - 'CCI-004581': - 'For systems that process information that will be maintained in a Privacy Act system of records: draft system of records notices in accordance with OMB guidance.', - 'CCI-004582': - 'For systems that process information that will be maintained in a Privacy Act system of records: submit new and significantly modified system of records notices to the OMB and appropriate committees for advance review.', - 'CCI-004583': - 'For systems that process information that will be maintained in a Privacy Act system of records: publish system of records notices in the Federal Register.', - 'CCI-004584': - 'For systems that process information that will be maintained in a Privacy Act system of records: keep system of records notices accurate, up-to-date, and scoped in accordance with policy.', - 'CCI-004585': - 'Review all routine uses published in the system of records notice at an organization-defined frequency to ensure continued accuracy.', - 'CCI-004586': - 'Defines the frequency for reviewing all routine uses in published in the system of records notice.', - 'CCI-004587': - 'Review all routine uses published in the system of records notice at an organization-defined frequency to ensure that routine uses continue to be compatible with the purpose for which the information was collected.', - 'CCI-004588': - 'Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they remain appropriate and necessary with law.', - 'CCI-004589': - 'Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they have been promulgated as regulations.', - 'CCI-004590': - 'Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure that they are accurately described in the system of records notice.', - 'CCI-004591': - 'Defines the frequency for reviewing all Privacy Act exemptions claimed for the system of records.', - 'CCI-004592': - 'Apply organization-defined processing conditions for specific categories of personally identifiable information.', - 'CCI-004593': - 'Defines the processing conditions for applying specific categories of personally identifiable information.', - 'CCI-004594': - 'When a system processes Social Security numbers: eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier.', - 'CCI-004595': - "When a system processes Social Security numbers: do not deny any individuals any right, benefit, or privilege provided by law because of such individuals' refusal to disclose his or her Social Security number.", - 'CCI-004596': - 'When a system processes Social Security numbers: inform any individual who is asked to disclose his or Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.', - 'CCI-004597': - 'Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statue or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.', - 'CCI-004598': - 'When a system or organization processes information for the purpose of conducting a matching program: obtain approval from the Data Integrity Board to conduct the matching program.', - 'CCI-004599': - 'When a system or organization processes information for the purpose of conducting a matching program: develop and enter into a computer matching agreement.', - 'CCI-004600': - 'When a system or organization processes information for the purpose of conducting a matching program: publish a matching notice in the Federal Register.', - 'CCI-004601': - 'When a system or organization processes information for the purpose of conducting a matching program: independently verify the information produced by the matching program before taking adverse action against an individual, if required.', - 'CCI-004602': - 'When a system or organization processes information for the purpose of conducting a matching program: provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.', - 'CCI-004603': - 'Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004604': - 'Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines, to organization-defined personnel or roles.', - 'CCI-004605': - 'Designate an organization-defined official to manage the development and documentation of the risk assessment policy.', - 'CCI-004606': - 'Designate an organization-defined official to manage the dissemination of the risk assessment policy.', - 'CCI-004607': - 'Designate an organization-defined official to manage development and documentation of the risk assessment procedures.', - 'CCI-004608': - 'Designate an organization-defined official to manage dissemination of the risk assessment procedures.', - 'CCI-004609': - 'Defines the official designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures.', - 'CCI-004610': - 'Review and update the current risk assessment policy following organization-defined events.', - 'CCI-004611': - 'Defines the events following reviewing and updating the current risk assessment policy.', - 'CCI-004612': - 'Review and update the current risk assessment procedures following organization-defined events.', - 'CCI-004613': - 'Defines the events following reviewing and updating the current risk assessment procedures.', - 'CCI-004614': 'Categorize the system and information it processes.', - 'CCI-004615': 'Categorize the system and information it stores.', - 'CCI-004616': 'Categorize the system and information it transmits.', - 'CCI-004617': - 'Conduct a impact-level categorization of organizational systems to obtain additional granularity on system impact levels.', - 'CCI-004618': - 'Conduct a risk assessment, including identifying threats to the system.', - 'CCI-004619': - 'Conduct a risk assessment, including identifying vulnerabilities in the system.', - 'CCI-004620': - 'Conduct a risk assessment, including determining the likelihood and impact of adverse effects on individuals arising from the processing of personally-identifiable information.', - 'CCI-004621': 'Integrate risk assessment results from the organization.', - 'CCI-004622': 'Integrate risk management decisions from the organization.', - 'CCI-004623': - 'Integrate mission or business process perspectives with system-level risk assessments.', - 'CCI-004624': - 'Assess supply chain risks associated with organization-defined systems, system components, and system services.', - 'CCI-004625': - 'Defines the systems, system-components, and system services for assessing supply chain risks.', - 'CCI-004626': - 'Update the supply chain risk assessment on an organization-defined frequency when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.', - 'CCI-004627': - 'Defines the frequency for updating the supply chain assessment.', - 'CCI-004628': - 'Use all-source intelligence to assist in the analysis of risk.', - 'CCI-004629': - 'Determine the current cyber threat environment on an ongoing basis using organization-defined means.', - 'CCI-004630': - 'Defines the means for determining the current threat environment.', - 'CCI-004631': - 'Employ organization-defined advanced automation and analytics capabilities to predict and identify risks to organization-defined systems or system components.', - 'CCI-004632': - 'Defines the advanced automation and analytics capabilities for predicting and identifying risks to organization-defined systems or system components.', - 'CCI-004633': - 'Defines the systems or system components for employing advanced automation and analytics capabilities.', - 'CCI-004634': - 'Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: formatting checklists and test procedures.', - 'CCI-004635': - 'Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: measuring vulnerability impact.', - 'CCI-004636': - 'Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.', - 'CCI-004637': - 'Defines the automated mechanisms for comparing the results of multiple vulnerability scans.', - 'CCI-004638': - 'Defines the system in which will be identified for determining if a vulnerability has been exploited.', - 'CCI-004639': - 'Defines the time period for reviewing historic audit logs to determine if a vulnerability identified has been exploited.', - 'CCI-004640': - 'Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.', - 'CCI-004641': 'Respond to findings from security assessments.', - 'CCI-004642': 'Respond to findings from privacy assessments.', - 'CCI-004643': 'Respond to findings from monitoring.', - 'CCI-004644': - 'Respond to findings from audits in accordance with organizational risk tolerance.', - 'CCI-004645': - 'Conduct privacy impact assessments for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information.', - 'CCI-004646': - 'Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that will be processes using information technology.', - 'CCI-004647': - 'Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more persons, other than agencies, instrumentalities, or employees of the Federal Government.', - 'CCI-004648': - 'Identify critical system components and functions by performing a criticality analysis for organization-defined systems, system components, or system services at organization-defined decision points in the system development life cycle.', - 'CCI-004649': - 'Defines the system, system components, or system services to perform a criticality analysis for identifying critical system components and functions.', - 'CCI-004650': - 'Defines the decision points in the system development life cycle at which organization-defined system, system components, or system services to perform a criticality analysis for identifying critical system components and functions.', - 'CCI-004651': - 'Establish and maintain a cyber threat hunting capability to search for indicators of compromise in organizational systems.', - 'CCI-004652': - 'Establish and maintain a cyber threat hunting capability to detect, track, and disrupt threats that evade existing controls.', - 'CCI-004653': - 'Employ the threat hunting capability on an organization-defined frequency.', - 'CCI-004654': - 'Defines the frequency for employing the threat hunting capability.', - 'CCI-004655': - 'Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that is consistent with applicable laws, Executive Orders, directives, regulations, polices, standards, and guidelines.', - 'CCI-004656': - 'Designate an organization-defined official to manage development and documentation of the system and services acquisition policy.', - 'CCI-004657': - 'Designate an organization-defined official to manage dissemination of the system and services acquisition policy.', - 'CCI-004658': - 'Defines the official designated to manage development and documentation of the system and services acquisition policy.', - 'CCI-004659': - 'Designate an organization-defined official to manage the development and documentation of the system and services acquisition procedures.', - 'CCI-004660': - 'Designate an organization-defined official to manage the dissemination of the system and services acquisition procedures.', - 'CCI-004661': - 'Defines the official designated to manage the system and services acquisition procedures.', - 'CCI-004662': - 'Review and update the current system and services acquisition policy following organization-defined events.', - 'CCI-004663': - 'Defines the events following reviewing and updating the current system and services acquisition policy.', - 'CCI-004664': - 'Review and update the current system and services acquisition procedures following organization-defined events.', - 'CCI-004665': - 'Defines the events following reviewing and updating the current system and services acquisition procedures.', - 'CCI-004666': - 'Determine the high-level information privacy requirements for the system or system service in mission and business process planning.', - 'CCI-004667': - 'Establish a discrete line item for information privacy in organizational programming documentation.', - 'CCI-004668': - 'Establish a discrete line item for information privacy in organizational budgeting documentation.', - 'CCI-004669': - 'Acquire the system using an organization-defined system development life cycle that incorporates information security considerations.', - 'CCI-004670': - 'Acquire the system using an organization-defined system development life cycle that incorporates information privacy considerations.', - 'CCI-004671': - 'Develop the system using an organization-defined system development life cycle that incorporates information security considerations.', - 'CCI-004672': - 'Develop the system using an organization-defined system development life cycle that incorporates information privacy considerations.', - 'CCI-004673': - 'Manage the system using an organization-defined system development life cycle that incorporates information privacy considerations.', - 'CCI-004674': - 'Defines a system development life cycle that is used to develop the system.', - 'CCI-004675': - 'Defines a system development life cycle that is used to acquire the system.', - 'CCI-004676': - 'Define and document information system privacy roles and responsibilities throughout the system development life cycle.', - 'CCI-004677': - 'Identify individuals having information system privacy roles and responsibilities.', - 'CCI-004678': - 'Integrate the organizational information privacy risk management process into system development life cycle activities.', - 'CCI-004679': - 'Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service.', - 'CCI-004680': - 'Approve the use of live data in preproduction environments for the system, system component, or system service.', - 'CCI-004681': - 'Document the use of live data in preproduction environments for the system, system component, or system service.', - 'CCI-004682': - 'Control the use of live data in preproduction environments for the system, system component, or system service.', - 'CCI-004683': - 'Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments.', - 'CCI-004684': - 'Plan for a technology refresh schedule to support the system throughout the system development life cycle.', - 'CCI-004685': - 'Implement technology refresh schedule to support the system throughout the system development life cycle.', - 'CCI-004686': - 'Defines the organization-defined contract language for including the requirements, descriptions, and criteria in the acquisition contract for the system, system component, or system service.', - 'CCI-004687': - 'Include the privacy functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004688': - 'Include the privacy assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004689': - 'Include the controls needed to satisfy security requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004690': - 'Include the controls needed to satisfy privacy requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004691': - 'Include the privacy documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004692': - 'Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004693': - 'Include the requirements for protecting privacy documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004694': - 'Include the allocation of responsibility or identification of parties responsible for information security, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004695': - 'Include the allocation of responsibility or identification of parties responsible for information privacy, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004696': - 'Include the allocation of responsibility or identification of parties responsible for supply chain risk management, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.', - 'CCI-004697': - 'Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined systems engineering methods.', - 'CCI-004698': - 'Defines the systems engineering methods for demonstrating the use of a system development life cycle process.', - 'CCI-004699': - 'Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined system security engineering methods and/or privacy engineering methods.', - 'CCI-004700': - 'Defines the system security engineering methods and/or privacy engineering methods for demonstrating the use of a system development life cycle process.', - 'CCI-004701': - 'Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes.', - 'CCI-004702': - 'Defines the software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes for demonstrating the use of a system development life cycle process.', - 'CCI-004703': - 'Include organization-defined Privacy Act requirements in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.', - 'CCI-004704': - 'Defines the Privacy Act requirements to include in the acquisition contract.', - 'CCI-004705': - 'Include organizational data ownership requirements in the acquisition contract.', - 'CCI-004706': - "Require all data to be removed from the contractor's system and returned to the organization within an organization-defined time frame.", - 'CCI-004707': - "Defines the time frame for returning the data removed from the contractor's system.", - 'CCI-004708': - 'Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of privacy functions and mechanisms.', - 'CCI-004709': - 'Obtain or develop user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms and how to effectively use those functions and mechanisms.', - 'CCI-004710': - 'Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to protect individual privacy.', - 'CCI-004711': - 'Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the privacy of individuals.', - 'CCI-004712': - 'Defines the systems security and privacy engineering principles applied to the specification of the system and system components.', - 'CCI-004713': - 'Defines the systems security engineering principles applied to the design of the system and system components.', - 'CCI-004714': - 'Defines the systems security engineering principles applied to the development of the system and system components.', - 'CCI-004715': - 'Defines the systems security engineering principles applied to the implementation of the system and system components.', - 'CCI-004716': - 'Defines the systems security engineering principles applied to the modification of the system and system components.', - 'CCI-004717': - 'Implement the security design principle of clear abstractions.', - 'CCI-004718': - 'Implement the security design principle of least common mechanism in organization-defined systems or system components.', - 'CCI-004719': - 'Defines the systems or system components which will implement the security design principle of least common mechanism.', - 'CCI-004720': - 'Implement the security design principles of modularity and layering in organization-defined systems or system components.', - 'CCI-004721': - 'Defines the systems or system components which will implement the security design principles of modularity and layering.', - 'CCI-004722': - 'Implement the security design principle of partially ordered dependencies in organization-defined systems or system components.', - 'CCI-004723': - 'Defines the systems or system components which will implement the security design principle of partially ordered dependencies.', - 'CCI-004724': - 'Implement the security design principle of efficiently mediated access in organization-defined systems or system components.', - 'CCI-004725': - 'Defines the systems or system components which will implement the security design principle of efficiently mediated access.', - 'CCI-004726': - 'Implement the security design principle of minimized sharing in organization-defined systems or system components.', - 'CCI-004727': - 'Defines the systems or system components which will implement the security design principle of minimized sharing.', - 'CCI-004728': - 'Implement the security design principle of reduced complexity in organization-defined systems or system components.', - 'CCI-004729': - 'Defines the systems or system components which will implement the security design principle of reduced complexity.', - 'CCI-004730': - 'Implement the security design principle of secure evolvability in organization-defined systems or system components.', - 'CCI-004731': - 'Defines the systems or system components which will implement the security design principle of secure evolvability.', - 'CCI-004732': - 'Implement the security design principle of trusted components in organization-defined systems or system components.', - 'CCI-004733': - 'Defines the systems or system components which will implement the security design principle of trusted components.', - 'CCI-004734': - 'Implement the security design principle of hierarchical trust in organization-defined systems or system components.', - 'CCI-004735': - 'Defines the systems or system components which will implement the security design principle of hierarchical trust.', - 'CCI-004736': - 'Implement the security design principle of inverse modification threshold in organization-defined systems or system components.', - 'CCI-004737': - 'Defines the systems or system components which will implement the security design principle of inverse modification threshold.', - 'CCI-004738': - 'Implement the security design principle of hierarchical protection in organization-defined systems or system components.', - 'CCI-004739': - 'Defines the systems or system components which will implement the security design principle of hierarchical protection.', - 'CCI-004740': - 'Implement the security design principle of minimized security elements in organization-defined systems or system components.', - 'CCI-004741': - 'Defines the systems or system components which will implement the security design principle of minimized security elements.', - 'CCI-004742': - 'Implement the security design principle of least privilege in organization-defined systems or system components.', - 'CCI-004743': - 'Defines the systems or system components which will implement the security design principle of least privilege.', - 'CCI-004744': - 'Implement the security design principle of predicate permission in organization-defined systems or system components.', - 'CCI-004745': - 'Defines the systems or system components which will implement the security design principle of predicate permission.', - 'CCI-004746': - 'Implement the security design principle of self-reliant trustworthiness in organization-defined systems or system components.', - 'CCI-004747': - 'Defines the systems or system components which will implement the security design principle of self-reliant trustworthiness.', - 'CCI-004748': - 'Implement the security design principle of secure distributed composition in organization-defined systems or system components.', - 'CCI-004749': - 'Defines the systems or system components which will implement the security design principle of secure distributed composition.', - 'CCI-004750': - 'Implement the security design principle of trusted communication channels in organization-defined systems or system components.', - 'CCI-004751': - 'Defines the systems or system components which will implement the security design principle of trusted communication channels.', - 'CCI-004752': - 'Implement the security design principle of continuous protection in organization-defined systems or system components.', - 'CCI-004753': - 'Defines the systems or system components which will implement the security design principle of continuous protection.', - 'CCI-004754': - 'Implement the security design principle of secure metadata management in organization-defined systems or system components.', - 'CCI-004755': - 'Defines the systems or system components which will implement the security design principle of secure metadata management.', - 'CCI-004756': - 'Implement the security design principle of self-analysis in organization-defined systems or system components.', - 'CCI-004757': - 'Defines the systems or system components which will implement the security design principle of self-analysis.', - 'CCI-004758': - 'Implement the security design principle of accountability and traceability in organization-defined systems or system components.', - 'CCI-004759': - 'Defines the systems or system components which will implement the security design principle of accountability and traceability.', - 'CCI-004760': - 'Implement the security design principle of secure defaults in organization-defined systems or system components.', - 'CCI-004761': - 'Defines the systems or system components which will implement the security design principle of secure defaults.', - 'CCI-004762': - 'Implement the security design principle of secure failure and recovery in organization-defined systems or system components.', - 'CCI-004763': - 'Defines the systems or system components which will implement the security design principle of secure failure and recovery.', - 'CCI-004764': - 'Implement the security design principle of economic security in organization-defined systems or system components.', - 'CCI-004765': - 'Defines the systems or system components which will implement the security design principle of economic security.', - 'CCI-004766': - 'Implement the security design principle of performance security in organization-defined systems or system components.', - 'CCI-004767': - 'Defines the systems or system components which will implement the security design principle of performance security.', - 'CCI-004768': - 'Implement the security design principle of human factored security in organization-defined systems or system components.', - 'CCI-004769': - 'Defines the systems or system components which will implement the security design principle of human factored security.', - 'CCI-004770': - 'Implement the security design principle of acceptable security in organization-defined systems or system components.', - 'CCI-004771': - 'Defines the systems or system components which will implement the security design principle of acceptable security.', - 'CCI-004772': - 'Implement the security design principle of repeatable and documented procedures in organization-defined systems or system components.', - 'CCI-004773': - 'Defines the systems or system components which will implement the security design principle of repeatable and documented procedures.', - 'CCI-004774': - 'Implement the security design principle of procedural rigor in organization-defined systems or system components.', - 'CCI-004775': - 'Defines the systems or system components which will implement the security design principle of procedural rigor.', - 'CCI-004776': - 'Implement the security design principle of secure system modification in organization-defined systems or system components.', - 'CCI-004777': - 'Defines the systems or system components which will implement the security design principle of secure system modification.', - 'CCI-004778': - 'Implement the security design principle of sufficient documentation in organization-defined systems or system components.', - 'CCI-004779': - 'Defines the systems or system components which will implement the security design principle of sufficient documentation.', - 'CCI-004780': - 'Implement the privacy principle of minimization using organization-defined processes.', - 'CCI-004781': - 'Defines the processes for implementing the privacy principle of minimization.', - 'CCI-004782': - 'Require that providers of external system services comply with organizational privacy requirements.', - 'CCI-004783': - 'Require that providers of external system services employ organization-defined controls.', - 'CCI-004784': - 'Defines the controls for complying with organizational security and privacy requirements.', - 'CCI-004785': - 'Define and document organizational oversight with regard to external system services.', - 'CCI-004786': - 'Define and document user roles and responsibilities with regard to external system services.', - 'CCI-004787': - 'Establish trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.', - 'CCI-004788': - 'Document trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.', - 'CCI-004789': - 'Maintain trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.', - 'CCI-004790': - 'Defines privacy requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.', - 'CCI-004791': - 'Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.', - 'CCI-004792': - 'Provide the capability to check the integrity of organizational information while it resides in the external system.', - 'CCI-004793': - 'Restrict the geographic location of information processing and data storage to facilities located within the legal jurisdictional boundary of the United States.', - 'CCI-004794': - 'Require the developer of the system, system component, or system service to document the potential privacy impacts of approved changes to the system, component, or service.', - 'CCI-004795': - 'Require organization-defined security and privacy representatives to be included in the organization-defined configuration change management and control process.', - 'CCI-004796': - 'Defines the security and privacy representatives to be included the organization-defined configuration change management and control process.', - 'CCI-004797': - 'Defines the configuration change management and control process required for the organization-defined security and privacy representatives.', - 'CCI-004798': - 'Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing privacy control assessment.', - 'CCI-004799': - 'Require the developer of the system, system component, or system service to implement a plan for ongoing privacy control assessment.', - 'CCI-004800': - 'Defines the frequency that the unit, integration, system, and/or regression testing/evaluation is performed at an organization-defined depth and coverage.', - 'CCI-004801': 'Use the following contextual information.', - 'CCI-004802': - 'Defines the information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.', - 'CCI-004803': 'Employ the following tools and methods.', - 'CCI-004804': 'Defines the tools and methods to be employed.', - 'CCI-004805': - 'Conduct the modeling and analyses as the following level of rigor.', - 'CCI-004806': - 'Defines the breadth and depth of modeling and analyses the level of rigor will be conducted.', - 'CCI-004807': - 'Produces evidence that meets the following acceptance criteria.', - 'CCI-004808': - 'Defines the acceptance criteria that meets the requirement for producing evidence.', - 'CCI-004809': - 'Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer privacy assessment plan.', - 'CCI-004810': - 'Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during privacy testing and evaluation.', - 'CCI-004811': - 'Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer privacy assessment plan and the evidence produced during privacy testing and evaluation.', - 'CCI-004812': - 'Require the developer of the system, system component, or system service to perform penetration testing at an organization-defined breadth and depth of testing.', - 'CCI-004813': - 'Require the developer of the system, system component, or system service to perform penetration testing under organization-defined constraints.', - 'CCI-004814': - 'Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws.', - 'CCI-004815': - 'Require the developer of the system, system component, or system service to employ interactive application security testing tools to document the results.', - 'CCI-004816': - 'Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses privacy requirements.', - 'CCI-004817': - 'Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined privacy requirements.', - 'CCI-004818': - 'Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined privacy requirements.', - 'CCI-004819': - 'Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined privacy requirements.', - 'CCI-004820': - 'Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements.', - 'CCI-004821': - 'Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements.', - 'CCI-004822': - 'Defines the privacy requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations.', - 'CCI-004823': - 'Require the developer of the system, system component, or system service to select a privacy tracking tool for use during the development process.', - 'CCI-004824': - 'Require the developer of the system, system component, or system service to employ a privacy tracking tool for use during the development process.', - 'CCI-004825': - 'Require the developer of the system, system component, or system service to perform a criticality analysis at the organization-defined decision points in the system development life cycle.', - 'CCI-004826': - 'Require the developer of the system, system component, or system service to perform a criticality analysis at an organization-defined breadth/depth of criticality analysis.', - 'CCI-004827': - 'Defines the frequency for performing an automated vulnerability analysis using organization-defined tools.', - 'CCI-004828': - 'Defines the frequency for determining the exploitation potential for discovered vulnerabilities.', - 'CCI-004829': - 'Defines the frequency for determining potential risk mitigations for delivered vulnerabilities.', - 'CCI-004830': - 'Defines the frequency for delivering the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles.', - 'CCI-004831': - 'Require the developer of the system, system component, or system service to implement an incident response plan.', - 'CCI-004832': - 'Require the developer of the system, system component, or system service to test an incident response plan.', - 'CCI-004833': - 'Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final privacy review.', - 'CCI-004834': - 'Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.', - 'CCI-004835': - 'Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms.', - 'CCI-004836': - 'Defines the training the developer of the system, system component, or information system service is required to provide on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms.', - 'CCI-004837': - 'Require the developer of the system, system component, or system service to produce a privacy architecture.', - 'CCI-004838': - "Require the developer of the system, system component, or system service to produce a privacy architecture that is consistent with and supportive of the organization's privacy architecture which is established within and is an integrated part of the organization's enterprise architecture.", - 'CCI-004839': - 'Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the required privacy functionality.', - 'CCI-004840': - 'Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the allocation of privacy controls among physical and logical components.', - 'CCI-004841': - 'Require the developer of the system, system component, or system service to produce a privacy architecture that expresses how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.', - 'CCI-004842': - 'Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational privacy policy to be enforced.', - 'CCI-004843': - 'Defines the elements of organizational privacy policy to be described in the formal policy model for enforcement on the system, system component, or system service.', - 'CCI-004844': - 'Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational privacy policy when implemented.', - 'CCI-004845': - 'Design organization-defined critical systems or system components with coordinated behavior to implement organization-defined capabilities, by system or component.', - 'CCI-004846': - 'Defines the critical systems or system components for implementing organization-defined capabilities, by system or component.', - 'CCI-004847': - 'Defines the capabilities, by system or component, for designing organization-defined critical systems or system components.', - 'CCI-004848': - 'Use different designs for organization-defined critical systems or system components to satisfy a common set of requirements or to provide equivalent functionality.', - 'CCI-004849': - 'Defines the critical systems or system components for satisfying a common set of requirements or to provide equivalent functionality.', - 'CCI-004850': - 'Employ design; modification; augmentation; and/or reconfiguration on organization-defined systems or system components supporting mission essential services or functions to increase the trustworthiness in those systems or components.', - 'CCI-004851': - 'Defines the systems or system components for supporting mission essential services or functions.', - 'CCI-004852': - 'Develop and document an organization-level; mission/business process-level; and/or system-level system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-004853': - 'Develop and document an organization-level; mission/business process-level; and/or system-level a system and communications protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004854': - 'Develop and document system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.', - 'CCI-004855': - 'Designate an organization-defined official to manage the development and documentation of the system and communications protection policy.', - 'CCI-004856': - 'Designate an organization-defined official to manage the development and documentation of the system and communications protection procedures.', - 'CCI-004857': - 'Designate an organization-defined official to manage the dissemination of the system and communications protection policy.', - 'CCI-004858': - 'Designate an organization-defined official to manage the dissemination of the system and communications protection procedures.', - 'CCI-004859': - 'Defines the official to manage the development, documentation, and dissemination of the system and communications protection policy.', - 'CCI-004860': - 'Defines the official to manage the development, documentation, and dissemination of the system and communications protection procedures.', - 'CCI-004861': - 'Review and update the current system and communications protection policy following organization-defined events.', - 'CCI-004862': - 'Defines the events following reviewing and updating the current system and communications protection policy.', - 'CCI-004863': - 'Review and update the current system and communications protection procedures following organization-defined events.', - 'CCI-004864': - 'Defines the events following reviewing and updating the current system and communications protection procedures.', - 'CCI-004865': - 'Store state information from applications and software separately.', - 'CCI-004866': - 'Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.', - 'CCI-004867': - 'Defines the controls by type of denial-of-service event by employing the controls to achieve the denial-of-service objective.', - 'CCI-004868': - 'Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational privacy architecture.', - 'CCI-004869': - 'Prevent unauthorized exchange of control plane traffic with external networks.', - 'CCI-004870': - 'Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks.', - 'CCI-004871': - 'Filter unauthorized control plane traffic from external networks.', - 'CCI-004872': - 'Defines the systems that will deny network communications traffic by default and allow network communications traffic by exception.', - 'CCI-004873': - 'Defines the safeguards to prevent split tunneling for remote devices connecting to organizational systems.', - 'CCI-004874': - 'Conduct exfiltration tests at an organization-defined frequency.', - 'CCI-004875': 'Defines the frequency to conduct exfiltration tests.', - 'CCI-004876': - 'For systems that process personally identifiable information, apply organization-defined processing rules to data elements of personally identifiable information.', - 'CCI-004877': - 'Defines processing rules to be applied to data elements of personally identifiable information.', - 'CCI-004878': - 'For systems that process personally identifiable information, monitor for permitted processing at the external boundary of the system and at key internal boundaries within the system.', - 'CCI-004879': - 'For systems that process personally identifiable information, document each processing exception.', - 'CCI-004880': - 'For systems that process personally identifiable information, review and remove exceptions that are no longer supported.', - 'CCI-004881': - 'Prohibit the direct connection of organization-defined unclassified national security system to an external network without the use of organization-defined boundary protection device.', - 'CCI-004882': - 'Defines the unclassified national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device.', - 'CCI-004883': - 'Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified national security system to an external system.', - 'CCI-004884': - 'Prohibit the direct connection of a classified national security system to an external network without the use of organization-defined boundary protection device.', - 'CCI-004885': - 'Defines the boundary protection device that prohibits the direct connection of a classified national security system to an external system.', - 'CCI-004886': - 'Prohibit the direct connection of organization-defined unclassified non-national security system to an external network without the use of organization-defined boundary protection device.', - 'CCI-004887': - 'Defines the unclassified non-national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device.', - 'CCI-004888': - 'Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified non-national security system to an external system.', - 'CCI-004889': - 'Prohibit the direct connection of organization-defined system to a public network.', - 'CCI-004890': - 'Defines the system that prohibits the direct connection to a public network.', - 'CCI-004891': - 'Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.', - 'CCI-004892': - 'Defines the critical system components to implement physically or logically separate subnetworks.', - 'CCI-004893': - 'Implement organization-defined protection distribution system to prevent unauthorized disclosure of information, and/or detect changes to information during transmission.', - 'CCI-004894': - 'Defines the protected distribution system for preventing unauthorized disclosure of information, and/or detect changes to information during transmission.', - 'CCI-004895': - 'Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication.', - 'CCI-004896': - 'Initiates the trusted communications path for communications between the organization-defined security functions of the system and the user.', - 'CCI-004897': - 'Defines the security functions to be initiated between the system and the user for trusted communications path for communications.', - 'CCI-004898': - 'Defines requirements for certificates that are issued for producing, controlling, and distributing asymmetric cryptographic keys.', - 'CCI-004899': - 'Maintain physical control of cryptographic keys when store information is encrypted by external service providers.', - 'CCI-004900': 'Determine the organization-defined cryptographic uses.', - 'CCI-004901': - 'Associate organization-defined privacy attributes with information exchanged between systems.', - 'CCI-004902': - 'Associate organization-defined privacy attributes with information exchanged between system components.', - 'CCI-004903': - 'Defines the privacy attributes to associate with the information being exchanged between systems and between system components.', - 'CCI-004904': 'Verify the integrity of transmitted privacy attributes.', - 'CCI-004905': - 'Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.', - 'CCI-004906': - 'Implement organization-defined mechanisms or techniques to bind security attributes to transmitted information.', - 'CCI-004907': - 'Implement organization-defined mechanisms or techniques to bind privacy attributes to transmitted information.', - 'CCI-004908': - 'Defines the mechanisms or techniques for binding security and privacy attributes to transmitted information.', - 'CCI-004909': - 'Include only approved trust anchors in trust stores or certificate stores managed by the organization.', - 'CCI-004910': - 'Provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.', - 'CCI-004911': - 'Defines the safeguards for providing protected storage for cryptographic keys.', - 'CCI-004912': - 'Partition privileged functions into separate physical domains.', - 'CCI-004913': - 'Takes organization-defined actions in response to identified faults, errors, or compromises.', - 'CCI-004914': - 'Defines actions to take in response to identified faults, errors, or compromises.', - 'CCI-004915': - 'Synchronize the organization-defined duplicate systems or system components.', - 'CCI-004916': - 'Defines the duplicate systems or system components to be synchronized.', - 'CCI-004917': - "Defines sensors to facilitate an individual's awareness that personally identifiable information is being collected.", - 'CCI-004918': - "Defines measures to facility an individual's awareness that personally identifiable information is being collected.", - 'CCI-004919': - "Employ organization-defined measures to facilitate an individual's awareness that personally identifiable information is being collected by organization-defined sensors.", - 'CCI-004920': - 'Defines sensors that are configured to minimize the collection of information about individuals that is not needed.', - 'CCI-004921': - 'Employ organization-defined sensors that are configured to minimize the collection of information about individuals that is not needed.', - 'CCI-004922': - 'Synchronize system clocks within and between systems or system components.', - 'CCI-004923': - 'Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.', - 'CCI-004924': - 'Defines the frequency for comparing the internal system clocks with organization-defined authoritative time source.', - 'CCI-004925': - 'Defines the time source used for comparing the internal system clocks.', - 'CCI-004926': - 'Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period.', - 'CCI-004927': - 'Defines the time period for synchronizing the internal system clocks to the authoritative time source.', - 'CCI-004928': - 'Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source.', - 'CCI-004929': - 'Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable.', - 'CCI-004930': - 'Implement a policy enforcement mechanism physically or logically between the physical and/or network interfaces for the connecting security domains.', - 'CCI-004931': - 'Establish organization-defined alternate communications paths for system operations organizational command and control.', - 'CCI-004932': - 'Relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances.', - 'CCI-004933': - 'Defines the sensors and monitoring capabilities to be relocated to organization-defined locations.', - 'CCI-004934': - 'Defines the locations of which the organization-defined sensors and monitoring capabilities will be relocated.', - 'CCI-004935': - 'Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are relocated.', - 'CCI-004936': - 'Dynamically relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances.', - 'CCI-004937': - 'Defines the sensors and monitoring capabilities to be dynamically relocated to organization-defined locations.', - 'CCI-004938': - 'Defines the locations of which the organization-defined sensors and monitoring capabilities will be dynamically relocated.', - 'CCI-004939': - 'Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are dynamically relocated.', - 'CCI-004940': - 'Implement hardware-enforced separation and policy enforcement mechanisms between organization-defined security domains.', - 'CCI-004941': - 'Defines the security domains for implementing hardware-enforced separation and policy enforcement mechanisms.', - 'CCI-004942': - 'Implement software-enforced separation and policy enforcement mechanisms between organization-defined security domains.', - 'CCI-004943': - 'Defines the security domains for implementing software-enforced separation and policy enforcement mechanisms.', - 'CCI-004944': - 'Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-004945': - 'Designate an organization-defined official to manage the development and documentation of the system and information integrity policy.', - 'CCI-004946': - 'Designate an organization-defined official to manage the dissemination of the system and information integrity policy.', - 'CCI-004947': - 'Designate an organization-defined official to manage the development and documentation of the system and information integrity procedures.', - 'CCI-004948': - 'Designate an organization-defined official to manage the dissemination of the system and information integrity procedures.', - 'CCI-004949': - 'Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity policy.', - 'CCI-004950': - 'Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity procedures.', - 'CCI-004951': - 'Review and update the current system and information integrity policy following organization-defined events.', - 'CCI-004952': - 'Defines the events following reviewing and updating the current system and information integrity policy.', - 'CCI-004953': - 'Review and update the current system and information integrity procedures following organization-defined events.', - 'CCI-004954': - 'Defines the events following reviewing and updating the current system and information integrity procedures.', - 'CCI-004955': - 'Determine if system components have applicable security-related software updates installed using organization-defined mechanisms on an organization-defined frequency.', - 'CCI-004956': - 'Determine if system components have applicable security-related firmware updates installed using organization-defined mechanisms on an organization-defined frequency.', - 'CCI-004957': - 'Defines a frequency for installing security-relevant software updates using organization-defined automated mechanisms.', - 'CCI-004958': - 'Defines a frequency for installing security-relevant firmware updates using organization-defined automated mechanisms.', - 'CCI-004959': - 'Defines the automated mechanisms for determining if system components have applicable security-related software updates installed.', - 'CCI-004960': - 'Defines the automated mechanisms for determining if system components have applicable security-related firmware updates installed.', - 'CCI-004961': - 'Employ automated patch management tools to facilitate flaw remediation to the organization-defined system components.', - 'CCI-004962': - 'Defines the system components on which patch management tools to facilitate flaw remediation are employed.', - 'CCI-004963': - 'Implement signature based and/or non-signature based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.', - 'CCI-004964': - 'Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy.', - 'CCI-004965': - 'Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management procedures.', - 'CCI-004966': - 'Configure malicious code protection mechanisms to send alerts to organization-defined personnel in response to malicious code detection.', - 'CCI-004967': 'Analyze detected events and anomalies.', - 'CCI-004968': - 'Employ automated mechanisms to support near real-time analysis of events.', - 'CCI-004969': - 'Employ automated mechanisms to integrate intrusion detection mechanisms into access control mechanisms.', - 'CCI-004970': - 'Employ automated mechanisms to integrate intrusion detection mechanisms into flow control mechanisms.', - 'CCI-004971': - 'Determine criteria for unusual or unauthorized activities or conditions for inbound communications traffic.', - 'CCI-004972': - 'Determine criteria for unusual or unauthorized activities or conditions for outbound communications traffic.', - 'CCI-004973': - 'Defines the unusual or unauthorized activities or conditions that will be monitored for inbound communications traffic.', - 'CCI-004974': - 'Defines the unusual or unauthorized activities or conditions that will be monitored for outbound communications traffic.', - 'CCI-004975': - 'Test intrusion monitoring mechanisms at an organization-defined frequency.', - 'CCI-004976': - 'Defines the frequency for testing intrusion monitoring mechanisms.', - 'CCI-004977': - 'Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring mechanisms.', - 'CCI-004978': - 'Defines the system monitoring mechanisms that will have visibility into organization-defined encrypted communications traffic.', - 'CCI-004979': - 'Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring mechanisms.', - 'CCI-004980': - 'Defines the personnel or roles to receive alerts when indications of inappropriate or unusual activities with security or privacy occur.', - 'CCI-004981': - 'Correlate information from monitoring mechanisms employed throughout the system.', - 'CCI-004982': - 'Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.', - 'CCI-004983': - 'Defines the automated mechanisms for broadcasting security alert and advisory information.', - 'CCI-004984': - 'Defines the privacy functions that require verification of correct operation.', - 'CCI-004985': - 'Verify correct operation of organization-defined privacy functions.', - 'CCI-004986': - 'Defines the frequency at which it will verify correct operation of organization-defined privacy functions.', - 'CCI-004987': - 'Defines the system transitional states when the system will verify correct operation of organization-defined privacy functions.', - 'CCI-004988': - 'Perform verification of the correct operation of organization-defined privacy functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.', - 'CCI-004989': - 'Alert organization-defined personnel or roles of failed privacy verification tests.', - 'CCI-004990': - 'Defines the personnel or roles to be notified when privacy verification tests fail.', - 'CCI-004991': - 'Defines alternative action(s) to be taken when anomalies in the operation of organization-defined privacy functions are discovered.', - 'CCI-004992': - 'Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined privacy functions are discovered.', - 'CCI-004993': - 'Implement automated mechanisms to support the management of distributed privacy function testing.', - 'CCI-004994': - 'Report the results of privacy function verification to organization-defined personnel or roles.', - 'CCI-004995': - 'Defines the personnel or roles that are to receive reports on the results of privacy function verification.', - 'CCI-004996': - 'Take organization-defined actions when unauthorized changes to the software, firmware, and information are detected.', - 'CCI-004997': - 'Defines the actions to be taken when unauthorized changes to the software, firmware, and information are detected.', - 'CCI-004998': - 'Implement organization-defined controls for application self-protection at runtime.', - 'CCI-004999': - 'Defines the controls to be implemented for runtime application self-protection.', - 'CCI-005000': - 'Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy.', - 'CCI-005001': - 'Update spam protection mechanisms when new releases are available in accordance with organizational configuration management procedures.', - 'CCI-005002': - 'Defines the frequency for updating spam protection mechanisms.', - 'CCI-005003': 'Prevent untrusted data injections.', - 'CCI-005004': - 'Limit personally identifiable information being processed in the information life cycle to the organization-defined elements of personally identifiable information.', - 'CCI-005005': - 'Defines the elements of personally identifiable information being processed in the information life cycle.', - 'CCI-005006': - 'Use organization-defined techniques to minimize the use of personally identifiable information for research, testing, or training, in accordance with the privacy risk assessment.', - 'CCI-005007': - 'Defines the techniques for minimizing the use of personally identifiable information for research, testing, or training.', - 'CCI-005008': - 'Use organization-defined techniques to dispose of, destroy, or erase information following the retention period.', - 'CCI-005009': - 'Defines the percentage of the mean time to failure used to manually initiate transfer between active and standby system components.', - 'CCI-005010': - 'Defines the action to be taken when system failures are detected.', - 'CCI-005011': - 'Refresh organization-defined information on an organization-defined frequency, or generate organization-defined information on demand.', - 'CCI-005012': - 'Defines the information to be refreshed on an organization-defined frequency.', - 'CCI-005013': - 'Defines the frequency at which to refresh organization-defined information.', - 'CCI-005014': 'Defines the information to be generated on demand.', - 'CCI-005015': 'Delete information when no longer needed.', - 'CCI-005016': 'Refresh connections to the system on demand.', - 'CCI-005017': - 'Terminate connections after completion of a request, or a period of non-use.', - 'CCI-005018': - 'Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle, on an organization-defined frequency.', - 'CCI-005019': - 'Defines the frequency for checking the accuracy, relevance, timeliness, and completeness of personally identifiable information.', - 'CCI-005020': - 'Correct or delete inaccurate or outdated personally identifiable information.', - 'CCI-005021': - 'Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using organization-defined mechanisms.', - 'CCI-005022': - 'Defines the automated mechanisms for identifying inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified personally identifiable information.', - 'CCI-005023': - 'Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.', - 'CCI-005024': - 'Collect personally identifiable information directly from the individual.', - 'CCI-005025': - 'Correct or delete personally identifiable information upon request by individuals or their designated representatives.', - 'CCI-005026': - 'Notify organization-defined recipients of personally identifiable information that the personally identifiable information has been corrected or deleted.', - 'CCI-005027': - 'Defines the recipients of personally identifiable information who are to be notified when the personally identifiable information is corrected or deleted.', - 'CCI-005028': - 'Notify individuals that the personally identifiable information has been corrected or deleted.', - 'CCI-005029': - 'Remove the following elements of personally identifiable information from datasets.', - 'CCI-005030': - 'Defines the elements of personally identifiable information to be removed from datasets.', - 'CCI-005031': - 'Evaluate organization-defined frequency for effectiveness of de-identification.', - 'CCI-005032': - 'Defines the frequency for evaluating for effectiveness of de-identification.', - 'CCI-005033': - 'De-identify the dataset upon collection by not collecting personally identifiable information.', - 'CCI-005034': - 'Prohibit archiving personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.', - 'CCI-005035': - 'Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.', - 'CCI-005036': - 'Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.', - 'CCI-005037': - 'Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.', - 'CCI-005038': - 'Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.', - 'CCI-005039': - 'Perform de-identification using validated algorithms and software that is validated to implement the algorithms.', - 'CCI-005040': - 'Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.', - 'CCI-005041': - 'Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization.', - 'CCI-005042': - 'Defines the systems or system components used to determine if organizational data has been exfiltrated or improperly removed from the organization.', - 'CCI-005043': - 'Refresh organization-defined information at organization-defined frequencies or generate the information on demand and delete the information when no longer needed.', - 'CCI-005044': - 'Defines the information to be refreshed at organization-defined frequencies or generate the information on demand and delete the information when no longer needed.', - 'CCI-005045': - 'Defines the frequencies for refreshing organization-defined information.', - 'CCI-005046': - 'Identify the following alternate sources of information for organization-defined essential functions and services.', - 'CCI-005047': - 'Defines the alternative information sources for identifying organization-defined essential functions and services.', - 'CCI-005048': - 'Use an alternate information source for the execution of essential functions or services on organization-defined systems or system components when the primary source of information is corrupted or unavailable.', - 'CCI-005049': - 'Defines the systems or system components used as an alternate information source for the execution of essential functions or services when the primary source of information is corrupted or unavailable.', - 'CCI-005050': - 'Based on organization-defined circumstances, fragment the following information.', - 'CCI-005051': 'Defines the information for fragmentation.', - 'CCI-005052': - 'Defines the circumstances for fragmenting organization-defined information.', - 'CCI-005053': - 'Based on organization-defined circumstances, distribute the fragmented information across the following systems or system components.', - 'CCI-005054': - 'Defines the systems or system components used to distribute fragmented information.', - 'CCI-005055': - 'Defines the circumstances for distributing fragmented information across organization-defined systems or system components.', - 'CCI-005056': - 'Disseminate an organization-level, mission/business process-level, and/or system-level supply chain risk management policy to organization-defined personnel or roles.', - 'CCI-005057': - 'Develop and document an organization-level, mission/business process-level, and/or system-level supply chain risk management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.', - 'CCI-005058': - 'Develop and document organization-level, mission/business process-level, and/or system-level supply chain risk management policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.', - 'CCI-005059': - 'Develop and document procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls.', - 'CCI-005060': - 'Designate an organization-defined official to manage the development and documentation of the supply chain risk management policy.', - 'CCI-005061': - 'Designate an organization-defined official to manage the development and documentation of the supply chain risk management procedures.', - 'CCI-005062': - 'Designate an organization-defined official to manage the dissemination of the supply chain risk management policy.', - 'CCI-005063': - 'Designate an organization-defined official to manage the dissemination of the supply chain risk management procedures.', - 'CCI-005064': - 'Review and update the current supply chain risk management policy on an organization-defined frequency.', - 'CCI-005065': - 'Defines the frequency for reviewing and updating the current supply chain risk management policy.', - 'CCI-005066': - 'Review and update the current supply chain risk management policy following organization-defined events.', - 'CCI-005067': - 'Defines the events following reviewing and updating the current supply chain risk management policy.', - 'CCI-005068': - 'Review and update the current supply chain risk management procedures on an organization-defined frequency.', - 'CCI-005069': - 'Defines the frequency for reviewing and updating the current supply chain risk management procedures.', - 'CCI-005070': - 'Review and update the current supply chain risk management procedures following organization-defined events.', - 'CCI-005071': - 'Defines the events following reviewing and updating the current supply chain risk management procedures.', - 'CCI-005072': - 'Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components, or system services.', - 'CCI-005073': - 'Defines the systems, system components, or system services that a plan for managing supply chain risks are developed.', - 'CCI-005074': - 'Review and update the supply chain risk management plan on an organization-defined frequency, or as required, to address threat, organizational or environmental changes.', - 'CCI-005075': - 'Defines the frequency for reviewing and updating the supply chain risk management plan.', - 'CCI-005076': - 'Protect the supply chain risk management plan from unauthorized disclosure and modification.', - 'CCI-005077': - 'Establish a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities to lead and support the following SCRM activities.', - 'CCI-005078': - 'Defines the supply chain risk management activities that will be led by a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities.', - 'CCI-005079': - 'Defines the personnel, roles, and responsibilities who lead and support organization-defined supply chain risk management activities.', - 'CCI-005080': - 'Establish a process of processes to identify and address weaknesses or deficiencies in the supply chain elements of organization-defined system or system components in coordination with organization-defined supply chain personnel.', - 'CCI-005081': - 'Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.', - 'CCI-005082': - 'Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.', - 'CCI-005083': - 'Establish a process of processes to identify and address weaknesses or deficiencies in the processes of organization-defined system or system components in coordination with organization-defined supply chain personnel.', - 'CCI-005084': - 'Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.', - 'CCI-005085': - 'Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.', - 'CCI-005086': - 'Employ the following controls to protect against supply chain risks to the system, system component, or system service.', - 'CCI-005087': - 'Limit the harm or consequences from supply chain-related events.', - 'CCI-005088': - 'Defines the supply chain controls employed for protecting against supply chain risks to the system, system component, or system service.', - 'CCI-005089': - 'Document the selected and implemented supply chain processes and controls in security and privacy plans, supply chain risk management plan, or organization-defined document.', - 'CCI-005090': - 'Defines the document which contains supply chain processes and controls.', - 'CCI-005091': - 'Employ a diverse set of sources for the following system components and services.', - 'CCI-005092': - 'Defines the system or system components and services which employ a diverse set of sources.', - 'CCI-005093': - 'Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain.', - 'CCI-005094': - 'Defines the controls to be employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.', - 'CCI-005095': - 'Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.', - 'CCI-005096': - 'Document valid provenance of the following systems, system components, and associated data.', - 'CCI-005097': - 'Monitor valid provenance of the following systems, system components, and associated data.', - 'CCI-005098': - 'Maintain valid provenance of the following systems, system components, and associated data.', - 'CCI-005099': - 'Defines the systems, system components, and associated data for documenting, monitoring, and maintaining valid provenance.', - 'CCI-005100': - 'Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components.', - 'CCI-005101': - 'Defines the supply chain elements, processes, and personnel associated with organization-defined systems and critical system components for establishing and maintaining unique identification.', - 'CCI-005102': - 'Establish and maintain unique identification of the following systems and critical components for tracking through the supply chain.', - 'CCI-005103': - 'Defines the systems and critical system components for tracking through the supply chain.', - 'CCI-005104': - 'Employ the following controls to validate that the system or system component received is genuine.', - 'CCI-005105': - 'Employ the following controls to validate that the system or system component received has not been altered.', - 'CCI-005106': - 'Defines the controls for validating that the system or system component received is genuine.', - 'CCI-005107': - 'Defines the controls for validating that the system or system component received has not been altered.', - 'CCI-005108': - 'Employ organization-defined controls to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services.', - 'CCI-005109': - 'Defines the controls for ensuring the integrity of the system and system components.', - 'CCI-005110': - 'Conduct organization-defined analysis to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services.', - 'CCI-005111': - 'Defines the analysis for ensuring the integrity of the system and system components.', - 'CCI-005112': - 'Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks.', - 'CCI-005113': - 'Defines the acquisition strategies, contract tools, and procurement methods for protecting against, identifying, and mitigating supply chain risks.', - 'CCI-005114': - 'Employ the following controls to ensure an adequate supply of organization-defined critical system components.', - 'CCI-005115': - 'Defines the controls for ensuring an adequate supply of organization-defined critical system components.', - 'CCI-005116': - 'Defines the critical system components that the organization-defined controls ensure an adequate supply of.', - 'CCI-005117': - 'Access the system, system component, or system service prior to selection, acceptance, modification, or update.', - 'CCI-005118': - 'Access and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide on an organization-defined frequency.', - 'CCI-005119': - 'Defines the frequency for assessing and reviewing the supply chain risks.', - 'CCI-005120': - 'Employ organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing of the following supply chain elements, processes, and actors associated with the system, system component, or system service.', - 'CCI-005121': - 'Defines the supply chain elements, processes, and actors for employing organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing.', - 'CCI-005122': - 'Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service.', - 'CCI-005123': - 'Defines the Operations Security (OPSEC) controls that protect supply chain-related information for the system, system component, or system service.', - 'CCI-005124': - 'Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the notification of supply chain compromises, results of assessments or audits, and/or organization-defined information.', - 'CCI-005125': - 'Defines the information for establishing agreements and procedures with entities involved in the supply chain for the system, system component, or system service.', - 'CCI-005126': - 'Implement a tamper protection program for the system, system component, or system service.', - 'CCI-005127': - 'Employ anti-tamper technologies, tool, and techniques throughout the system development life cycle.', - 'CCI-005128': - 'Inspect the following systems or system components at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.', - 'CCI-005129': - 'Defines the frequency for inspecting systems or system components.', - 'CCI-005130': - 'Defines the indications of need for inspection for detecting tampering.', - 'CCI-005131': - 'Defines the system or system components which will be inspected at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.', - 'CCI-005132': - 'Develop and document anti-counterfeit policy that include the means to detect and prevent counterfeit components from entering the system.', - 'CCI-005133': - 'Develop and document anti-counterfeit procedures that include the means to detect and prevent counterfeit components from entering the system.', - 'CCI-005134': - 'Report counterfeit system components to source of counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles.', - 'CCI-005135': - 'Defines the external reporting organizations who report counterfeit system components.', - 'CCI-005136': - 'Defines the personnel or roles who report counterfeit system components.', - 'CCI-005137': - 'Train organization-defined personnel or roles to detect counterfeit system components including hardware, software, and firmware.', - 'CCI-005138': - 'Defines the personnel or roles who are trained to detect counterfeit system components (including hardware, software, and firmware).', - 'CCI-005139': - 'Maintain configuration control over the following system components awaiting service or repair.', - 'CCI-005140': - 'Maintain configuration control over serviced or repaired components awaiting return to service.', - 'CCI-005141': 'Defines the system components awaiting service or repair.', - 'CCI-005142': - 'Scan for counterfeit system components on an organization-defined frequency.', - 'CCI-005143': - 'Defines the frequency for which the counterfeit system components are scanned.', - 'CCI-005144': - 'Dispose of organization-defined data, documentation, tools, or system components using the following techniques and methods.', - 'CCI-005145': - 'Defines the data, documentation, tools, or system components which are to be disposed of using organization-defined techniques and methods.', - 'CCI-005146': - 'Defines the techniques or methods used to dispose of organization-defined data, documentation, tools, or system components.', - 'CCI-005147': - 'Provide basic privacy literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users.', - 'CCI-005149': - 'Implement organization-defined measures to disassociate individuals from audit information transmitted across organizational boundaries.', - 'CCI-005150': - 'Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.' -}; +export const CCI_TO_NIST: Record = cciToNistData; +export const CCI_TO_DEFINITION: Record = cciToDefinitionData; diff --git a/libs/hdf-converters/src/mappings/U_CCI_List.defs.json b/libs/hdf-converters/src/mappings/U_CCI_List.defs.json new file mode 100644 index 0000000000..48d32d8ea5 --- /dev/null +++ b/libs/hdf-converters/src/mappings/U_CCI_List.defs.json @@ -0,0 +1 @@ +{"CCI-000001":"The organization develops an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000002":"Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.","CCI-000003":"Review and update the current access control policy on an organization-defined frequency.","CCI-000004":"The organization develops procedures to facilitate the implementation of the access control policy and associated access controls.","CCI-000005":"Disseminate procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls to the organization-defined personnel or roles.","CCI-000006":"Review and update the current access control procedures on an organization-defined frequency.","CCI-000007":"The organization manages information system accounts by identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary).","CCI-000008":"The organization establishes conditions for group membership.","CCI-000009":"The organization manages information system accounts by identifying authorized users of the information system and specifying access privileges.","CCI-000010":"Require approvals by organization-defined personnel or roles for requests to create accounts.","CCI-000011":"Create, enable, modify, disable, and remove system accounts in accordance with organization-defined procedures.","CCI-000012":"Review accounts for compliance with account management requirements per organization-defined frequency.","CCI-000013":"The organization manages information system accounts by notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes.","CCI-000014":"The organization manages information system accounts by granting access to the system based on a valid access authorization; intended system usage; and other attributes as required by the organization or associated missions/business functions.","CCI-000015":"Support the management of system accounts using organization-defined automated mechanisms.","CCI-000016":"Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account.","CCI-000017":"Disable accounts when the accounts have been inactive for the organization-defined time-period.","CCI-000018":"Automatically audit account creation actions.","CCI-000019":"Require that users log out in accordance with the organization-defined time-period of expected inactivity or description of when to log out.","CCI-000020":"The information system dynamically manages user privileges and associated access authorizations.","CCI-000021":"Enforce dual authorization for organization-defined privileged commands and/or other organization-defined actions.","CCI-000022":"The information system enforces one or more organization-defined nondiscretionary access control policies over an organization-defined set of users and resources.","CCI-000023":"The organization develops an organization-wide information security program plan that provides sufficient information about the program management controls and common controls (including specification of parameters for any assignment and selection operations either explicitly or by reference) to enable an implementation that is unambiguously compliant with the intent of the plan, and a determination of the risk to be incurred if the plan is implemented as intended.","CCI-000024":"Prevent access to organization-defined security-relevant information except during secure, non-operable system states.","CCI-000025":"The information system enforces information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions.","CCI-000026":"Use protected processing domains to enforce organization-defined information flow control policies as a basis for flow control decisions.","CCI-000027":"Enforce organization-defined information flow control policies.","CCI-000028":"Prevent encrypted information from bypassing organization-defined flow control mechanisms by employing organization-defined procedures or methods.","CCI-000029":"Enforce organization-defined limitations on embedding data types within other data types.","CCI-000030":"Enforce information flow control based on organization-defined metadata.","CCI-000031":"Enforce one-way information flows using hardware-based flow control mechanisms.","CCI-000032":"Enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.","CCI-000033":"The information system enforces the use of human review for organization-defined security policy filters when the system is not capable of making an information flow control decision.","CCI-000034":"Provide the capability for privileged administrators to enable and disable organization-defined security or privacy filters under organization-defined conditions.","CCI-000035":"Provide the capability for privileged administrators to configure the organization-defined security or privacy policy filters to support different security or privacy policies.","CCI-000036":"The organization separates organization-defined duties of individuals.","CCI-000037":"The organization implements separation of duties through assigned information system access authorizations.","CCI-000038":"The organization explicitly authorizes access to organization-defined security functions and security-relevant information.","CCI-000039":"Require that users of system accounts, or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts or roles, when accessing nonsecurity functions.","CCI-000040":"The organization audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions.","CCI-000041":"Authorize network access to organization-defined privileged commands only for organization-defined compelling operational needs.","CCI-000042":"Document the rationale for authorized network access to organization-defined privileged commands in the security plan for the system.","CCI-000043":"Defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period.","CCI-000044":"Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.","CCI-000045":"The organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period.","CCI-000046":"The organization selects either a lock out mode for the organization-defined time period or delays the next login prompt for the organization-defined delay period for information system responses to consecutive invalid access attempts.","CCI-000047":"The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccessful attempts is exceeded, automatically locks the account/node for an organization-defined time period or locks the account/node until released by an Administrator IAW organizational policy.","CCI-000048":"Display an organization-defined system use notification message or banner to users before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines.","CCI-000049":"The organization defines a system use notification message or banner displayed before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) use of the system indicates consent to monitoring and recording.","CCI-000050":"Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.","CCI-000051":"The organization approves the information system use notification message before its use.","CCI-000052":"Notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access).","CCI-000053":"Notify the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.","CCI-000054":"Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.","CCI-000055":"Defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type.","CCI-000056":"Retain the device lock until the user reestablishes access using established identification and authentication procedures.","CCI-000057":"Prevent further access to the system by initiating a device lock after organization-defined time period of inactivity; and/or requiring the user to initiate a device lock before leaving the system unattended.","CCI-000058":"The information system provides the capability for users to directly initiate session lock mechanisms.","CCI-000059":"Defines the time-period of inactivity after which the system initiates a device lock.","CCI-000060":"Conceal, via the device lock, information previously visible on the display with a publicly viewable image.","CCI-000061":"Identify organization-defined user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.","CCI-000062":"The organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission/business objectives.","CCI-000063":"The organization defines allowed methods of remote access to the information system.","CCI-000064":"The organization establishes usage restrictions and implementation guidance for each allowed remote access method.","CCI-000065":"Authorize remote access to the system prior to allowing such connections.","CCI-000066":"The organization enforces requirements for remote connections to the information system.","CCI-000067":"Employ automated mechanisms to monitor remote access methods.","CCI-000068":"Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.","CCI-000069":"Route all remote accesses through authorized and managed network access control points.","CCI-000070":"Authorize the execution of privileged commands via remote access only in a format that provides assessable evidence for organization-defined needs.","CCI-000071":"The organization monitors for unauthorized remote connections to the information system on an organization-defined frequency.","CCI-000072":"Protect information about remote access mechanisms from unauthorized use and disclosure.","CCI-000073":"Develop an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.","CCI-000074":"Develop an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.","CCI-000075":"Review and update the organization-wide information security program plan on an organization-defined frequency.","CCI-000076":"Defines the frequency with which to review and update the organization-wide information security program plan.","CCI-000077":"The organization updates the plan to address organizational changes and problems identified during plan implementation or security control assessments.","CCI-000078":"Appoint a Senior Information Security Officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.","CCI-000079":"The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information employ organization-defined additional security measures.","CCI-000080":"Include the resources needed to implement the information security programs in capital planning and investment requests and document all exceptions to this requirement.","CCI-000081":"The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required.","CCI-000082":"The organization establishes usage restrictions for organization-controlled mobile devices.","CCI-000083":"Establish implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas.","CCI-000084":"Authorize connection of mobile devices to organizational systems.","CCI-000085":"The organization monitors for unauthorized connections of mobile devices to organizational information systems.","CCI-000086":"The organization enforces requirements for the connection of mobile devices to organizational information systems.","CCI-000087":"The organization disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction.","CCI-000088":"The organization issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.","CCI-000089":"The organization applies organization-defined inspection and preventative measures to mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.","CCI-000090":"The organization restricts the use of writable, removable media in organizational information systems.","CCI-000091":"The organization prohibits the use of personally-owned, removable media in organizational information systems.","CCI-000092":"The organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner.","CCI-000093":"Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from the external systems.","CCI-000094":"The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process organization-controlled information using the external information systems.","CCI-000095":"The organization prohibits authorized individuals from using an external information system to access the information system except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.","CCI-000096":"The organization prohibits authorized individuals from using an external information system to access the information system or to process, store, or transmit organization-controlled information except in situations where the organization has approved information system connection or processing agreements with the organizational entity hosting the external information system.","CCI-000097":"Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using organization-defined restrictions.","CCI-000098":"Enable authorized users to determine whether access authorizations assigned to the sharing partner match the information's access and use restrictions for organization-defined information sharing circumstances where user discretion is required.","CCI-000099":"Employ organization-defined automated mechanisms to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.","CCI-000100":"Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000101":"Disseminate an organization level, mission/business process-level, or system-level awareness and training policy to organization-defined personnel or roles.","CCI-000102":"Review and update the current security awareness and training policy in accordance with organization-defined frequency.","CCI-000103":"Develop and document procedures to facilitate the implementation of the awareness and training policy and associated awareness and training controls.","CCI-000104":"Disseminate organization-level; mission/business process-level; or system-level awareness and training procedures to organization-defined personnel or roles.","CCI-000105":"Review and update the current security awareness and training procedures in accordance with an organization-defined frequency.","CCI-000106":"Provide basic security literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users.","CCI-000107":"Provide practical exercises in literacy training that simulate events and incidents.","CCI-000108":"Provide role-based security training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.","CCI-000109":"Provide role-based security training to personnel with organization-defined roles and responsibilities when required by system changes.","CCI-000110":"The organization provides refresher role-based security training to personnel with assigned security roles and responsibilities in accordance with organization-defined frequency.","CCI-000111":"The organization defines a frequency for providing refresher role-based security training.","CCI-000112":"Provide basic security awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events.","CCI-000113":"Document individual security training activities, including security awareness training and specific system security training.","CCI-000114":"Monitor individual information security training activities, including security awareness training and specific security training.","CCI-000115":"The organization establishes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.","CCI-000116":"The organization institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.","CCI-000117":"Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000118":"The organization disseminates a formal, documented, audit and accountability policy to elements within the organization having associated audit and accountability roles and responsibilities.","CCI-000119":"Review and update the current audit and accountability policy on an organization-defined frequency.","CCI-000120":"Develop and document procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.","CCI-000121":"The organization disseminates formal, documented, procedures to elements within the organization having associated audit and accountability roles and responsibilities.","CCI-000122":"Review and update the current audit and accountability procedures on an organization-defined frequency.","CCI-000123":"Identify the organization-defined event types that the system is capable of logging in support of the audit function.","CCI-000124":"Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.","CCI-000125":"Provide a rationale for why the event types selected for logging are deemed to be adequate for support after-the-fact investigations of incidents.","CCI-000126":"Specify the organization-defined event types (subset of the event types defined in AU-2a) along with the frequency of (or situation requiring logging for each identified event type.","CCI-000127":"The organization reviews and updates the list of organization-defined audited events on an organization-defined frequency.","CCI-000128":"The organization includes execution of privileged functions in the list of events to be audited by the information system.","CCI-000129":"The organization defines in the auditable events that the information system must be capable of auditing based on a risk assessment and mission/business needs.","CCI-000130":"Ensure that audit records contain information that establishes what type of event occurred.","CCI-000131":"Ensure that audit records containing information that establishes when the event occurred.","CCI-000132":"Ensure that audit records containing information that establishes where the event occurred.","CCI-000133":"Ensure that audit records containing information that establishes the source of the event.","CCI-000134":"Ensure that audit records containing information that establishes the outcome of the event.","CCI-000135":"Generate audit records containing the organization-defined additional information that is to be included in the audit records.","CCI-000136":"The organization centrally manages the content of audit records generated by organization-defined information system components.","CCI-000137":"The organization allocates audit record storage capacity.","CCI-000138":"The organization configures auditing to reduce the likelihood of storage capacity being exceeded.","CCI-000139":"Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.","CCI-000140":"Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.","CCI-000141":"Make available for expenditure, the planned information security resources.","CCI-000142":"Implement a process to ensure that plans of action and milestones for the information security program and the associated organizational systems are maintained.","CCI-000143":"The information system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.","CCI-000144":"The information system provides a real-time alert when organization-defined audit failure events occur.","CCI-000145":"Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity by delaying or rejecting network traffic above those organization-defined thresholds.","CCI-000146":"The organization defines the percentage of maximum audit record storage capacity that when exceeded, a warning is provided.","CCI-000147":"Defines the audit logging failure events requiring real-time alerts.","CCI-000148":"Review and analyze system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusual activity.","CCI-000149":"Report any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity.","CCI-000150":"The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to organizational operations, organizational assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.","CCI-000151":"Defines the frequency for the review and analysis of system audit records for organization-defined inappropriate or unusual activity.","CCI-000152":"The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.","CCI-000153":"Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.","CCI-000154":"Provide the capability to centrally review and analyze audit records from multiple components within the system.","CCI-000155":"The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to further enhance the ability to identify inappropriate or unusual activity.","CCI-000156":"The information system provides an audit reduction capability.","CCI-000157":"The information system provides a report generation capability.","CCI-000158":"Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.","CCI-000159":"Use internal system clocks to generate time stamps for audit records.","CCI-000160":"The information system synchronizes internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.","CCI-000161":"The organization defines the frequency for the synchronization of internal information system clocks.","CCI-000162":"Protect audit information from unauthorized access.","CCI-000163":"Protect audit information from unauthorized modification.","CCI-000164":"Protect audit information from unauthorized deletion.","CCI-000165":"Write audit records to hardware-enforced, write-once media.","CCI-000166":"Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.","CCI-000167":"Retain audit records for an organization-defined time period to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.","CCI-000168":"Defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after-the-fact investigations of incidents and meet regulatory and organizational information retention requirements.","CCI-000169":"Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defined information system components.","CCI-000170":"Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.","CCI-000171":"Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.","CCI-000172":"Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.","CCI-000173":"Defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.","CCI-000174":"Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.","CCI-000175":"The organization manages information system authenticators for users and devices by verifying, as part of the initial authenticator distribution, the identity of the individual and/or device receiving the authenticator.","CCI-000176":"Manage system authenticators by establishing initial authenticator content for authenticators issued by the organization.","CCI-000177":"The organization manages information system authenticators for users and devices by establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators.","CCI-000178":"The organization manages information system authenticators for users and devices by changing default content of authenticators upon information system installation.","CCI-000179":"The organization manages information system authenticators by establishing minimum lifetime restrictions for authenticators.","CCI-000180":"The organization manages information system authenticators by establishing maximum lifetime restrictions for authenticators.","CCI-000181":"The organization manages information system authenticators by establishing reuse conditions for authenticators.","CCI-000182":"Manage system authenticators by changing or refreshing authenticators in accordance with the organization-defined time period by authenticator type or when organization-defined events occur.","CCI-000183":"Manage system authenticators by protecting authenticator content from unauthorized disclosure.","CCI-000184":"Manage system authenticators by requiring individuals to take, and having devices implement, specific security controls to protect authenticators.","CCI-000185":"For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.","CCI-000186":"For public key-based authentication, enforce authorized access to the corresponding private key.","CCI-000187":"For public key-based authentication, map the authenticated identity to the account of the individual or group.","CCI-000188":"The organization requires that the registration process to receive an organizational-defined type of authenticator be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).","CCI-000189":"The organization employs automated tools to determine if authenticators are sufficiently strong to resist attacks intended to discover or otherwise compromise the authenticators.","CCI-000190":"The organization requires vendors/manufacturers of information system components to provide unique authenticators or change default authenticators prior to delivery.","CCI-000191":"The organization enforces password complexity by the number of special characters used.","CCI-000192":"The information system enforces password complexity by the minimum number of upper case characters used.","CCI-000193":"The information system enforces password complexity by the minimum number of lower case characters used.","CCI-000194":"The information system enforces password complexity by the minimum number of numeric characters used.","CCI-000195":"The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.","CCI-000196":"The information system, for password-based authentication, stores only cryptographically-protected passwords.","CCI-000197":"For password-based authentication, transmit passwords only over cryptographically-protected channels.","CCI-000198":"The information system enforces minimum password lifetime restrictions.","CCI-000199":"The information system enforces maximum password lifetime restrictions.","CCI-000200":"The information system prohibits password reuse for the organization-defined number of generations.","CCI-000201":"Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.","CCI-000202":"The organization ensures unencrypted static authenticators are not embedded in access scripts.","CCI-000203":"The organization ensures unencrypted static authenticators are not stored on function keys.","CCI-000204":"Defines the security controls required to manage the risk of compromise due to individuals having accounts on multiple systems.","CCI-000205":"The information system enforces minimum password length.","CCI-000206":"Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.","CCI-000207":"The organization develops and maintains an inventory of its information systems.","CCI-000208":"The organization determines normal time-of-day and duration usage for information system accounts.","CCI-000209":"Develop the results of information security measures of performance.","CCI-000210":"Monitor the results of information security measures of performance.","CCI-000211":"Report on the results of information security measures of performance.","CCI-000212":"Develop an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.","CCI-000213":"Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.","CCI-000214":"The organization establishes a Discretionary Access Control (DAC) policy that limits propagation of access rights.","CCI-000215":"The organization establishes a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.","CCI-000216":"Address information security issues in the development and documentation of a critical infrastructure and key resources protection plan.","CCI-000217":"Defines a time period after which inactive accounts are automatically disabled.","CCI-000218":"The information system, when transferring information between different security domains, identifies information flows by data type specification and usage.","CCI-000219":"When transferring information between different security domains, decompose information into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms.","CCI-000221":"The information system enforces security policies regarding information on interconnected systems.","CCI-000223":"The information system binds security attributes to information to facilitate information flow policy enforcement.","CCI-000224":"The information system tracks problems associated with the security attribute binding.","CCI-000225":"Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks.","CCI-000226":"The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to support different security policies.","CCI-000227":"Develop a comprehensive strategy to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems.","CCI-000228":"Implement the risk management strategy consistently across the organization.","CCI-000229":"The organization documents the security state of organizational information systems and the environments in which those systems operate through security authorization processes.","CCI-000230":"The organization tracks the security state of organizational information systems and the environments in which those systems operate through security authorization processes.","CCI-000231":"The organization reports the security state of organizational information systems and the environments in which those systems operate through security authorization processes.","CCI-000232":"Document and provide supporting rationale in the security plan for the system, user actions not requiring identification and authentication.","CCI-000233":"Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process.","CCI-000234":"Integrate the authorization processes into an organization-wide risk management program.","CCI-000235":"Define organizational mission and business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.","CCI-000236":"Determine information protection needs arising from the defined mission and business processes.","CCI-000237":"The organization manages information system accounts by specifically authorizing and monitoring the use of guest/anonymous accounts and temporary accounts.","CCI-000238":"Defines the frequency to review and update the current assessment, authorization, and monitoring policy.","CCI-000239":"Develop and document an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000240":"Disseminates to organization-defined personnel or roles an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy.","CCI-000241":"Review and update the current assessment, authorization, and monitoring policy on an organization-defined frequency.","CCI-000242":"Develop and document procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.","CCI-000243":"Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.","CCI-000244":"Review and update the current assessment, authorization, and monitoring procedures on an organization-defined frequency.","CCI-000245":"The organization develops a security assessment plan for the information system and its environment of operation.","CCI-000246":"Develop a control assessment plan that describes the scope of the assessment including controls and control enhancements under assessment.","CCI-000247":"Develop a control assessment plan that describes the scope of the assessment including assessment procedures to be used to determine control effectiveness.","CCI-000248":"Develop a control assessment plan that describes the scope of the assessment including assessment environment.","CCI-000249":"The organizations security assessment plan describes the assessment team.","CCI-000250":"The organization's security assessment plan describes assessment roles and responsibilities.","CCI-000251":"Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements.","CCI-000252":"Defines the frequency on which the security controls in the system and its environment of operation are assessed.","CCI-000253":"Produce a control assessment report that document the results of the assessment.","CCI-000254":"Provide the results of the control assessment to organization-defined individuals or roles.","CCI-000255":"Employ independent assessors or assessment teams to conduct control assessments.","CCI-000256":"Include as part of the control assessments, announced or unannounced, on an organization-defined frequency, in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; and/or organization-defined other forms of assessment.","CCI-000257":"The organization authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements.","CCI-000258":"Document, as part of each exchange agreement, the interface characteristics.","CCI-000259":"Document, as part of each exchange agreement, the security requirements, controls and responsibilities for each system, and the impact level of the information communicated.","CCI-000260":"The organization documents, for each interconnection, the nature of the information communicated.","CCI-000261":"The organization monitors the information system connections on an ongoing basis to verify enforcement of security requirements.","CCI-000262":"The organization prohibits the direct connection of an organization-defined unclassified, national security system to an external network without the use of an organization-defined boundary protection device.","CCI-000263":"The organization prohibits the direct connection of a classified, national security system to an external network without the use of organization-defined boundary protection device.","CCI-000264":"Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.","CCI-000265":"Defines the frequency with which to update the existing plan of action and milestones for the system.","CCI-000266":"Update, on an organization-defined frequency, the existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.","CCI-000267":"Ensure the accuracy of the plan of action and milestones for the system using organization-defined automated mechanisms.","CCI-000268":"Ensure the currency of the plan of action and milestones for the system using organization-defined automated mechanisms.","CCI-000269":"Ensure the availability of the plan of action and milestones for the system using organization-defined automated mechanisms.","CCI-000270":"Assign a senior official as the authorizing official for the system.","CCI-000271":"Ensure the authorizing official for the system authorizes the system to operate before commencing operations.","CCI-000272":"Update the authorization on an organization-defined frequency.","CCI-000273":"Defines the frequency with which to update the authorizations.","CCI-000274":"Develop a continuous monitoring strategy.","CCI-000275":"The organization implements a continuous monitoring program that includes a configuration management process for the information system.","CCI-000276":"The organization implements a continuous monitoring program that includes a configuration management process for the information system constituent components.","CCI-000277":"The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the information system.","CCI-000278":"The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the environment of operation.","CCI-000279":"Implement ongoing control assessments in accordance with the continuous monitoring strategy.","CCI-000280":"Implement a continuous monitoring program that includes reporting the security status to organization-defined personnel or roles on an organization-defined frequency.","CCI-000281":"Defines the frequency with which to report the security status to organization-defined personnel or roles.","CCI-000282":"Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.","CCI-000283":"The organization plans announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.","CCI-000284":"The organization schedules announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.","CCI-000285":"The organization conducts announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.","CCI-000286":"Defines the frequency with which to review and update the configuration management policies.","CCI-000287":"Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000288":"The organization disseminates formal, documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities.","CCI-000289":"Review and update, on an organization-defined frequency, the configuration management policy.","CCI-000290":"Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and the associated configuration management controls.","CCI-000291":"The organization disseminates formal, documented procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.","CCI-000292":"Review and update, on an organization-defined frequency, the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls.","CCI-000293":"The organization develops a current baseline configuration of the information system.","CCI-000294":"The organization documents a baseline configuration of the information system.","CCI-000295":"Maintain, under configuration control, a current baseline configuration of the system.","CCI-000296":"Review and update the baseline configuration of the system on an organization-defined frequency.","CCI-000297":"Review and update the baseline configuration of the system when required due to organization-defined circumstances.","CCI-000298":"The organization reviews and updates the baseline configuration of the information system as an integral part of information system component installations.","CCI-000299":"The organization reviews and updates the baseline configuration of the information system as an integral part of information system component upgrades.","CCI-000300":"Maintain complete configuration of the system using organization-defined automated mechanisms.","CCI-000301":"Maintain current configuration of the system using organization-defined automated mechanisms.","CCI-000302":"Maintain accurate configuration of the system using organization-defined automated mechanisms.","CCI-000303":"Maintain available configuration of the system using organization-defined automated mechanisms.","CCI-000304":"Retain organization-defined number of previous versions of baseline configurations of the system to support rollback.","CCI-000305":"The organization develops a list of software programs not authorized to execute on the information system.","CCI-000306":"The organization maintains the list of software programs not authorized to execute on the information system.","CCI-000307":"The organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system.","CCI-000308":"The organization develops the list of software programs authorized to execute on the information system.","CCI-000309":"The organization maintains the list of software programs authorized to execute on the information system.","CCI-000310":"The organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system.","CCI-000311":"Maintain a baseline configuration for system development environments that is managed separately from the operational baseline configuration.","CCI-000312":"Maintain a baseline configuration for system test environments that is managed separately from the operational baseline configuration.","CCI-000313":"Determine and document the types of changes to the system that are configuration-controlled.","CCI-000314":"Approve or disapprove configuration-controlled changes to the system, with explicit consideration for security impact analyses.","CCI-000315":"The organization documents approved configuration-controlled changes to the system.","CCI-000316":"Retain records of configuration-controlled changes to the system for an organization-defined time period.","CCI-000317":"The organization reviews records of configuration-controlled changes to the system.","CCI-000318":"Monitor and review activities associated with configuration-controlled changes to the system.","CCI-000319":"Coordinate and provides oversight for configuration change control activities through an organization-defined configuration change control element that convenes at the organization-defined frequency, and/or for any organization-defined configuration change conditions.","CCI-000320":"Defines the frequency with which to convene the configuration change control element.","CCI-000321":"Defines configuration change conditions that prompt the configuration change control element to convene.","CCI-000322":"Use organization-defined automated mechanisms to document proposed changes to the system.","CCI-000323":"Use organization-defined automated mechanisms to notify organization-defined approval authorities of proposed changes to the system and request change approval.","CCI-000324":"Use organization-defined automated mechanisms to highlight proposed changes to the system that have not been approved or disapproved by an organization-defined time period.","CCI-000325":"Use organization-defined automated mechanisms to prohibit changes to the system until designated approvals are received.","CCI-000326":"Use organization-defined automated mechanisms to document all changes to the system.","CCI-000327":"Tests changes to the system before finalizing the implementation of the changes.","CCI-000328":"Validate changes to the system before finalizing the implementation of the changes.","CCI-000329":"Document changes to the system before finalizing the implementation of the changes.","CCI-000330":"Implement changes to the current system baseline using organization-defined automated mechanisms.","CCI-000331":"Deploy the updated system baseline across the installed base using organization-defined automated mechanism.","CCI-000332":"Require an organization-defined security representative to be a member of the organization-defined configuration change control element.","CCI-000333":"Analyze changes to the system to determine potential security impacts prior to change implementation.","CCI-000334":"The organization analyzes new software in a separate test environment before installation in an operational environment.","CCI-000335":"After system changes, verify that the impacted controls are implemented correctly, meeting the security requirements for the system.","CCI-000336":"After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.","CCI-000337":"After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system.","CCI-000338":"The organization defines physical access restrictions associated with changes to the information system.","CCI-000339":"The organization documents physical access restrictions associated with changes to the information system.","CCI-000340":"Approve physical access restrictions associated with changes to the system.","CCI-000341":"Enforce physical access restrictions associated with changes to the system.","CCI-000342":"The organization defines logical access restrictions associated with changes to the information system.","CCI-000343":"The organization documents logical access restrictions associated with changes to the information system.","CCI-000344":"Approve logical access restrictions associated with changes to the system.","CCI-000345":"Enforce logical access restrictions associated with changes to the system.","CCI-000346":"The organization employs automated mechanisms to enforce access restrictions.","CCI-000347":"The organization employs automated mechanisms to support auditing of the enforcement actions.","CCI-000348":"The organization defines a frequency with which to conduct reviews of information system changes.","CCI-000349":"The organization reviews information system changes per organization-defined frequency to determine whether unauthorized changes have occurred.","CCI-000350":"The organization reviews information system changes upon organization-defined circumstances to determine whether unauthorized changes have occurred.","CCI-000351":"The organization defines critical software programs that the information system will prevent from being installed if such software programs are not signed with a recognized and approved certificate.","CCI-000352":"The information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization.","CCI-000353":"Defines system components requiring enforcement of a dual authorization for system changes.","CCI-000354":"Enforce dual authorization for implementing changes to organization-defined system components.","CCI-000355":"The organization limits information system developer/integrator privileges to change hardware components directly within a production environment.","CCI-000356":"The organization limits information system developer/integrator privileges to change software components directly within a production environment.","CCI-000357":"The organization limits information system developer/integrator privileges to change firmware components directly within a production environment.","CCI-000358":"The organization limits information system developer/integrator privileges to change system information directly within a production environment.","CCI-000359":"The organization defines the frequency to review information system developer/integrator privileges.","CCI-000360":"The organization defines the frequency to reevaluate information system developer/integrator privileges.","CCI-000361":"The organization reviews information system developer/integrator privileges per organization-defined frequency.","CCI-000362":"The organization reevaluates information system developer/integrator privileges per organization-defined frequency.","CCI-000363":"The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.","CCI-000364":"The organization establishes configuration settings for information technology products employed within the information system using organization-defined security configuration checklists.","CCI-000365":"The organization documents configuration settings for information technology products employed within the information system using organization-defined security configuration checklists that reflect the most restrictive mode consistent with operational requirements.","CCI-000366":"Implement the security configuration settings.","CCI-000367":"Identify any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.","CCI-000368":"Document any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.","CCI-000369":"Approve any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.","CCI-000370":"Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.","CCI-000371":"Apply configuration settings for organization-defined system components using organization-defined automated mechanisms.","CCI-000372":"Verify configuration settings for organization-defined system components using organization-defined automated mechanisms.","CCI-000373":"The organization defines configuration settings for which unauthorized changes are responded to by automated mechanisms.","CCI-000374":"The organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings.","CCI-000375":"The organization incorporates detection of unauthorized, security-relevant configuration changes into the organizations incident response capability.","CCI-000376":"The organization ensures unauthorized, security-relevant configuration changes detected are monitored.","CCI-000377":"The organization ensures unauthorized, security-relevant configuration changes detected are corrected.","CCI-000378":"The organization ensures unauthorized, security-relevant configuration changes detected are available for historical purposes.","CCI-000379":"The information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance (i.e., security checklists) prior to being introduced into a production environment.","CCI-000380":"Defines prohibited or restricted functions, system ports, protocols, software and/or services for the system.","CCI-000381":"Configure the system to provide only organization-defined mission essential capabilities.","CCI-000382":"Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.","CCI-000383":"The organization defines the frequency of information system reviews to identify and eliminate unnecessary functions, ports, protocols and/or services.","CCI-000384":"Review the system per organization-defined frequency to identify unnecessary and nonsecure functions, ports, protocols, software, and services.","CCI-000385":"The organization reviews the information system per organization-defined frequency to eliminate unnecessary functions, ports, protocols, and/or services.","CCI-000386":"The organization employs automated mechanisms to prevent program execution on the information system in accordance with the organization-defined specifications.","CCI-000387":"Defines registration requirements for functions, ports, protocols, and services.","CCI-000388":"Ensure compliance with organization-defined registration requirements for functions, ports, protocols, and services.","CCI-000389":"The organization develops an inventory of information system components that accurately reflects the current information system.","CCI-000390":"The organization documents an inventory of information system components that accurately reflects the current information system.","CCI-000391":"The organization maintains an inventory of information system components that accurately reflects the current information system.","CCI-000392":"The organization develops an inventory of information system components that includes all components within the authorization boundary of the information system.","CCI-000393":"The organization documents an inventory of information system components that includes all components within the authorization boundary of the information system.","CCI-000394":"The organization maintains an inventory of information system components that is consistent with the authorization boundary of the information system.","CCI-000395":"The organization develops an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.","CCI-000396":"The organization documents an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.","CCI-000397":"The organization maintains an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.","CCI-000398":"Defines information deemed necessary to achieve effective system component accountability.","CCI-000399":"The organization develops an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.","CCI-000400":"The organization documents an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.","CCI-000401":"The organization maintains an inventory of information system components that includes organization-defined information deemed necessary to achieve effective property accountability.","CCI-000402":"The organization develops an inventory of information system components that is available for review by designated organizational officials.","CCI-000403":"The organization documents an inventory of information system components that is available for review by designated organizational officials.","CCI-000404":"The organization maintains an inventory of information system components that is available for review by designated organizational officials.","CCI-000405":"The organization develops an inventory of information system components that is available for audit by designated organizational officials.","CCI-000406":"The organization documents an inventory of information system components that is available for audit by designated organizational officials.","CCI-000407":"The organization maintains an inventory of information system components that is available for audit by designated organizational officials.","CCI-000408":"Update the inventory of system components as part of component installations.","CCI-000409":"Update the inventory of system components as part of component removals.","CCI-000410":"Update the inventory of system components as part of system updates.","CCI-000411":"Maintain the currency of the inventory of system components using organization-defined automated mechanisms.","CCI-000412":"Maintain the completeness of the inventory of system components using organization-defined automated mechanisms.","CCI-000413":"Maintain the accuracy of the inventory of system components using organization-defined automated mechanisms.","CCI-000414":"Maintain the availability of the inventory of system components using organization-defined automated mechanisms.","CCI-000415":"Defines the frequency of employing automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the system.","CCI-000416":"Detect the presence of unauthorized hardware, software, and firmware components within the system using organization-defined automated mechanisms, on an organization-defined frequency.","CCI-000417":"The organization disables network access by unauthorized components/devices or notifies designated organizational officials.","CCI-000418":"Include in the system component inventory information, a means for identifying by name, position, and/or role, individuals responsible and accountable for administering those components.","CCI-000419":"The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories.","CCI-000420":"Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.","CCI-000421":"The organization develops a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.","CCI-000422":"The organization documents a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.","CCI-000423":"Implement a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes and procedures.","CCI-000424":"The organization develops a configuration management plan for the information system that defines the configuration items for the information system.","CCI-000425":"The organization documents a configuration management plan for the information system that defines the configuration items for the information system.","CCI-000426":"Implement a configuration management plan for the system that defines the configuration items for the system.","CCI-000427":"The organization develops a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.","CCI-000428":"The organization documents a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.","CCI-000429":"The organization implements a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.","CCI-000430":"The organization develops a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.","CCI-000431":"The organization documents a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.","CCI-000432":"The organization implements a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.","CCI-000433":"The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.","CCI-000434":"The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.","CCI-000435":"The organization implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.","CCI-000436":"Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.","CCI-000437":"Defines the frequency with which to review and update the current contingency planning policy.","CCI-000438":"Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000439":"Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles.","CCI-000440":"Review and update the current contingency planning policy in accordance with an organization-defined frequency.","CCI-000441":"Develop and document procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls.","CCI-000443":"Develop a contingency plan for the system that identifies essential missions.","CCI-000444":"Develop a contingency plan for the system that identifies essential business functions.","CCI-000445":"Develop a contingency plan for the system that identifies associated contingency requirements.","CCI-000446":"Develop a contingency plan for the system that provides recovery objectives.","CCI-000447":"Develop a contingency plan for the system that provides restoration priorities.","CCI-000448":"Develop a contingency plan for the system that provides metrics.","CCI-000449":"Develop a contingency plan for the system that addresses contingency roles, responsibilities, assigned individuals with contact information.","CCI-000450":"The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system disruption.","CCI-000451":"The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system disruption.","CCI-000452":"The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system compromise.","CCI-000453":"The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system compromise.","CCI-000454":"The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system failure.","CCI-000455":"The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system failure.","CCI-000456":"Develop a contingency plan for the system that addresses eventual, full system restoration without deterioration of the controls originally planned and implemented.","CCI-000457":"Develop a contingency plan for the system that is reviewed and approved by organization-defined personnel or roles.","CCI-000458":"Defines the key contingency personnel (identified by name and/or by role) and organizational elements designated to receive copies of the contingency plan.","CCI-000459":"Distributes copies of the contingency plan to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.","CCI-000460":"Coordinate contingency planning activities with incident handling activities.","CCI-000461":"Defines the frequency with which to review the contingency plan for the system.","CCI-000462":"Reviews the contingency plan for the system in accordance with organization-defined frequency.","CCI-000463":"Updates the contingency plan to address changes to the organization.","CCI-000464":"Updates the contingency plan to address changes to the system.","CCI-000465":"Updates the contingency plan to address changes to the environment of operation.","CCI-000466":"Updates the contingency plan to address problems encountered during contingency plan implementation, execution, or testing.","CCI-000468":"Communicates contingency plan changes to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.","CCI-000469":"Coordinate contingency plan development with organizational elements responsible for related plans.","CCI-000470":"Conduct capacity planning so that necessary capacity for information processing exists during contingency operations.","CCI-000471":"Conduct capacity planning so that necessary capacity for telecommunications exists during contingency operations.","CCI-000472":"Conduct capacity planning so that necessary capacity for environmental support exists during contingency operations.","CCI-000473":"Defines the time period for planning the resumption of essential missions as a result of contingency plan activation.","CCI-000474":"Defines the time period for planning the resumption of essential business functions as a result of contingency plan activation.","CCI-000475":"Plan for the resumption of all or essential mission functions within the organization-defined time period of contingency plan activation.","CCI-000476":"Plan for the resumption of all or essential business functions within the organization-defined time period of contingency plan activation.","CCI-000477":"The organization defines the time period for planning the resumption of all missions as a result of contingency plan activation.","CCI-000478":"The organization defines the time period for planning the resumption of all business functions as a result of contingency plan activation.","CCI-000479":"The organization plans for the resumption of all missions within an organization-defined time period of contingency plan activation.","CCI-000480":"The organization plans for the resumption of all business functions within an organization-defined time period of contingency plan activation.","CCI-000481":"Plan for the continuance of all or essential missions with little or no loss of operational continuity.","CCI-000482":"Plan for the continuance of all or essential business functions with little or no loss of operational continuity.","CCI-000483":"Plan for the transfer of all or essential mission functions to alternate processing and/or storage sites with minimal or no loss of operational continuity.","CCI-000484":"Plan for the transfer of all or essential business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity.","CCI-000485":"Defines the frequency of contingency training to system users.","CCI-000486":"Provide contingency training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility.","CCI-000487":"Provide contingency training to system users consistent with assigned roles and responsibilities in accordance with organization-defined frequency.","CCI-000488":"Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.","CCI-000489":"Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment.","CCI-000490":"Defines the frequency with which to test the contingency plan for the system.","CCI-000491":"The organization defines the frequency to exercise the contingency plan for the information system.","CCI-000492":"Defines the contingency plan tests to be conducted for the system.","CCI-000493":"The organization defines contingency plan exercises to be conducted for the information system.","CCI-000494":"Test the contingency plan for the system in accordance with organization-defined frequency using organization-defined tests to determine the effectiveness of the plan and the organizational readiness to execute the plan.","CCI-000495":"The organization exercises the contingency plan using organization-defined exercises in accordance with organization-defined frequency.","CCI-000496":"Review the contingency plan test results.","CCI-000497":"Initiate corrective actions, if needed, after reviewing the contingency plan test results.","CCI-000498":"Coordinate contingency plan testing with organizational elements responsible for related plans.","CCI-000499":"The organization coordinates contingency plan exercises with organizational elements responsible for related plans.","CCI-000500":"Test the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources.","CCI-000501":"The organization exercises the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources and to evaluate the site's capabilities to support contingency operations.","CCI-000502":"Test the contingency plan using organization-defined automated mechanisms.","CCI-000503":"The organization employs automated mechanisms to more thoroughly and effectively exercise the contingency plan by providing more complete coverage of contingency issues, selecting more realistic exercise scenarios and environments, and more effectively stressing the information and supported missions.","CCI-000504":"Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.","CCI-000505":"Establish an alternate storage site, including necessary agreements to permit the storage of system backup information.","CCI-000506":"The organization initiates necessary alternate storage site agreements to permit the storage and recovery of information system backup information.","CCI-000507":"Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.","CCI-000508":"Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.","CCI-000509":"Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.","CCI-000510":"Defines the time-period consistent with recovery time and recovery point objectives for essential missions/business functions to permit the transfer and resumption of organization-defined system operations at an alternate processing site when the primary processing capabilities are unavailable.","CCI-000511":"The organization defines the time period for achieving the recovery time objectives for business functions within which processing must be resumed at the alternate processing site.","CCI-000512":"The organization establishes an alternate processing site.","CCI-000513":"Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential mission functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.","CCI-000514":"Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential business functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.","CCI-000515":"Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption.","CCI-000516":"Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.","CCI-000517":"Identify potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.","CCI-000518":"Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).","CCI-000519":"Prepare the alternate processing site so that the site can serve as the operational site supporting essential missions.","CCI-000520":"Prepare the alternate processing site so that the site can serve as the operational site supporting essential business functions.","CCI-000521":"Provide controls at the alternate processing site that are equivalent to those at the primary site.","CCI-000522":"Defines the time-period within which to permit the resumption of organization-defined system operations for essential mission functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.","CCI-000523":"Defines the time-period within which to permit the resumption of organization-defined system operations for essential business functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.","CCI-000524":"Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential mission functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.","CCI-000525":"Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.","CCI-000526":"Develop primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).","CCI-000527":"Develop alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).","CCI-000528":"The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary telecommunications services are provided by a common carrier.","CCI-000529":"The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the alternate telecommunications services are provided by a common carrier.","CCI-000530":"Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.","CCI-000531":"Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.","CCI-000532":"Require primary telecommunications service providers to have contingency plans.","CCI-000533":"Require alternate telecommunications service providers to have contingency plans.","CCI-000534":"Defines the frequency of conducting user-level information backups to support recovery time objectives and recovery point objectives.","CCI-000535":"Conduct backups of user-level information contained in organization-defined system components per organization-defined frequency that is consistent with recovery time and recovery point objectives.","CCI-000536":"Defines the frequency of conducting system-level information backups to support recovery time objectives and recovery point objectives.","CCI-000537":"Conduct backups of system-level information contained in the system per organization-defined frequency that is consistent with recovery time and recovery point objectives.","CCI-000538":"Defines the frequency of conducting system documentation backups, including security-related documentation, to support recovery time objectives and recovery point objectives.","CCI-000539":"Conduct backups of system documentation, including security-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.","CCI-000540":"The organization protects the confidentiality, integrity, and availability of backup information at storage locations.","CCI-000541":"Defines the frequency with which to test backup information to verify media reliability and information integrity.","CCI-000542":"Test backup information per an organization-defined frequency to verify media reliability and information integrity.","CCI-000543":"Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.","CCI-000544":"The organization stores backup copies of the operating system in a separate facility or in a fire-rated container that is not colocated with the operational system.","CCI-000545":"The organization stores backup copies of critical information system software in a separate facility or in a fire-rated container that is not colocated with the operational system.","CCI-000546":"The organization stores backup copies of the information system inventory (including hardware, software, and firmware components) in a separate facility or in a fire-rated container that is not colocated with the operational system.","CCI-000547":"Defines the time-period and transfer rate of the system backup information to the alternate storage site consistent with the recovery time and recovery point objectives.","CCI-000548":"Transfer system backup information to the alternate storage site in accordance with the organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives.","CCI-000549":"Maintain a redundant secondary system that is not collocated with the primary system.","CCI-000550":"The organization provides for the recovery and reconstitution of the information system to a known state after a disruption.","CCI-000551":"The organization provides for the recovery and reconstitution of the information system to a known state after a compromise.","CCI-000552":"The organization provides for the recovery and reconstitution of the information system to a known state after a failure.","CCI-000553":"Implement transaction recovery for systems that are transaction-based.","CCI-000554":"The organization defines in the security plan, explicitly or by reference, the circumstances that can inhibit recovery and reconstitution of the information system to a known state.","CCI-000555":"The organization provides compensating security controls for organization-defined circumstances that can inhibit recovery and reconstitution of the information system to a known state.","CCI-000556":"Defines restoration time periods within which to restore system components from configuration-controlled and integrity-protected information representing a known, operational state for the components.","CCI-000557":"Provide the capability to restore information system components within organization-defined restoration time periods from configuration-controlled and integrity-protected information representing a known, operational state for the components.","CCI-000558":"Defines the real-time or near-real-time failover capability to be provided for the system.","CCI-000559":"Provide real-time or near-real-time organization-defined failover capability for the system.","CCI-000560":"The organization protects backup and restoration hardware.","CCI-000561":"The organization protects backup and restoration firmware.","CCI-000562":"The organization protects backup and restoration software.","CCI-000563":"Develop and document an organization-level; mission/business process-level; and or system-level planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000564":"Disseminate an organization-level; mission/business process-level; and or system-level planning policy to organization-defined personnel or roles.","CCI-000565":"The organization reviews/updates, per organization-defined frequency, a formal, documented security planning policy.","CCI-000566":"Develop and document procedures to facilitate the implementation of the planning policy and associated planning controls.","CCI-000567":"Disseminates planning procedures to organization-defined personnel or roles.","CCI-000568":"Review and update the current planning procedures in accordance with organization-defined frequency.","CCI-000570":"The organization develops a security plan for the information system that is consistent with the organization's enterprise architecture; explicitly defines the authorization boundary for the system; describes the operational context of the information system in terms of mission and business processes; provides the security category and impact level of the information system, including supporting rationale; describes the operational environment for the information system; describes relationships with, or connections to, other information systems; provides an overview of the security requirements for the system; and describes the security controls in place or planned for meeting those requirements, including a rationale for the tailoring and supplemental decisions.","CCI-000571":"Develop security and privacy plans for the system that are reviewed and approved by the authorizing official or designated representative prior to plan implementation.","CCI-000572":"Defines the frequency for reviewing the plans for the system.","CCI-000573":"Review the plans in accordance with organization-defined frequency.","CCI-000574":"Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments.","CCI-000576":"The organization develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum: the purpose of the system; a description of the system architecture; the security authorization schedule; and the security categorization and associated factors considered in determining the categorization.","CCI-000577":"Defines the frequency with which to review and update the CONOPS.","CCI-000578":"Review and update the CONOPS in accordance with organization-defined frequency.","CCI-000580":"The organization develops a functional architecture for the information system that identifies and maintains external interfaces.","CCI-000581":"The organization develops a functional architecture for the information system that identifies and maintains the information being exchanged across the interfaces.","CCI-000582":"The organization develops a functional architecture for the information system that identifies and maintains the protection mechanisms associated with each interface.","CCI-000583":"The organization develops a functional architecture for the information system that identifies and maintains user roles.","CCI-000584":"The organization develops a functional architecture for the information system that identifies and maintains the access privileges assigned to each role.","CCI-000585":"The organization develops a functional architecture for the information system that identifies and maintains unique security requirements.","CCI-000586":"The organization develops a functional architecture for the information system that identifies and maintains types of information processed by the information system.","CCI-000587":"The organization develops a functional architecture for the information system that identifies and maintains types of information stored by the information system.","CCI-000588":"The organization develops a functional architecture for the information system that identifies and maintains types of information transmitted by the information system.","CCI-000589":"The organization develops a functional architecture for the information system that identifies and maintains any specific protection needs in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.","CCI-000590":"The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information.","CCI-000591":"The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information system services.","CCI-000592":"Establish the rules that describe their responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system.","CCI-000593":"Receive a documented acknowledgement from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system.","CCI-000594":"Include in the rules of behavior, restrictions on the use of social media, social networking sites, and external sites/applications.","CCI-000595":"Include in the rules of behavior, restrictions on posting organizational information on public websites.","CCI-000596":"The organization includes in the rules of behavior, explicit restrictions on sharing information system account information.","CCI-000597":"The organization conducts a privacy impact assessment on the information system in accordance with OMB policy.","CCI-000598":"The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational operations (i.e., mission, functions, image, and reputation).","CCI-000599":"The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational assets.","CCI-000600":"The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational individuals.","CCI-000601":"Defines the frequency with which to review and update the current system and services acquisition policy.","CCI-000602":"Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000603":"Disseminate to organization-defined personnel or roles an organization-level; mission/business process-level; and/or system-level system and services acquisition policy.","CCI-000604":"Review and update the current system and services acquisition policy in accordance with organization-defined frequency.","CCI-000605":"Develop and document procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.","CCI-000606":"Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.","CCI-000607":"Review and update the current system and services acquisition procedures in accordance with organization-defined frequency.","CCI-000608":"The organization includes a determination of information security requirements for the information system in mission process planning.","CCI-000609":"The organization includes a determination of information security requirements for the information system in business process planning.","CCI-000610":"Determine the resources required to protect the system or system service as part of the organizational capital planning and investment control process.","CCI-000611":"Document the resources required to protect the system or system service as part of the organizational capital planning and investment control process.","CCI-000612":"Allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process.","CCI-000613":"Establish a discrete line item for information security in organizational programming documentation.","CCI-000614":"Establish a discrete line item for information security in organizational budgeting documentation.","CCI-000615":"Manage the system using an organization-defined system development life cycle that incorporates information security considerations.","CCI-000616":"Define and document information system security roles and responsibilities throughout the system development life cycle.","CCI-000617":"The organization documents information system security roles and responsibilities throughout the system development life cycle.","CCI-000618":"Identify individuals having information system security roles and responsibilities.","CCI-000619":"The organization includes security functional requirements/specifications, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.","CCI-000620":"The organization includes security-related documentation requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.","CCI-000621":"The organization includes developmental and evaluation-related assurance requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.","CCI-000623":"Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.","CCI-000624":"The organization requires in acquisition documents that vendors/contractors provide information describing the design details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.","CCI-000625":"The organization requires in acquisition documents that vendors/contractors provide information describing the implementation details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.","CCI-000626":"The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs state-of-the-practice software and security engineering methods.","CCI-000627":"The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs quality control processes.","CCI-000628":"The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development processes employ validation techniques.","CCI-000629":"The organization ensures each information system component acquired is explicitly assigned to an information system, and that the owner of the system acknowledges this assignment.","CCI-000630":"The organization requires in acquisition documents, that information system components are delivered in a secure, documented configuration, and that the secure configuration is the default configuration for any software reinstalls or upgrades.","CCI-000631":"Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.","CCI-000632":"The organization employs only commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.","CCI-000633":"Ensure that government off-the-shelf or commercial-off-the-shelf information assurance and information assurance-enabled information technology products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.","CCI-000634":"Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists.","CCI-000635":"Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.","CCI-000636":"The organization obtains administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.","CCI-000637":"The organization protects, as required, administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.","CCI-000638":"The organization makes available to authorized personnel administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.","CCI-000639":"The organization obtains user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.","CCI-000640":"The organization protects, as required, user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.","CCI-000641":"The organization makes available to authorized personnel user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.","CCI-000642":"Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent.","CCI-000643":"The organization obtains vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.","CCI-000644":"The organization protects, as required, vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system.","CCI-000645":"The organization makes available to authorized personnel vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.","CCI-000646":"The organization obtains vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.","CCI-000647":"The organization obtains vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.","CCI-000648":"The organization protects, as required, vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system.","CCI-000650":"The organization obtains vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.","CCI-000651":"The organization protects, as required, vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system.","CCI-000653":"The organization obtains the source code for the information system to permit analysis and testing.","CCI-000654":"The organization protects, as required, the source code for the information system to permit analysis and testing.","CCI-000655":"The organization uses software and associated documentation in accordance with contract agreements and copyright laws.","CCI-000656":"The organization employs tracking systems for software and associated documentation protected by quantity licenses to control copying and distribution.","CCI-000657":"The organization controls the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.","CCI-000658":"The organization documents the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.","CCI-000659":"The organization prohibits the use of binary executable code from sources with limited or no warranty without accompanying source code.","CCI-000660":"The organization prohibits the use of machine executable code from sources with limited or no warranty without accompanying source code.","CCI-000661":"The organization provides exceptions to the source code requirement only when no alternative solutions are available to support compelling mission/operational requirements.","CCI-000662":"The organization obtains express written consent of the authorizing official for exceptions to the source code requirement.","CCI-000663":"The organization (or information system) enforces explicit rules governing the installation of software by users.","CCI-000664":"Apply organization-defined systems security and privacy engineering principles in the specification of the system and system components.","CCI-000665":"Apply organization-defined systems security and privacy engineering principles in the design of the system and system components.","CCI-000666":"Apply organization-defined systems security and privacy engineering principles in the development of the system and system components.","CCI-000667":"Apply organization-defined systems security and privacy engineering principles in the implementation of the system and system components.","CCI-000668":"Apply organization-defined systems security and privacy engineering principles in the modification of the system and system components.","CCI-000669":"Require that providers of external system services comply with organizational security requirements.","CCI-000670":"The organization requires that providers of external information system services employ organization-defined security controls in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.","CCI-000671":"The organization defines government oversight with regard to external information system services.","CCI-000672":"The organization documents government oversight with regard to external information system services.","CCI-000673":"The organization defines user roles and responsibilities with regard to external information system services.","CCI-000674":"The organization documents user roles and responsibilities with regard to external information system services.","CCI-000675":"The organization monitors security control compliance by external service providers.","CCI-000676":"The organization conducts an organizational assessment of risk prior to the acquisition of dedicated information security services.","CCI-000677":"The organization conducts an organizational assessment of risk prior to the outsourcing of dedicated information security services.","CCI-000678":"The organization defines the senior organizational official designated to approve acquisition of dedicated information security services.","CCI-000679":"The organization defines the senior organizational official designated to approve outsourcing of dedicated information security services.","CCI-000680":"The organization ensures the acquisition of dedicated information security services is approved by an organization-designated senior organizational official.","CCI-000681":"The organization ensures the outsourcing of dedicated information security services is approved by an organization-designated senior organizational official.","CCI-000682":"The organization requires information system developers to perform configuration management during information system design.","CCI-000683":"The organization requires information system developers to perform configuration management during information system development.","CCI-000684":"The organization requires information system developers to perform configuration management during information system implementation.","CCI-000685":"The organization requires information system developers to perform configuration management during information system operation.","CCI-000686":"The organization requires information system integrators to perform configuration management during information system design.","CCI-000687":"The organization requires information system integrators to perform configuration management during information system development.","CCI-000688":"The organization requires information system integrators to perform configuration management during information system implementation.","CCI-000689":"The organization requires information system integrators to perform configuration management during information system operation.","CCI-000690":"The organization requires information system developers to manage and control changes to the information system during design.","CCI-000691":"The organization requires information system integrators to manage and control changes to the information system during design.","CCI-000692":"Require the developer of the system, system component, or system service to implement only organization-approved changes to the system, component, or service.","CCI-000693":"The organization requires information system integrators to implement only organization-approved changes.","CCI-000694":"Require the developer of the system, system component, or system service to document approved changes to the system, component, or service.","CCI-000695":"The organization requires information system integrators to document approved changes to the information system.","CCI-000696":"The organization requires that information system developers track security flaws and flaw resolution.","CCI-000697":"The organization requires information system integrators to track security flaws and flaw resolution.","CCI-000698":"Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.","CCI-000699":"The organization requires information system integrators to provide an integrity check of software to facilitate organizational verification of software integrity after delivery.","CCI-000700":"Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.","CCI-000701":"The organization provides an alternative configuration management process with organizational personnel in the absence of a dedicated integrator configuration management team.","CCI-000702":"The organization requires information system developers, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.","CCI-000703":"The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.","CCI-000704":"The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.","CCI-000705":"The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.","CCI-000706":"The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.","CCI-000707":"The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.","CCI-000708":"The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.","CCI-000709":"The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.","CCI-000710":"The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.","CCI-000711":"The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.","CCI-000712":"The organization requires information system developers to employ code analysis tools to examine software for common flaws and document the results of the analysis.","CCI-000713":"The organization requires information system integrators to employ code analysis tools to examine software for common flaws and document the results of the analysis.","CCI-000714":"The organization requires information system developers to perform a vulnerability analysis to document vulnerabilities.","CCI-000715":"The organization requires information system developers to perform a vulnerability analysis to document exploitation potential.","CCI-000716":"The organization requires information system developers to perform a vulnerability analysis to document risk mitigations.","CCI-000717":"The organization requires information system integrators to perform a vulnerability analysis to document vulnerabilities.","CCI-000718":"The organization requires information system integrators to perform a vulnerability analysis to document exploitation potential.","CCI-000719":"The organization requires information system integrators perform a vulnerability analysis to document risk mitigations.","CCI-000720":"The organization requires information system developers implement the security test and evaluation plan under the witness of an independent verification and validation agent.","CCI-000721":"The organization requires information system integrators to implement the security test and evaluation plan under the witness of an independent verification and validation agent.","CCI-000722":"The organization defines the security safeguards to employ to protect against supply chain threats to the information system, system component, or information system service.","CCI-000723":"The organization protects against supply chain threats to the information system, system component, or information system service by employing organization-defined security safeguards as part of a comprehensive, defense-in-breadth information security strategy.","CCI-000724":"The organization purchases all anticipated information system components and spares in the initial acquisition.","CCI-000725":"The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system hardware.","CCI-000726":"The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system software.","CCI-000727":"The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system firmware.","CCI-000728":"The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system services.","CCI-000729":"The organization uses trusted shipping for information systems.","CCI-000730":"The organization uses trusted shipping for information system components.","CCI-000731":"The organization uses trusted shipping for information technology products.","CCI-000732":"The organization uses trusted warehousing for information systems.","CCI-000733":"The organization uses trusted warehousing for information system components.","CCI-000734":"The organization uses trusted warehousing for information technology products.","CCI-000735":"The organization employs a diverse set of suppliers for information systems.","CCI-000736":"The organization employs a diverse set of suppliers for information system components.","CCI-000737":"The organization employs a diverse set of suppliers for information technology products.","CCI-000738":"The organization employs a diverse set of suppliers for information system services.","CCI-000739":"The organization employs standard configurations for information systems.","CCI-000740":"The organization employs standard configurations for information system components.","CCI-000741":"The organization employs standard configurations for information technology products.","CCI-000742":"The organization minimizes the time between purchase decisions and delivery of information systems.","CCI-000743":"The organization minimizes the time between purchase decisions and delivery of information system components.","CCI-000744":"The organization minimizes the time between purchase decisions and delivery of information technology products.","CCI-000745":"The organization employs independent analysis and penetration testing against delivered information systems.","CCI-000746":"The organization employs independent analysis and penetration testing against delivered information system components.","CCI-000747":"The organization employs independent analysis and penetration testing against delivered information technology products.","CCI-000748":"The organization defines level of trustworthiness for the information system.","CCI-000749":"The organization requires that the information system meets the organization-defined level of trustworthiness.","CCI-000750":"The organization defines the list of critical information system components that require re-implementation.","CCI-000751":"The organization determines the organization-defined list of critical information system components that require re-implementation.","CCI-000752":"The organization re-implements organization-defined critical information system components.","CCI-000753":"The organization identifies information system components for which alternative sourcing is not viable.","CCI-000754":"The organization defines measures to be employed to prevent critical security controls for information system components from being compromised.","CCI-000755":"The organization employs organization-defined measures to ensure critical security controls for the information system components are not compromised.","CCI-000756":"The organization develops an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000757":"Disseminate an organization-level; mission/business process-level; and/or system-level identification and authentication policy to organization-defined personnel.","CCI-000758":"Review and update the current identification and authentication policy in accordance with the organization-defined frequency.","CCI-000759":"Defines a frequency for reviewing and updating the identification and authentication policy.","CCI-000760":"The organization develops procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.","CCI-000761":"The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.","CCI-000762":"Review and update the current identification and authentication procedures in accordance with the organization-defined frequency.","CCI-000763":"Defines a frequency for reviewing and updating the identification and authentication procedures.","CCI-000764":"Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.","CCI-000765":"Implement multifactor authentication for access to privileged accounts.","CCI-000766":"Implement multifactor authentication for access to non-privileged accounts.","CCI-000767":"The information system implements multifactor authentication for local access to privileged accounts.","CCI-000768":"The information system implements multifactor authentication for local access to non-privileged accounts.","CCI-000769":"The organization allows the use of group authenticators only when used in conjunction with an individual/unique authenticator.","CCI-000770":"The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.","CCI-000771":"The information system uses multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the information system being accessed.","CCI-000772":"The information system uses multifactor authentication for network access to non-privileged accounts where one of the factors is provided by a device separate from the information system being accessed.","CCI-000773":"The organization defines replay-resistant authentication mechanisms to be used for network access to privileged accounts.","CCI-000774":"The information system uses organization-defined replay-resistant authentication mechanisms for network access to privileged accounts.","CCI-000775":"The organization defines replay-resistant authentication mechanisms to be used for network access to non-privileged accounts.","CCI-000776":"The information system uses organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts.","CCI-000777":"Defines devices and/or types of devices for which identification and authentication is required before establishing a connection.","CCI-000778":"Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.","CCI-000779":"The information system authenticates devices before establishing remote network connections using bidirectional authentication between devices that is cryptographically based.","CCI-000780":"The information system authenticates devices before establishing wireless network connections using bidirectional authentication between devices that is cryptographically based.","CCI-000781":"The information system authenticates devices before establishing network connections using bidirectional authentication between devices that is cryptographically based.","CCI-000782":"The organization standardizes, with regard to dynamic address allocation, Dynamic Host Control Protocol (DHCP) lease information and the time assigned to DHCP-enabled devices.","CCI-000783":"Audit lease information when assigned to a device.","CCI-000784":"The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a user identifier.","CCI-000785":"The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a device identifier.","CCI-000786":"The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies an individual.","CCI-000787":"The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies a device.","CCI-000788":"The organization manages information system identifiers for users and devices by assigning the user identifier to the intended party.","CCI-000789":"The organization manages information system identifiers for users and devices by assigning the device identifier to the intended device.","CCI-000790":"The organization defines a time period for which the reuse of user identifiers is prohibited.","CCI-000791":"The organization defines a time period for which the reuse of device identifiers is prohibited.","CCI-000792":"The organization manages information system identifiers for users and devices by preventing reuse of user identifiers for an organization-defined time period.","CCI-000793":"The organization manages information system identifiers for users and devices by preventing reuse of device identifiers for an organization-defined time period.","CCI-000794":"The organization defines a time period of inactivity after which the identifier is disabled.","CCI-000795":"The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.","CCI-000796":"Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.","CCI-000797":"The organization requires that registration to receive a user ID and password include authorization by a supervisor.","CCI-000798":"The organization requires that registration to receive a user ID and password be done in person before a designated registration authority.","CCI-000799":"The organization requires multiple forms of certification of individual identification, such as documentary evidence or a combination of documents and biometrics, be presented to the registration authority.","CCI-000800":"Defines characteristics for identifying individual status.","CCI-000801":"Manage individual identifiers by uniquely identifying each individual as organization-defined characteristics identifying individual status.","CCI-000802":"The information system dynamically manages identifiers, attributes, and associated access authorizations.","CCI-000803":"Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.","CCI-000804":"Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.","CCI-000805":"Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000806":"Disseminate an organization-level; mission/business process-level; and/or system-level incident response policy to organization-defined personnel or roles.","CCI-000807":"Review and update the current incident response policy in accordance with organization-defined frequency.","CCI-000808":"Defines the frequency with which to review and update the current incident response policy.","CCI-000809":"Develop and document procedures to facilitate the implementation of incident response policy and associated incident response controls.","CCI-000810":"Disseminate the incident response procedures to organization-defined personnel or roles.","CCI-000811":"Review and update the current incident response procedures in accordance with organization-defined frequency.","CCI-000812":"Defines the frequency with which to review and update the current incident response procedures.","CCI-000813":"Provide incident response training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming an incident response role or responsibility.","CCI-000814":"Provide incident response training in accordance with organization-defined frequency.","CCI-000815":"Defines a frequency for incident response training.","CCI-000816":"Incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations.","CCI-000817":"Provide an incident response training environment using organization-defined automated mechanisms.","CCI-000818":"Test the effectiveness of the incident response capability for the system on an organization-defined frequency using organization-defined tests.","CCI-000819":"Defines a frequency for incident response tests.","CCI-000820":"Defines tests for incident response.","CCI-000821":"Test the incident response capability using organization-defined automated mechanisms.","CCI-000822":"Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.","CCI-000823":"Coordinate incident handling activities with contingency planning activities.","CCI-000824":"The organization incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises.","CCI-000825":"Support the incident handling process using organization-defined automated mechanisms.","CCI-000826":"Include organization-defined types of dynamic reconfiguration for organization-defined system components as part of the incident response capability.","CCI-000827":"Identify organization-defined classes of incidents for which organization-defined actions are to be taken to ensure continuation of organizational mission and business functions.","CCI-000828":"Identify actions to take in response to organization-defined classes of incidents to ensure continuation of organizational missions and business functions.","CCI-000829":"Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.","CCI-000830":"Defines security violations that, if detected, initiate a configurable capability to automatically disable the system.","CCI-000831":"Implement a configurable capability to automatically disable the system if organization-defined security violations are detected.","CCI-000832":"Track and document incidents.","CCI-000833":"The organization employs automated mechanisms to assist in the tracking of security incidents.","CCI-000834":"Defines a time period for personnel to report suspected incidents to the organizational incident response capability.","CCI-000835":"Require personnel to report suspected incidents to the organizational incident response capability within the organization-defined time period.","CCI-000836":"Report incident information to organization-defined authorities.","CCI-000837":"Report incidents using organization-defined automated mechanisms.","CCI-000838":"Report system vulnerabilities associated with reported incidents to organization-defined personnel or roles.","CCI-000839":"Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.","CCI-000840":"The organization employs automated mechanisms to increase the availability of incident response-related information and support.","CCI-000841":"Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability.","CCI-000842":"Identify organizational incident response team members to the external providers.","CCI-000843":"The organization develops an incident response plan that provides the organization with a roadmap for implementing its incident response capability; describes the structure and organization of the incident response capability; provides a high-level approach for how the incident response capability fits into the overall organization; meets the unique requirements of the organization, which relate to mission, size, structure, and functions; defines reportable incidents; provides metrics for measuring the incident response capability within the organization; and defines the resources and management support needed to effectively maintain and mature an incident response capability.","CCI-000844":"Develop an incident response plan that is reviewed and approved by organization-defined personnel or roles on an organization-defined frequency.","CCI-000845":"Defines incident response personnel (identified by name and/or by role) and organizational elements to whom copies of the incident response plan are distributed.","CCI-000846":"Distributes copies of the incident response plan to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.","CCI-000847":"The organization defines the frequency for reviewing the incident response plan.","CCI-000848":"The organization reviews the incident response plan on an organization-defined frequency.","CCI-000849":"Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing.","CCI-000850":"Communicate incident response plan changes to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.","CCI-000851":"Defines the frequency with which to review and update the current system maintenance policy.","CCI-000852":"Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000853":"Disseminate an organization-level; mission/business process-level; and/or system-level maintenance policy to organization-defined personnel or roles.","CCI-000854":"Review and update the current maintenance policy in accordance with organization-defined frequency.","CCI-000855":"Develop and document procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls.","CCI-000856":"Disseminate procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls to organization-defined personnel or roles.","CCI-000857":"Review and update the current maintenance procedures in accordance with organization-defined frequency.","CCI-000858":"The organization schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-000859":"The organization approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.","CCI-000860":"Require that organization-defines personnel or roles explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement.","CCI-000861":"Sanitize equipment to remove organization-defined information from associated media prior to removal from organizational facilities for off-site maintenance, repairs or replacement.","CCI-000862":"Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair or replacement actions.","CCI-000863":"The organization maintains maintenance records for the information system that include the date and time of maintenance, the name of the individual performing the maintenance, the name of escort, if necessary, a description of the maintenance performed, and a list of equipment removed or replaced (including identification numbers, if applicable).","CCI-000864":"The organization employs automated mechanisms to schedule, conduct, and document maintenance and repairs as required.","CCI-000865":"Approve the use of system maintenance tools.","CCI-000866":"Control the use of system maintenance tools.","CCI-000867":"Monitor the use of system maintenance tools.","CCI-000868":"The organization maintains, on an ongoing basis, information system maintenance tools.","CCI-000869":"Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.","CCI-000870":"Check media containing diagnostic and test programs for malicious code before the media are used in the system.","CCI-000871":"Prevent the unauthorized removal of maintenance equipment containing organizational information by: (a) verifying that there is no organizational information contained on the equipment; (b) sanitizing or destroying the equipment; (c) retaining the equipment within the facility; or (d) obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.","CCI-000872":"The organization employs automated mechanisms to restrict the use of maintenance tools to authorized personnel only.","CCI-000873":"Approve nonlocal maintenance and diagnostic activities.","CCI-000874":"Monitor nonlocal maintenance and diagnostic activities.","CCI-000875":"The organization controls non-local maintenance and diagnostic activities.","CCI-000876":"Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system.","CCI-000877":"Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.","CCI-000878":"Maintain records for nonlocal maintenance and diagnostic activities.","CCI-000879":"The organization terminates sessions and network connections when nonlocal maintenance is completed.","CCI-000880":"The organization audits non-local maintenance and diagnostic sessions.","CCI-000881":"The organization documents, in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.","CCI-000882":"Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced.","CCI-000883":"Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information).","CCI-000884":"Protect nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant.","CCI-000885":"The organization requires that maintenance personnel notify organization-defined personnel when non-local maintenance is planned (i.e., date/time).","CCI-000886":"Defines the personnel or roles to be notified of the date and time of planned nonlocal maintenance.","CCI-000887":"Require the approval of each nonlocal maintenance session by organization-defined personnel or roles.","CCI-000888":"The organization employs cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications.","CCI-000889":"The organization employs remote disconnect verification at the termination of non-local maintenance and diagnostic sessions.","CCI-000890":"Establish a process for maintenance personnel authorization.","CCI-000891":"Maintain a list of authorized maintenance organizations or personnel.","CCI-000892":"The organization ensures that personnel performing maintenance on the information system have required access authorizations or designates organizational personnel with required access authorizations and technical competence deemed necessary to supervise information system maintenance.","CCI-000893":"Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens.","CCI-000894":"Requires maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals to be escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified.","CCI-000895":"Require that, prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system be sanitized and all nonvolatile storage media be removed or physically disconnected from the system and secured.","CCI-000896":"The organization requires that in the event an information system component cannot be sanitized, the procedures contained in the security plan for the system be enforced.","CCI-000897":"Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.","CCI-000898":"Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.","CCI-000899":"Ensure that cleared foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments.","CCI-000900":"Ensure that that approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.","CCI-000901":"The organization defines a list of security-critical information system components and/or key information technology components for which it will obtain maintenance support and/or spare parts.","CCI-000902":"The organization defines a time period for obtaining maintenance support and/or spare parts for security-critical information system components and/or key information technology components.","CCI-000903":"Obtain maintenance support and/or spare parts for organization-defined system components within an organization-defined time period of failure.","CCI-000904":"Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000905":"Disseminate a physical and environmental protection policy to organization-defined personnel or roles.","CCI-000906":"Review and update the current physical and environmental protection policy in accordance with organization-defined frequency.","CCI-000907":"Defines the frequency with which to review and update the physical and environmental protection policy.","CCI-000908":"Develop and document procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls.","CCI-000909":"Disseminate physical and environmental protection procedures to organization-defined personnel or roles.","CCI-000910":"Review and update the current physical and environmental protection procedures in accordance with organization-defined frequency.","CCI-000911":"Defines the frequency with which to review and update the physical and environmental protection procedures.","CCI-000912":"Develop a list of individuals with authorized access to the facility where the system resides.","CCI-000913":"Issue authorization credentials for facility access.","CCI-000914":"Review the access list detailing authorized facility access by individuals in accordance with organization-defined frequency.","CCI-000915":"Defines the frequency with which to review the access list detailing authorized facility access by individuals.","CCI-000916":"Authorize physical access to the facility where the system resides based on position or role.","CCI-000917":"Require two forms of identification from an organization-defined list of acceptable forms of identification for visitor access to the facility where the system resides.","CCI-000918":"The organization restricts physical access to the facility containing an information system that processes classified information to authorized personnel with appropriate clearances and access authorizations.","CCI-000919":"The organization enforces physical access authorizations at organization-defined entry/exit points to the facility where the information system resides.","CCI-000920":"Verify individual access authorizations before granting access to the facility.","CCI-000921":"The organization controls ingress/egress to the facility where the information system resides using one or more organization-defined physical access control systems/devices or guards.","CCI-000922":"The organization controls access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.","CCI-000923":"Secure keys, combinations, and other physical access devices.","CCI-000924":"Inventory organization-defined physical access devices on an organization-defined frequency.","CCI-000925":"Defines the frequency for conducting inventories of organization-defined physical access devices.","CCI-000926":"Change combinations and keys in accordance with organization-defined frequency and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.","CCI-000927":"Defines a frequency for changing combinations and keys.","CCI-000928":"Enforce physical access authorizations to the system in addition to the physical access controls for the facility where the system resides at organization-defined physical spaces containing one or more components of the system.","CCI-000929":"Perform security checks in accordance with organization-defined frequency at the physical boundary of the facility or system for unauthorized exfiltration of information or removal of system components.","CCI-000930":"Employ guards to control every physical access point to the facility where the system resides 24 hours per day, 7 days per week.","CCI-000931":"Use lockable physical casings to protect organization-defined system components from unauthorized physical access.","CCI-000932":"Defines system components to be protected from unauthorized physical access using lockable physical casings.","CCI-000933":"Employ organization-defined anti-tamper technologies to deter and/or prevent physical tampering or alteration of organization-defined hardware components within the system.","CCI-000934":"The organization employs a penetration testing process that includes unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility on an organization-defined frequency.","CCI-000935":"The organization defines the frequency of unannounced attempts to be included in a penetration testing process to bypass or circumvent security controls associated with physical access points to the facility.","CCI-000936":"Control physical access to organization-defined system distribution and transmission lines within organizational facilities using organization-defined security controls.","CCI-000937":"Control physical access to output from organization-defined output devices to prevent unauthorized individuals from obtaining the output.","CCI-000938":"The organization monitors physical access to the information system to detect and respond to physical security incidents.","CCI-000939":"Review physical access logs in accordance with organization-defined frequency.","CCI-000940":"Defines a frequency for reviewing physical access logs.","CCI-000941":"Coordinate results of reviews and investigations with the organization's incident response capability.","CCI-000942":"Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.","CCI-000943":"The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions.","CCI-000944":"The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible.","CCI-000945":"The organization escorts visitors and monitors visitor activity, when required.","CCI-000946":"The organization requires two forms of identification for visitor access to the facility.","CCI-000947":"Maintain visitor access records to the facility where the system resides for an organization-defined time period.","CCI-000948":"Review visitor access records in accordance with organization-defined frequency.","CCI-000949":"Defines the frequency with which to review the visitor access records for the facility where the system resides.","CCI-000950":"Maintain and review visitor access records using organization-defined automated mechanisms.","CCI-000951":"The organization maintains a record of all physical access, both visitor and authorized individuals.","CCI-000952":"Protect power equipment and power cabling for the system from damage and destruction.","CCI-000953":"The organization employs redundant and parallel power cabling paths.","CCI-000954":"Employ automatic voltage controls for organization-defined critical system components.","CCI-000955":"Defines critical system components that require automatic voltage controls.","CCI-000956":"Provides the capability of shutting off power to the organization-defined system or individual system components in emergency situations.","CCI-000957":"Place emergency shutoff switches or devices in an organization-defined location by system or system component to facilitate access for authorized personnel.","CCI-000958":"Defines a location for emergency shutoff switches or devices by system or system component.","CCI-000959":"Protect emergency power shutoff capability from unauthorized activation.","CCI-000960":"The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system in the event of a primary power source loss.","CCI-000961":"Provide an alternate power supply for the system that is activated manually or automatically and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.","CCI-000962":"The organization provides a long-term alternate power supply for the information system that is self-contained and not reliant on external power generation.","CCI-000963":"Employ and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.","CCI-000964":"The organization provides emergency lighting for all areas within the facility supporting essential missions and business functions.","CCI-000965":"Employ and maintain fire detection and suppression systems that are supported by an independent energy source.","CCI-000966":"The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire.","CCI-000967":"The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to the organization and emergency responders.","CCI-000968":"Employ an automatic fire suppression capability for the system when the facility is not staffed on a continuous basis.","CCI-000969":"The organization ensures that the facility undergoes, on an organization-defined frequency, fire marshal inspections and promptly resolves identified deficiencies.","CCI-000970":"The organization defines a frequency for fire marshal inspections.","CCI-000971":"Maintain temperature; humidity; pressure; radiation; and/or organization-defined environmental control levels within the facility where the system resides at organization-defined acceptable levels.","CCI-000972":"Defines acceptable temperature, humidity, pressure, radiation, and/or organization-defined environmental control levels to be maintained within the facility where the system resides.","CCI-000973":"Monitor environmental control levels in accordance with organization-defined frequency.","CCI-000974":"Defines a frequency for monitoring environmental control levels.","CCI-000975":"Employ organization-defined automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system.","CCI-000976":"Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to organization-defined personnel or roles.","CCI-000977":"Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible.","CCI-000978":"Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are working properly.","CCI-000979":"Key personnel have knowledge of the master water shutoff or isolation valves.","CCI-000980":"The organization employs mechanisms that, without the need for manual intervention, protect the information system from water damage in the event of a water leak.","CCI-000981":"Authorize organization-defined types of system components entering and exiting the facility.","CCI-000982":"The organization monitors organization-defined types of information system components entering and exiting the facility.","CCI-000983":"Control organization-defined types of system components entering and exiting the facility.","CCI-000984":"Maintain records of system components.","CCI-000985":"Employ organization-defined controls at alternate work sites.","CCI-000986":"The organization defines management, operational, and technical information system security controls to be employed at alternate work sites.","CCI-000987":"Assess as feasible, the effectiveness of controls at alternate work sites.","CCI-000988":"Provide a means for employees to communicate with information security personnel in case of incidents.","CCI-000989":"Position system components within the facility to minimize potential damage from organization-defined physical and environmental hazards.","CCI-000990":"The organization positions information system components within the facility to minimize potential damage from environmental hazards.","CCI-000991":"Position system components within the facility to minimize the opportunity for unauthorized access.","CCI-000992":"The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards, and for existing facilities, considers the physical and environmental hazards in its risk mitigation strategy.","CCI-000993":"Protect the system from information leakage due to electromagnetic signals emanations.","CCI-000994":"The organization ensures that information system components, associated data communications, and networks are protected in accordance with national emissions and TEMPEST policies and procedures based on the security category or classification of the information.","CCI-000995":"Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-000996":"Disseminates a media protection policy to organization-defined personnel or roles.","CCI-000997":"Review and update the current media protection policy in accordance with organization-defined frequency.","CCI-000998":"Defines a frequency for reviewing and updating the current media protection policy.","CCI-000999":"Develop and document procedures to facilitate the implementation of the media protection policy and associated media protection controls.","CCI-001000":"Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the media protection policy and associated media protection controls.","CCI-001001":"Review and update the current media protection procedures in accordance with organization-defined frequency.","CCI-001002":"Defines a frequency for reviewing and updating the current media protection procedures.","CCI-001003":"Restrict access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.","CCI-001004":"Defines types of digital and/or non-digital media for which the organization restricts access.","CCI-001005":"Defines personnel or roles from which to restrict access to organization-defined types of digital and/or non-digital media.","CCI-001006":"The organization defines security measures for restricting access to media.","CCI-001007":"Restrict access to media storage areas using organization-defined automated mechanisms.","CCI-001008":"Log access attempts and access granted using organization-defined automated mechanisms.","CCI-001009":"The information system uses cryptographic mechanisms to protect and restrict access to information on portable digital media.","CCI-001010":"Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information.","CCI-001011":"Exempt organization-defined types of system media from marking as long as the media remain within organization-defined controlled areas.","CCI-001012":"Defines types of system media to exempt from marking as long as the media remain within organization-defined controlled areas.","CCI-001013":"Defines controlled areas where organization-defined types of system media are exempt from being marked.","CCI-001014":"The organization physically controls and securely stores organization-defined types of digital and/or non-digital media within organization-defined controlled areas.","CCI-001015":"Defines types of digital and/or non-digital media to physically control and securely store within organization-defined controlled areas.","CCI-001016":"Defines controlled areas where organization-defined types of digital and/or non-digital media are physically controlled and securely stored.","CCI-001017":"The organization defines security measures for securing media storage.","CCI-001018":"The organization protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.","CCI-001019":"The organization employs cryptographic mechanisms to protect information in storage.","CCI-001020":"The organization protects and controls organization-defined types of information system media during transport outside of controlled areas using organization-defined security safeguards.","CCI-001021":"Defines types of system media protected and controlled during transport outside of controlled areas.","CCI-001022":"Defines controls to be used to protect and control organization-defined types of system media during transport outside of controlled areas.","CCI-001023":"Maintain accountability for system media during transport outside of controlled areas.","CCI-001024":"Restrict the activities associated with the transport of system media to authorized personnel.","CCI-001025":"Document activities associated with the transport of system media.","CCI-001026":"Employ an identified custodian during transport of system media outside of controlled areas.","CCI-001027":"The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.","CCI-001028":"Sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures.","CCI-001029":"The organization tracks, documents, and verifies media sanitization and disposal actions.","CCI-001030":"The organization tests sanitization equipment and procedures in accordance with the organization-defined frequency to verify that the intended sanitization is being achieved.","CCI-001031":"Defines a frequency for testing sanitization equipment and procedures to ensure that the intended sanitization is being achieved.","CCI-001032":"Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system in accordance with organization-defined circumstances requiring sanitization of portable storage devices.","CCI-001033":"Defines circumstances requiring sanitization of portable storage devices prior to connecting such devices to the system.","CCI-001034":"The organization sanitizes information system media containing Controlled Unclassified Information (CUI) or other sensitive information in accordance with applicable organizational and/or federal standards and policies.","CCI-001035":"The organization sanitizes information system media containing classified information in accordance with NSA standards and policies.","CCI-001036":"The organization destroys information system media that cannot be sanitized.","CCI-001037":"Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-001038":"Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.","CCI-001039":"Review and update the current risk assessment policy in accordance with organization-defined frequency.","CCI-001040":"Defines the frequency with which to review and update the current risk assessment policy.","CCI-001041":"Develop and document procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls.","CCI-001042":"Disseminate risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls to organization-defined personnel or roles.","CCI-001043":"Review and update the current risk assessment procedures in accordance with organization-defined frequency.","CCI-001044":"Defines the frequency with which to review and update the current risk assessment procedures.","CCI-001045":"The organization categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.","CCI-001046":"Document the security categorization results including supporting rationale in the security plan for the system.","CCI-001047":"Verify the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.","CCI-001048":"Conduct a risk assessment, including determining the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information.","CCI-001049":"Document risk assessment results in the organization-defined document.","CCI-001050":"Review risk assessment results on an organization-defined frequency.","CCI-001051":"Defines a frequency for reviewing risk assessment results.","CCI-001052":"Update the risk assessment on an organization-defined frequency or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.","CCI-001053":"Defines a frequency for updating the risk assessment.","CCI-001054":"Monitor and scan for vulnerabilities in the system and hosted applications on an organization-defined frequency and/or randomly in accordance with organization-defined process.","CCI-001055":"Defines a frequency for scanning for vulnerabilities in the system and hosted applications, and/or randomly in accordance with organization-defined process.","CCI-001056":"Monitor and scan for vulnerabilities in the system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported.","CCI-001057":"Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating platforms, software flaws, and improper configurations.","CCI-001058":"Analyze vulnerability scan reports and results from vulnerability monitoring.","CCI-001059":"Remediate legitimate vulnerabilities in organization-defined response times in accordance with an organizational assessment risk.","CCI-001060":"Defines response times for remediating legitimate vulnerabilities in accordance with an organization assessment of risk.","CCI-001061":"Share information obtained from the vulnerability monitoring process and control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other systems.","CCI-001062":"The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.","CCI-001063":"Update the system vulnerabilities scanned on an organization-defined frequency, prior to a new scan, and/or when new vulnerabilities are identified and reported.","CCI-001064":"Defines a frequency for updating the system vulnerabilities scanned.","CCI-001065":"The organization employs vulnerability scanning procedures that can demonstrate the breadth of coverage (i.e., information system components scanned).","CCI-001066":"Determine information about the system that is discoverable.","CCI-001067":"Implement privileged access authorization to organization-identified system components for organization-defined vulnerability scanning activities.","CCI-001068":"Compare the results of multiple vulnerability scans using organization-defined automated mechanisms.","CCI-001069":"The organization employs automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization-defined frequency.","CCI-001070":"The organization defines a frequency for employing automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials.","CCI-001071":"Review historic audit logs to determine if a vulnerability identified in the organization-defined system has been previously exploited within an organization-defined time period.","CCI-001072":"The organization employs an independent penetration agent or penetration team to conduct a vulnerability analysis on the information system.","CCI-001073":"The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system based on the vulnerability analysis to determine the exploitability of identified vulnerabilities.","CCI-001074":"The organization develops a system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-001075":"Disseminates to organization-defined personnel or roles the organization-level; mission/business process-level; and/or system-level system and communications protection policy.","CCI-001076":"Review and update the current system and communications protection policy in accordance with organization-defined frequency.","CCI-001077":"Defines the frequency for reviewing and updating the current system and communications protection policy.","CCI-001078":"The organization develops system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.","CCI-001079":"Disseminates to organization-defined personnel or roles the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.","CCI-001080":"Review and update the current system and communications protection procedures in accordance with organization-defined frequency.","CCI-001081":"Defines the frequency for reviewing and updating the current system and communications protection procedures.","CCI-001082":"Separate user functionality, including user interface services, from system management functionality.","CCI-001083":"Prevent the presentation of system management functionality at an interface for non-privileged users.","CCI-001084":"Isolate security functions from nonsecurity functions.","CCI-001085":"Employ hardware separation mechanisms to implement security function isolation.","CCI-001086":"Isolate security functions enforcing access and information flow control from both nonsecurity functions and from other security functions.","CCI-001087":"The organization implements an information system isolation boundary to minimize the number of nonsecurity functions included within the boundary containing security functions.","CCI-001088":"The organization implements security functions as largely independent modules that avoid unnecessary interactions between modules.","CCI-001089":"Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.","CCI-001090":"Prevent unauthorized and unintended information transfer via shared system resources.","CCI-001091":"The information system does not share resources that are used to interface with systems operating at different security levels.","CCI-001092":"The information system protects against or limits the effects of the organization-defined or referenced types of denial of service attacks.","CCI-001093":"Defines the types of denial-of-service events for protecting against or limiting the effects of the denial-of-service events.","CCI-001094":"Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems.","CCI-001095":"Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service attacks.","CCI-001096":"The information system limits the use of resources by priority.","CCI-001097":"Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.","CCI-001098":"Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.","CCI-001099":"The organization physically allocates publicly accessible information system components to separate subnetworks with separate physical network interfaces.","CCI-001100":"The information system prevents public access into the organization's internal networks except as appropriately mediated by managed interfaces employing boundary protection devices.","CCI-001101":"Limit the number of external network connections to the system.","CCI-001102":"Implement a managed interface for each external telecommunication service.","CCI-001103":"Establish a traffic flow policy for each managed interface for each external telecommunication service.","CCI-001104":"The organization employs security controls as needed to protect the confidentiality and integrity of the information being transmitted.","CCI-001105":"Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need.","CCI-001106":"Review exceptions to the traffic flow policy on an organization-defined frequency for each external telecommunication service.","CCI-001107":"Defines a frequency for the review of exceptions to the traffic flow policy for each external telecommunication service.","CCI-001108":"Remove traffic flow policy exceptions that are no longer supported by an explicit mission or business need for each external telecommunication service.","CCI-001109":"Deny network communications traffic by default and allow network communications traffic by exception at managed interfaces; and/or for organization-defined systems.","CCI-001110":"The organization prevents the unauthorized release of information outside of the information system boundary or any unauthorized communication through the information system boundary when there is an operational failure of the boundary protection mechanisms.","CCI-001111":"The information system prevents remote devices that have established a non-remote connection with the system from communicating outside of that communications path with resources in external networks.","CCI-001112":"Route organization-defined internal communications traffic to organization-defined external networks through authenticated proxy servers at managed interfaces.","CCI-001113":"Defines the internal communications traffic to be routed to external networks.","CCI-001114":"Defines the external networks to which organization-defined internal communications traffic should be routed.","CCI-001115":"The information system, at managed interfaces, denies network traffic and audits internal users (or malicious code) posing a threat to external information systems.","CCI-001116":"Prevent the exfiltration of information.","CCI-001117":"The information system checks incoming communications to ensure the communications are coming from an authorized source and routed to an authorized destination.","CCI-001118":"The information system implements host-based boundary protection mechanisms for servers, workstations, and mobile devices.","CCI-001119":"Isolate organization-defined information security tools, mechanisms, and support components from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.","CCI-001120":"Defines the information security tools, mechanisms, and support components to be isolated.","CCI-001121":"Protect against unauthorized physical connections at organization-defined managed interfaces.","CCI-001122":"The organization defines the managed interfaces where boundary protections against unauthorized physical connections are to be implemented.","CCI-001123":"Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.","CCI-001124":"Prevent discovery of specific system components that represent a managed interface.","CCI-001125":"Enforce adherence to protocol formats.","CCI-001126":"Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.","CCI-001127":"The information system protects the integrity of transmitted information.","CCI-001128":"The organization employs cryptographic mechanisms to recognize changes to information during transmission unless otherwise protected by alternative physical measures.","CCI-001129":"The information system maintains the integrity of information during aggregation, packaging, and transformation in preparation for transmission.","CCI-001130":"The information system protects the confidentiality of transmitted information.","CCI-001131":"The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical measures.","CCI-001132":"The information system maintains the confidentiality of information during aggregation, packaging, and transformation in preparation for transmission.","CCI-001133":"Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.","CCI-001134":"Defines the time period of inactivity after which the system terminates a network connection associated with a communications session.","CCI-001135":"Provide a physically or logically isolated trusted communication path for communication between the user and the trusted components of the system.","CCI-001136":"The organization defines security functions include information system authentication and reauthentication.","CCI-001137":"The organization establishes cryptographic keys for required cryptography employed within the information system.","CCI-001138":"The organization manages cryptographic keys for required cryptography employed within the information system.","CCI-001139":"Maintain availability of information in the event of the loss of cryptographic keys by users.","CCI-001140":"The organization produces, controls, and distributes symmetric cryptographic keys using NIST-approved or NSA-approved key management technology and processes.","CCI-001141":"The organization produces, controls, and distributes symmetric and asymmetric cryptographic keys using NSA-approved key management technology and processes.","CCI-001142":"The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 certificates or prepositioned keying material.","CCI-001143":"The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key.","CCI-001144":"The information system implements required cryptographic protections using cryptographic modules that comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.","CCI-001145":"The organization employs, at a minimum, FIPS-validated cryptography to protect unclassified information.","CCI-001146":"The organization employs NSA-approved cryptography to protect classified information.","CCI-001147":"The organization employs, at a minimum, FIPS-validated cryptography to protect information when such information must be separated from individuals who have the necessary clearances yet lack the necessary access approvals.","CCI-001148":"The organization employs FIPS-validated or NSA-approved cryptography to implement digital signatures.","CCI-001149":"The information system protects the integrity and availability of publicly available information and applications.","CCI-001150":"Prohibit remote activation of collaborative computing devices and applications, excluding the organization-defined exceptions where remote activation is to be allowed.","CCI-001151":"Defines exceptions to the prohibition of collaborative computing devices where remote activation is to be allowed.","CCI-001152":"Provide an explicit indication of use to users physically present at collaborative computing devices.","CCI-001153":"Provide physical or logical disconnect of collaborative computing devices in a manner that supports ease of use.","CCI-001154":"The information system or supporting environment blocks both inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers.","CCI-001155":"Disable or remove collaborative computing devices and applications from organization-defined systems or system components in organization-defined secure work areas.","CCI-001156":"Defines secure work areas where collaborative computing devices and applications are to be disabled or removed.","CCI-001157":"Associate organization-defined security attributes with information exchanged between systems.","CCI-001158":"Verify the integrity of transmitted security attributes.","CCI-001159":"Issue public key certificates under an organization-defined certificate policy or obtain public key certificates from an approved service provider.","CCI-001160":"Defines acceptable and unacceptable mobile code and mobile code technologies.","CCI-001161":"The organization establishes usage restrictions for acceptable mobile code and mobile code technologies.","CCI-001162":"The organization establishes implementation guidance for acceptable mobile code and mobile code technologies.","CCI-001163":"Authorize the use of mobile code within the system.","CCI-001164":"Monitor the use of mobile code within the system.","CCI-001165":"Control the use of mobile code within the system.","CCI-001166":"Identify organization-defined unacceptable mobile code.","CCI-001167":"Verify that the development of mobile code to be deployed in information systems meets organization-defined mobile code requirements.","CCI-001168":"Defines mobile code requirements for the acquisition, development, and use of mobile code.","CCI-001169":"Prevent the download of organization-defined unacceptable mobile code.","CCI-001170":"Prevents the automatic execution of mobile code in organization-defined software applications.","CCI-001171":"Defines software applications in which automatic mobile code execution is to be prohibited.","CCI-001172":"Defines actions to be enforced before executing mobile code.","CCI-001173":"The organization establishes usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.","CCI-001174":"The organization establishes implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.","CCI-001175":"The organization authorizes the use of VoIP within the information system.","CCI-001176":"The organization monitors the use of VoIP within the information system.","CCI-001177":"The organization controls the use of VoIP within the information system.","CCI-001178":"Provide additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.","CCI-001179":"Provides the means to indicate the security status of child zones, when operating as part of a distributed, hierarchical namespace.","CCI-001180":"The information system performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources when requested by client systems.","CCI-001181":"The information system performs data origin authentication and data integrity verification on all resolution responses received whether or not local client systems explicitly request this service.","CCI-001182":"Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant.","CCI-001183":"Ensure the systems that collectively provide name/address resolution service for an organization implement internal/external role separation.","CCI-001184":"Protect the authenticity of communications sessions.","CCI-001185":"Invalidate session identifiers upon user logout or other session termination.","CCI-001186":"The information system provides a readily observable logout capability whenever authentication is used to gain access to web pages.","CCI-001187":"The information system generates a unique session identifier for each session.","CCI-001188":"Generate a unique session identifier for each session with organization-defined randomness requirements.","CCI-001189":"Defines randomness requirements for generating unique session identifiers.","CCI-001190":"Fail to an organization-defined known-system state for the list of organization-defined types of system failures on organization-defined system components on the indicated components while preserving organization-defined system state information in failure.","CCI-001191":"Defines the known system state the system should fail to in the event of an organization-defined system failure.","CCI-001192":"Defines types of system failures for which should fail to an organization-defined known system state.","CCI-001193":"Defines system state information that should be preserved in the event of a system failure.","CCI-001194":"Employ minimal functionality and information storage on organization-defined information system components.","CCI-001195":"Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.","CCI-001196":"Include system components that proactively seek to identify network-based malicious code or malicious websites.","CCI-001197":"Include within organizational systems organization-defined platform-independent applications.","CCI-001198":"Defines applications that are platform independent.","CCI-001199":"Protects the confidentiality and/or integrity of organization-defined information at rest.","CCI-001200":"The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information at rest unless otherwise protected by alternative physical measures.","CCI-001201":"Employ a diverse set of information technologies for organization-defined system components in the implementation of the system.","CCI-001202":"The organization employs virtualization techniques to present information system components as other types of components, or components with differing configurations.","CCI-001203":"Employ virtualization techniques to support the deployment of a diversity of operating systems that are changed on an organization-defined frequency.","CCI-001204":"Defines the frequency of changes to operating systems and applications to support a diversity of deployments.","CCI-001205":"The organization employs randomness in the implementation of the virtualization techniques.","CCI-001206":"The organization requires that information system developers/integrators perform a covert channel analysis to identify those aspects of system communication that are potential avenues for covert storage and timing channels.","CCI-001207":"Test a subset of the identified covert channels to determine which channels are exploitable.","CCI-001208":"The organization partitions the information system into components residing in separate physical domains (or environments) as deemed necessary.","CCI-001209":"The information system protects the integrity of information during the processes of data aggregation, packaging, and transformation in preparation for transmission.","CCI-001210":"For organization-defined system components, load and execute the operating environment from hardware-enforced, read-only media.","CCI-001211":"For organization-defined system components, load and execute organization-defined applications from hardware-enforced, read-only media.","CCI-001212":"Defines system components on which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media.","CCI-001213":"Defines applications that will be loaded and executed from hardware-enforced, read-only media.","CCI-001214":"Employ organization-defined system components with no writeable storage that is persistent across component restart or power on/off.","CCI-001215":"Defines the system components to be employed with no writeable storage.","CCI-001216":"Protect the integrity of information prior to storage on read-only media.","CCI-001217":"Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-001218":"Disseminate an organization-level; mission/business process-level; and/or system level system and information integrity policy to organization-defined personnel or roles.","CCI-001219":"Review and update the current system and information integrity policy in accordance with organization-defined frequency.","CCI-001220":"Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system level system and information integrity policy and associated system integrity controls.","CCI-001221":"Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls.","CCI-001222":"Review and update the current system and information integrity procedures in accordance with organization-defined frequency.","CCI-001223":"Defines the frequency for reviewing and updating the current system and information integrity policy.","CCI-001224":"Defines the frequency for reviewing and updating the current system and information integrity procedures.","CCI-001225":"Identify system flaws.","CCI-001226":"Report system flaws.","CCI-001227":"Correct system flaws.","CCI-001228":"Test software updates related to flaw remediation for effectiveness before installation.","CCI-001229":"Test software updates related to flaw remediation for potential side effects before installation.","CCI-001230":"Incorporate flaw remediation into the organizational configuration management process.","CCI-001231":"The organization centrally manages the flaw remediation process.","CCI-001232":"The organization installs software updates automatically.","CCI-001233":"The organization employs automated mechanisms on an organization-defined frequency to determine the state of information system components with regard to flaw remediation.","CCI-001234":"The organization defines a frequency for employing automated mechanisms to determine the state of information system components with regard to flaw remediation.","CCI-001235":"Measure the time between flaw identification and flaw remediation.","CCI-001236":"Defines benchmarks for the time taken to apply corrective actions after flaw identification.","CCI-001237":"The organization employs automated patch management tools to facilitate flaw remediation to organization-defined information system components.","CCI-001238":"The organization defines information system components for which automated patch management tools are to be employed to facilitate flaw remediation.","CCI-001239":"The organization employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.","CCI-001240":"The organization updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.","CCI-001241":"Configure malicious code protection mechanisms to perform periodic scans of the system on an organization-defined frequency.","CCI-001242":"The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.","CCI-001243":"Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection.","CCI-001244":"Defines one or more actions to perform in response to malicious code detection, such as blocking malicious code, quarantining malicious code, or sending alerts to administrators.","CCI-001245":"Address the receipt of false positives during malicious code detection and eradication, and the resulting potential impact on the availability of the system.","CCI-001246":"The organization centrally manages malicious code protection mechanisms.","CCI-001247":"The information system automatically updates malicious code protection mechanisms.","CCI-001248":"The information system prevents non-privileged users from circumventing malicious code protection capabilities.","CCI-001249":"Update malicious code protection mechanisms only when directed by a privileged user.","CCI-001250":"The organization does not allow users to introduce removable media into the information system.","CCI-001251":"Test malicious code protection mechanisms on an organization-defined frequency by introducing a known benign code into the system.","CCI-001252":"The organization monitors events on the information system in accordance with organization-defined monitoring objectives and detects information system attacks.","CCI-001253":"Defines the objectives of monitoring for attacks and indicators of potential attacks on the system.","CCI-001254":"The organization identifies unauthorized use of the information system.","CCI-001255":"Invoke internal monitoring capabilities or deploy monitoring devices strategically within the system to collect organization-determined essential information.","CCI-001256":"Invoke internal monitoring capabilities or deploy monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization.","CCI-001257":"Adjust the level of system monitoring activity when there is a change in increased risk to organizational operations and assets, individuals, other organizations, or the Nation.","CCI-001258":"Obtain legal opinion with regard to system monitoring activities.","CCI-001259":"The organization interconnects and configures individual intrusion detection tools into a systemwide intrusion detection system using common protocols.","CCI-001260":"Employ automated tools to support near real-time analysis of events.","CCI-001261":"The organization employs automated tools to integrate intrusion detection tools into access control and flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.","CCI-001262":"The information system monitors inbound and outbound communications for unusual or unauthorized activities or conditions.","CCI-001263":"The information system provides near real-time alerts when any of the organization-defined list of compromise or potential compromise indicators occurs.","CCI-001264":"Defines the indicators of compromise or potential compromise which will result in system alerts being provided to organization-defined personnel or roles.","CCI-001265":"The information system prevents non-privileged users from circumventing intrusion detection and prevention capabilities.","CCI-001266":"Notify an organization-defined incident response personnel (identified by name and/or by role) of detected suspicious events.","CCI-001267":"Defines incident response personnel (identified by name and/or by role) to be notified of detected suspicious events.","CCI-001268":"Defines the least-disruptive actions to be taken by system to terminate suspicious events.","CCI-001269":"The organization protects information obtained from intrusion monitoring tools from unauthorized access, modification, and deletion.","CCI-001270":"Test intrusion monitoring tools at an organization-defined frequency.","CCI-001271":"Defines the frequency for testing intrusion monitoring tools.","CCI-001272":"The organization makes provisions so encrypted traffic is visible to information system monitoring tools.","CCI-001273":"Analyze outbound communications traffic at the external interfaces to the system to discover anomalies.","CCI-001274":"Alert organization-defined personnel or roles using organization-defined automated mechanisms when inappropriate or unusual activities with security or privacy implications.","CCI-001275":"Defines the activities which will trigger alerts to security personnel of inappropriate or unusual activities.","CCI-001276":"Analyze communications traffic and event patterns for the system.","CCI-001277":"Develop profiles representing common traffic and event patterns.","CCI-001278":"The organization uses the traffic/event profiles in tuning system monitoring devices to reduce the number of false positives to an organization-defined measure of false positives and the number of false negatives to an organization-defined measure of false negatives.","CCI-001279":"The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false positives.","CCI-001280":"The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false negatives.","CCI-001281":"The organization employs a wireless intrusion detection system.","CCI-001282":"Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.","CCI-001283":"Correlate information from monitoring tools employed throughout the system.","CCI-001284":"Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.","CCI-001285":"Receive system security alerts, advisories, and directives from organization-defined external organizations on an ongoing basis.","CCI-001286":"Generate internal security alerts, advisories, and directives as deemed necessary.","CCI-001287":"Disseminate security alerts, advisories, and directives to organization-defined personnel or roles, organization-defined elements within the organization, and/or organization-defined external organizations.","CCI-001288":"Defines the personnel or roles to whom the organization will disseminate security alerts, advisories, and directives.","CCI-001289":"Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.","CCI-001290":"Broadcast security alert and advisory information throughout the organization using organization-defined automated mechanisms.","CCI-001291":"The information system verifies the correct operation of security functions in accordance with organization-defined conditions and in accordance with organization-defined frequency (if periodic verification).","CCI-001292":"The organization defines the appropriate conditions, including the system transitional states if applicable, for verifying the correct operation of security functions.","CCI-001293":"The organization defines the information system responses and alternative action(s) to anomalies discovered during security function verification.","CCI-001294":"Alert organization-defined personnel or roles of failed security verification tests.","CCI-001295":"Implement automated mechanisms to support the management of distributed security function testing.","CCI-001296":"Report the results of security function verification to organization-defined personnel or roles.","CCI-001297":"The information system detects unauthorized changes to software and information.","CCI-001298":"The organization reassesses the integrity of software and information by performing, on an organization-defined frequency, integrity scans of the information system.","CCI-001299":"The organization defines the frequency of integrity scans to be performed on the information system.","CCI-001300":"Employ automated tools that provide notification to organization-defined personnel or roles upon discovering discrepancies during integrity verification.","CCI-001301":"Employ centrally managed integrity verification tools.","CCI-001302":"The organization requires use of tamper-evident packaging for organization-defined information system components during organization-defined conditions.","CCI-001303":"The organization defines information system components that require tamper-evident packaging.","CCI-001304":"The organization defines conditions (i.e., transportation from vendor to operational site, during operation, both) under which tamper-evident packaging must be used for organization-defined information system components.","CCI-001305":"The organization employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.","CCI-001306":"The organization updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.","CCI-001307":"The organization centrally manages spam protection mechanisms.","CCI-001308":"Automatically update spam protection mechanisms on an organization-defined frequency.","CCI-001309":"The organization restricts the capability to input information to the information system to authorized personnel.","CCI-001310":"Checks the validity of organization-defined information inputs to the system.","CCI-001311":"The information system identifies potentially security-relevant error conditions.","CCI-001312":"Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited.","CCI-001313":"The organization defines sensitive or potentially harmful information that should not be contained in error logs and administrative messages.","CCI-001314":"Reveal error messages only to organization-defined personnel or roles.","CCI-001315":"Manage information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.","CCI-001316":"The organization protects the information system from harm by considering mean time to failure rates for an organization-defined list of information system components in specific environments of operation.","CCI-001317":"The organization defines a list of information system components for which mean time to failure rates should be considered to protect the information system from harm.","CCI-001318":"Provide substitute system components.","CCI-001319":"Take system components out of service by transferring component responsibilities to a substitute component no later than an organization-defined fraction or percentage of mean time to failure (MTTF).","CCI-001320":"Defines the maximum fraction or percentage of mean time to failure (MTTF) used to determine when system components are taken out of service by transferring component responsibilities to substitute components.","CCI-001321":"Prohibit processes from executing without supervision for more than an organization-defined time period.","CCI-001322":"Defines a time period that is the longest a process is allowed to execute without supervision.","CCI-001323":"Manually initiate transfers between active and standby system components when the use of the active component reaches an organization-defined percentage of the mean time to failure.","CCI-001324":"The organization defines the minimum frequency at which the organization manually initiates a transfer between active and standby information system components if the mean time to failure (MTTF) exceeds the organization-defined time period.","CCI-001325":"The organization defines a time period that the mean time to failure (MTTF) must exceed before the organization manually initiates a transfer between active and standby information system components.","CCI-001326":"If system component failures are detected, ensure standby components are successfully and transparently installed within an organization-defined time period.","CCI-001327":"Defines a time period for a standby system component to be successfully and transparently installed for the system component that has failed.","CCI-001328":"If system component failures are detected, activate an organization-defined alarm, automatically shut down the system, and/or organization-defined action.","CCI-001329":"Defines the alarm to be activated when a system component failure is detected.","CCI-001330":"Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official.","CCI-001331":"Prohibit the connection of unclassified mobile devices to classified systems.","CCI-001332":"Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official.","CCI-001333":"Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited.","CCI-001334":"Require unclassified mobile devices used in facilities containing systems processing, storing, or transmitting classified information and the information stored on those devices be subject to random reviews and inspections by organization-defined security officials.","CCI-001335":"Defines security officials to perform reviews and inspections of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information.","CCI-001336":"Retain individual training records for an organization-defined time-period.","CCI-001337":"Defines the time period for retaining individual training records.","CCI-001338":"The information system associates the identity of the information producer with the information.","CCI-001339":"The information system validates the binding of the information producer's identity to the information.","CCI-001340":"Maintain reviewer or releaser identity and credentials within the established chain of custody for all information reviewed or released.","CCI-001341":"Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between organization-defined security domains.","CCI-001342":"The organization employs either FIPS-validated or NSA-approved cryptography to implement digital signatures.","CCI-001343":"The information system invokes a system shutdown in the event of an audit failure, unless an alternative audit capability exists.","CCI-001344":"The organization specifies the permitted actions for each authorized information system process, role, and/or user in the audit and accountability policy.","CCI-001345":"The organization employs automated mechanisms to alert security personnel of any organization-defined inappropriate or unusual activities with security implications.","CCI-001346":"The organization defines a list of inappropriate or unusual activities with security implications that are to result in alerts to security personnel.","CCI-001347":"The organization performs, in a physically dedicated information system, full-text analysis of privileged functions executed.","CCI-001348":"Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component than the system or component being audited.","CCI-001349":"Defines a frequency for storing audit records in a repository that is part of a physically different system or system component than the system or component being audited.","CCI-001350":"Implement cryptographic mechanisms to protect the integrity of audit information.","CCI-001351":"Authorize access to management of audit logging functionality to only an organization-defined subset of privileged users or roles.","CCI-001352":"The organization protects the audit records of non-local accesses to privileged accounts and the execution of privileged functions.","CCI-001353":"Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.","CCI-001354":"The organization manages information system accounts by deactivating temporary accounts that are no longer required.","CCI-001355":"The organization manages information system accounts by deactivating accounts of terminated or transferred users.","CCI-001356":"The organization monitors for atypical usage of information system accounts.","CCI-001357":"The organization reports atypical usage to designated organizational officials.","CCI-001358":"Establish privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.","CCI-001359":"The organization tracks privileged role assignments.","CCI-001360":"Monitor privileged role assignments.","CCI-001361":"Defines a time period after which temporary accounts are automatically terminated.","CCI-001362":"The information system enforces a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.","CCI-001363":"The organization establishes a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.","CCI-001365":"Defines a time period after which emergency accounts are automatically terminated.","CCI-001366":"The organization defines user information to be encrypted or stored off-line in a secure location.","CCI-001367":"The organization defines system information to be encrypted or stored off-line in a secure location.","CCI-001368":"Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.","CCI-001371":"Defines security or privacy policy filters requiring fully enumerated formats which are to be implemented when transferring information between different security domains.","CCI-001372":"When transferring information between different security domains, implement organization-defined security or privacy policy filters requiring fully enumerated formats that restrict data structure and content.","CCI-001373":"When transferring information between different security domains, examine the information for the presence of organization-defined unsanctioned information.","CCI-001374":"When transferring information between different security domains, prohibit the transfer of such information in accordance with the organization-defined security or privacy policy.","CCI-001376":"The information system uniquely identifies source domains for information transfer.","CCI-001377":"The information system uniquely authenticates source domains for information transfer.","CCI-001380":"The organization documents separation of duties of individuals.","CCI-001382":"The organization defines the number of consecutive, unsuccessful login attempts to the mobile device.","CCI-001383":"The information system provides additional protection for mobile devices accessed via login by purging information from the device after an organization-defined number of consecutive, unsuccessful login attempts to the mobile device.","CCI-001384":"For publicly accessible systems, display system use information with organization-defined conditions before granting further access to the publicly accessible system.","CCI-001385":"For publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities.","CCI-001386":"For publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities.","CCI-001387":"For publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.","CCI-001388":"For publicly accessible systems, includes a description of the authorized uses of the system.","CCI-001389":"Defines the time period that the system notifies the user of the number of successful logon/access attempts.","CCI-001390":"Defines the time period that the system notifies the user of the number of unsuccessful logon/access attempts.","CCI-001391":"Notify the user, upon successful logon, of the number of successful logons/accesses during the organization-defined time period.","CCI-001392":"Notify the user, upon successful logon, of the number of unsuccessful logon/access attempts during the organization-defined time period.","CCI-001393":"Defines the security-related characteristics/parameters of the user's account which, when changed, will result in a notification being provided to the user during the organization-defined time period.","CCI-001394":"Defines the time period during which organization-defined security-related changes to the user's account are to be tracked.","CCI-001395":"Notify the user, upon successful logon, of changes to organization-defined security-related characteristics/parameters of the user's account during the organization-defined time-period.","CCI-001396":"The organization defines security attributes for which the information system supports and maintains the bindings for information in storage.","CCI-001397":"The organization defines security attributes for which the information system supports and maintains the bindings for information in process.","CCI-001398":"The organization defines security attributes for which the information system supports and maintains the bindings for information in transmission.","CCI-001399":"The information system supports and maintains the binding of organization-defined security attributes to information in storage.","CCI-001400":"The information system supports and maintains the binding of organization-defined security attributes to information in process.","CCI-001401":"The information system supports and maintains the binding of organization-defined security attributes to information in transmission.","CCI-001402":"The organization monitors for unauthorized remote access to the information system.","CCI-001403":"Automatically audit account modification actions.","CCI-001404":"Automatically audit account disabling actions.","CCI-001405":"Automatically audit account removal actions.","CCI-001406":"Defines a time period of expected inactivity when users are required to log out.","CCI-001407":"Administer privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.","CCI-001408":"Defines privileged commands for which dual authorization is to be enforced.","CCI-001409":"The organization defines nondiscretionary access control policies to be enforced over the organization-defined set of users and resources, where the rule set for each policy specifies access control information employed by the policy rule set (e.g., position, nationality, age, project, time of day) and required relationships among the access control information to permit access.","CCI-001410":"The organization defines the set of users and resources over which the information system is to enforce nondiscretionary access control policies.","CCI-001411":"Defines security-relevant information to which the system prevents access except during secure, non-operable system states.","CCI-001412":"The organization encrypts or stores off-line, in a secure location, organization-defined user information.","CCI-001413":"The organization encrypts or stores off-line, in a secure location, organization-defined system information.","CCI-001414":"Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.","CCI-001415":"Defines limitations for the embedding of data types within other data types.","CCI-001416":"The organization defines one-way information flows to be enforced by the information system.","CCI-001417":"Defines security policy filters to be enforced and used as a basis for flow control decisions.","CCI-001418":"The organization defines security policy filters for which the information system enforces the use of human review.","CCI-001419":"Defines the security functions or security-relevant information to which users of system accounts, or roles, have access.","CCI-001420":"Defines the privileged commands to which network access is to be authorized only for organization-defined compelling operational needs.","CCI-001421":"The organization limits authorization to super user accounts on the information system to designated system administration personnel.","CCI-001422":"Prohibit privileged access to the system by non-organizational users.","CCI-001423":"Defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts occur.","CCI-001424":"Dynamically associate security attributes with organization-defined subjects in accordance with organization-defined security policies as information is created and combined.","CCI-001425":"Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes.","CCI-001426":"The information system maintains the binding of security attributes to information with sufficient assurance that the information--attribute association can be used as the basis for automated policy actions.","CCI-001427":"The information system allows authorized users to associate security attributes with information.","CCI-001428":"Display security attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.","CCI-001429":"Identify special dissemination, handling, or distribution instructions for identifying security attributes on output.","CCI-001430":"Identify human-readable, standard naming conventions for identifying security attributes on output.","CCI-001431":"The organization defines a frequency for monitoring for unauthorized remote connections to the information system.","CCI-001432":"The organization takes appropriate action if an unauthorized remote connection to the information system is discovered.","CCI-001433":"The organization defines a list of security functions and security-relevant information that for remote access sessions have organization-defined security measures employed and are audited.","CCI-001434":"The organization defines additional security measures to be employed when an organization-defined list of security functions and security-relevant information is accessed remotely.","CCI-001435":"The organization defines networking protocols within the information system deemed to be nonsecure.","CCI-001436":"The organization disables organization-defined networking protocols within the information system deemed to be nonsecure except for explicitly identified components in support of specific operational requirements.","CCI-001437":"The organization documents the rationale for the execution of privileged commands and access to security-relevant information in the security plan for the information system.","CCI-001438":"The organization establishes usage restrictions for wireless access.","CCI-001439":"Establish implementation guidance for wireless access.","CCI-001440":"The organization monitors for unauthorized wireless access to the information system.","CCI-001441":"Authorize each type of wireless access to the system prior to allowing such connections.","CCI-001442":"The organization enforces requirements for wireless connections to the information system.","CCI-001443":"Protect wireless access to the system using authentication of users and/or devices.","CCI-001444":"Protect wireless access to the system using encryption.","CCI-001445":"The organization monitors for unauthorized wireless connections to the information system on an organization-defined frequency.","CCI-001446":"The organization scans for unauthorized wireless access points on an organization-defined frequency.","CCI-001447":"The organization defines a frequency of monitoring for unauthorized wireless connections to information system, including scans for unauthorized wireless access points.","CCI-001448":"The organization takes appropriate action if an unauthorized wireless connection is discovered.","CCI-001449":"Disable, when not intended for use, wireless networking capabilities internally embedded within system components prior to issuance and deployment.","CCI-001450":"The organization does not allow users to independently configure wireless networking capabilities.","CCI-001451":"Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.","CCI-001452":"The information system enforces the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted.","CCI-001453":"Implement cryptographic mechanisms to protect the integrity of remote access sessions.","CCI-001454":"The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information are audited.","CCI-001455":"The organization explicitly identifies components needed in support of specific operational requirements.","CCI-001456":"The organization defines locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.","CCI-001457":"The organization defines inspection and preventative measures to be applied on mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.","CCI-001458":"If classified information is found on mobile devices, the incident handling policy is to be followed.","CCI-001459":"Defines system components that provide audit record generation capability.","CCI-001460":"Monitor organization-defined open source information and/or information sites per organization-defined frequency for evidence of unauthorized disclosure of organizational information.","CCI-001461":"Defines a frequency for monitoring open source information and/or information sites for evidence of unauthorized exfiltration or disclosure of organizational information.","CCI-001462":"The information system provides the capability for authorized users to capture/record and log content related to a user session.","CCI-001463":"The information system provides the capability to remotely view/hear all content related to an established user session in real time.","CCI-001464":"Initiates session audits automatically at system start-up.","CCI-001465":"The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to store organization-controlled information using the external information systems.","CCI-001466":"The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to transmit organization-controlled information using the external information systems.","CCI-001467":"The organization prohibits authorized individuals from using an external information system to process organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.","CCI-001468":"The organization prohibits authorized individuals from using an external information system to store organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.","CCI-001469":"The organization prohibits authorized individuals from using an external information system to transmit organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.","CCI-001470":"Defines information sharing circumstances where user discretion is required.","CCI-001471":"Employ organization-defined automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.","CCI-001472":"Defines the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.","CCI-001473":"Designate individuals authorized to post information onto a publicly accessible system.","CCI-001474":"Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information.","CCI-001475":"Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included.","CCI-001476":"Review the content on the publicly accessible system for nonpublic information on an organization-defined frequency.","CCI-001477":"Defines a frequency for reviewing the content on the publicly accessible system for nonpublic information.","CCI-001478":"Remove nonpublic information from the publicly accessible system, if discovered.","CCI-001479":"The organization provides refresher security awareness training to all information system users (including managers, senior executives, and contractors) in accordance with the organization-defined frequency.","CCI-001480":"The organization defines the frequency for providing refresher security awareness training to all information system users (including managers, senior executives, and contractors).","CCI-001481":"Provide organization-defined personnel or roles with initial training in the employment and operation of environmental controls.","CCI-001482":"Provide organization-defined personnel or roles with refresher training in the employment and operation of environmental controls in accordance with the organization-defined frequency.","CCI-001483":"Defines a frequency for providing employees with refresher training in the employment and operation of environmental controls.","CCI-001484":"Defines the frequency of (or situation requiring) logging for each identified event.","CCI-001485":"Defines the event types for logging within the system.","CCI-001486":"The organization defines a frequency for reviewing and updating the list of organization-defined auditable events.","CCI-001487":"Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.","CCI-001488":"Defines the additional information to be included in the audit records.","CCI-001489":"The organization defines information system components for which generated audit records are centrally managed by the organization.","CCI-001490":"Defines the actions to be taken by the system upon audit failure, including shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.","CCI-001491":"Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.","CCI-001492":"The organization defines an authoritative time source for the synchronization of internal information system clocks.","CCI-001493":"Protect audit tools from unauthorized access.","CCI-001494":"Protect audit tools from unauthorized modification.","CCI-001495":"Protect audit tools from unauthorized deletion.","CCI-001496":"Implement cryptographic mechanisms to protect the integrity of audit tools.","CCI-001497":"Defines a frequency for the review and update to the baseline configuration of the system.","CCI-001498":"Defines a time period after which proposed changes to the system that have not been approved or disapproved are highlighted.","CCI-001499":"Limit privileges to change software resident within software libraries.","CCI-001500":"The information system automatically implements organization-defined safeguards and countermeasures if security functions (or mechanisms) are changed inappropriately.","CCI-001501":"The organization defines safeguards and countermeasures to be employed by the information system if security functions (or mechanisms) are changed inappropriately.","CCI-001502":"The organization monitors changes to the configuration settings in accordance with organizational policies and procedures.","CCI-001503":"The organization controls changes to the configuration settings in accordance with organizational policies and procedures.","CCI-001504":"Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-001505":"Disseminate an organization-level; mission/business process-level; and/or system-level personnel security policy to organization-defined personnel or roles.","CCI-001506":"Review and update the current personnel security policy in accordance with organization-defined frequency.","CCI-001507":"Defines the frequency with which to review and update the current personnel security policy.","CCI-001508":"Defines the frequency with which to review and update the current personnel security procedures.","CCI-001509":"Develop and document procedures to facilitate the implementation of the personnel security policy and associated personnel security controls.","CCI-001510":"Disseminate personnel security procedures to organization-defined personnel or roles.","CCI-001511":"Review and update the current personnel security procedures in accordance with organization-defined frequency.","CCI-001512":"Assign a risk designation to all organizational positions.","CCI-001513":"Establish screening criteria for individuals filling organizational positions.","CCI-001514":"Review and update position risk designations in accordance with organization-defined frequency.","CCI-001515":"Defines the frequency with which to review and update position risk designations.","CCI-001516":"Screen individuals prior to authorizing access to the system.","CCI-001517":"Rescreen individuals with authorized access to the system in accordance with organization-defined conditions requiring rescreening, and where rescreening is so indicated, on the organization-defined frequency of rescreening.","CCI-001518":"Defines the conditions requiring rescreening of individuals with authorized access to the system.","CCI-001519":"Defines the frequency for rescreening individuals with authorized access to the information system when organization-defined conditions requiring rescreening are met.","CCI-001520":"Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.","CCI-001521":"Verify that individuals accessing a system processing, storing, or transmitting types of classified information which require formal indoctrination, are formally indoctrinated for all of the relevant types of information to which they have access on the system.","CCI-001522":"Upon termination of individual employment, disable system access within an organization-defined time period.","CCI-001523":"Upon termination of individual employment, conduct exit interviews that include a discussion of organization-defined information security topics.","CCI-001524":"Upon termination of individual employment, retrieve all security-related organizational system-related property.","CCI-001525":"Upon termination of individual employment, retain access to organizational information formerly controlled by the terminated individual.","CCI-001526":"Upon termination of individual employment, retain access to organizational systems formerly controlled by the terminated individual.","CCI-001527":"Review and confirm the ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization.","CCI-001528":"Initiate organization-defined transfer or reassignment actions within an organization-defined time period following the formal personnel transfer action.","CCI-001529":"Defines transfer or reassignment actions to initiate within an organization-defined time period following the formal personnel transfer action.","CCI-001530":"Defines the time period within which the organization initiates organization-defined transfer or reassignment actions following the formal personnel transfer action.","CCI-001531":"The organization ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access.","CCI-001532":"Review and update the access agreements for organizational systems in accordance with organization-defined frequency.","CCI-001533":"Defines the frequency with which to review and update access agreements for organizational systems.","CCI-001534":"The organization ensures that access to information with special protection measures is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.","CCI-001535":"The organization ensures that access to information with special protection measures is granted only to individuals who satisfy associated personnel security criteria.","CCI-001536":"Verify that access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.","CCI-001537":"Verify that access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria.","CCI-001538":"Verify that access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a nondisclosure agreement.","CCI-001539":"Establish personnel security requirements including security roles and responsibilities for external providers.","CCI-001540":"Document personnel security requirements.","CCI-001541":"Monitor provider compliance with personnel security requirements.","CCI-001542":"The organization employs a formal sanctions process for individuals failing to comply with established information security policies and procedures.","CCI-001543":"The organization disseminates the most recent information security program plan to appropriate entities in the organization that includes roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-001544":"Manage system authenticators by ensuring that authenticators have sufficient strength of mechanism for their intended use.","CCI-001545":"Defines a frequency for reviewing and updating the access control policy.","CCI-001546":"Defines a frequency for reviewing and updating the access control procedures.","CCI-001547":"Defines the frequency on which it will review information system accounts for compliance with account management requirements.","CCI-001548":"Defines the information flow control policies for controlling the flow of information within the system.","CCI-001549":"Defines the information flow control policies for controlling the flow of information between interconnected systems.","CCI-001550":"The organization defines approved authorizations for controlling the flow of information within the system.","CCI-001551":"The organization defines approved authorizations for controlling the flow of information between interconnected systems.","CCI-001552":"The organization defines policy that allows or disallows information flows based on changing conditions or operational considerations.","CCI-001553":"Defines security or privacy policy filters that privileged administrators have the capability to enable and disable.","CCI-001554":"Defines the security or privacy policy filters that privileged administrators have the capability to configure.","CCI-001555":"The information system uniquely identifies destination domains for information transfer.","CCI-001556":"The information system uniquely authenticates destination domains for information transfer.","CCI-001557":"The information system tracks problems associated with the information transfer.","CCI-001558":"Defines the security functions (deployed in hardware, software, and firmware) for which access must be authorized.","CCI-001559":"The organization identifies the individuals authorized to change the value of associated security attributes.","CCI-001560":"The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined objects.","CCI-001561":"The organization defines managed access control points for remote access to the information system.","CCI-001562":"The organization defines the appropriate action(s) to be taken if an unauthorized remote connection is discovered.","CCI-001563":"The organization defines the appropriate action(s) to be taken if an unauthorized wireless connection is discovered.","CCI-001564":"Defines the frequency of security awareness and training policy reviews and updates.","CCI-001565":"Defines the frequency of security awareness and training procedure reviews and updates.","CCI-001566":"Provide organization-defined personnel or roles with initial training in the employment and operation of physical security controls.","CCI-001567":"Provide organization-defined personnel or roles with refresher training, thereafter, in the employment and operation of physical security controls in accordance with the organization-defined frequency.","CCI-001568":"Defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.","CCI-001569":"Defines the frequency on which the current audit and accountability policy will be reviewed and updated.","CCI-001570":"Defines the frequency on which the current audit and accountability procedures will be reviewed and updated.","CCI-001571":"Defines the event types that the system is capable of logging in support of the audit function.","CCI-001572":"Defines the personnel or roles to be alerted in the event of an audit logging process failure.","CCI-001573":"Defines whether to reject or delay network traffic that exceeds organization-defined thresholds.","CCI-001574":"The information system rejects or delays, as defined by the organization, network traffic which exceed the organization-defined thresholds.","CCI-001575":"The organization defines the system or system component for storing audit records that is a different system or system component than the system or component being audited.","CCI-001576":"The information system produces a system-wide (logical or physical) audit trail of information system audit records.","CCI-001577":"Defines the system components from which audit records are to be compiled into the system-wide audit trail.","CCI-001578":"Defines the frequency to review and update the current assessment, authorization, and monitoring procedures.","CCI-001579":"The organization conducts security control assessments using organization-defined forms of testing in accordance with organization-defined frequency and assessment techniques.","CCI-001580":"The organization identifies connections to external information systems (i.e., information systems outside of the authorization boundary).","CCI-001581":"The organization defines personnel or roles to whom the security status of the organization and the information system should be reported.","CCI-001582":"Defines other forms of control assessments other than in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment that should be included as part of the control assessments.","CCI-001583":"The organization selects announced or unannounced assessments for each form of security control assessment.","CCI-001584":"Defines the frequency with which to review and update configuration management procedures.","CCI-001585":"Defines the circumstances that require reviews and updates to the baseline configuration of the system.","CCI-001586":"Defines the configuration change control element responsible for coordinating and providing oversight for configuration change control activities.","CCI-001587":"The organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.","CCI-001588":"The organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements.","CCI-001589":"The organization incorporates detection of unauthorized, security-relevant configuration changes into the organization's incident response capability to ensure they are tracked.","CCI-001590":"The organization develops a list of software programs authorized to execute on the information system.","CCI-001591":"The organization develops a list of software programs not authorized to execute on the information system.","CCI-001592":"Defines the rules authorizing the terms and conditions of software program usage on the system.","CCI-001593":"The organization maintains a list of software programs authorized to execute on the information system.","CCI-001594":"The organization maintains a list of software programs not authorized to execute on the information system.","CCI-001595":"The organization maintains rules authorizing the terms and conditions of software program usage on the information system.","CCI-001596":"Defines the frequency with which to review and update the current contingency planning procedures.","CCI-001597":"Disseminate contingency planning procedures to organization-defined personnel or roles.","CCI-001598":"Review and update the current contingency planning procedures in accordance with the organization-defined frequency.","CCI-001599":"Sustain operational continuity of essential missions until full system restoration at primary processing and/or storage sites.","CCI-001600":"Sustains operational continuity of essential business functions until full system restoration at primary processing and/or storage sites.","CCI-001601":"Sustain operational continuity of essential mission functions at alternate processing and/or storage sites until system restoration to primary processing and/or storage sites.","CCI-001602":"Sustain operational continuity of essential business functions at alternate processing and/or storage sites until system restoration at primary processing and/or storage sites.","CCI-001603":"The contingency plan identifies the primary storage site hazards.","CCI-001604":"Outline explicit mitigation actions for potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.","CCI-001605":"The contingency plan identifies the primary processing site hazards.","CCI-001606":"Identify potential accessibility problems to outline explicit mitigation actions.","CCI-001607":"The organization establishes alternate telecommunications services to support the information system.","CCI-001608":"The organization identifies the primary provider's telecommunications service hazards.","CCI-001609":"Activate the redundant secondary system that is not collocated with the primary system without loss of information or disruption to operations.","CCI-001610":"Defines the time-period (by authenticator type) for changing/refreshing authenticators.","CCI-001611":"The organization defines the minimum number of special characters for password complexity enforcement.","CCI-001612":"The organization defines the minimum number of upper case characters for password complexity enforcement.","CCI-001613":"The organization defines the minimum number of lower case characters for password complexity enforcement.","CCI-001614":"The organization defines the minimum number of numeric characters for password complexity enforcement.","CCI-001615":"The organization defines the minimum number of characters that are changed when new passwords are created.","CCI-001616":"The organization defines minimum password lifetime restrictions.","CCI-001617":"The organization defines maximum password lifetime restrictions.","CCI-001618":"The organization defines the number of generations for which password reuse is prohibited.","CCI-001619":"The information system enforces password complexity by the minimum number of special characters used.","CCI-001620":"The organization defines the types of and/or specific authenticators for which the registration process must be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).","CCI-001621":"Implement organization-defined security controls to manage the risk of compromise due to individuals having accounts on multiple systems.","CCI-001622":"The organization identifies personnel with incident response roles and responsibilities with respect to the information system.","CCI-001623":"The incident response training material addresses the procedures and activities necessary to fulfill identified organizational incident response roles and responsibilities.","CCI-001624":"The organization documents the results of incident response tests.","CCI-001625":"Implement the resulting incident handling activity changes to incident response procedures, training, and testing accordingly.","CCI-001626":"The organization employs automated mechanisms to assist in the collection of security incident information.","CCI-001627":"The organization employs automated mechanisms to assist in the analysis of security incident information.","CCI-001628":"Defines a frequency with which to review and update the current maintenance procedures.","CCI-001629":"The organization employs automated mechanisms to produce up-to-date, accurate, complete, and available records of all maintenance and repair actions needed, in process, and complete.","CCI-001630":"Designated organizational personnel review the maintenance records of the non-local maintenance and diagnostic sessions.","CCI-001631":"After the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.","CCI-001632":"Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by either physically separated communications paths or logically separated communications paths based upon encryption.","CCI-001633":"The organization defines removable media types and information output requiring marking.","CCI-001634":"The organization identifies authorized personnel with appropriate clearances and access authorizations for gaining physical access to the facility containing an information system that processes classified information.","CCI-001635":"Remove individuals from the facility access list when access is no longer required.","CCI-001636":"Defines the frequency with which to review and update the current planning policy.","CCI-001637":"Review and update the current planning policy in accordance with organization-defined frequency.","CCI-001638":"Defines the frequency with which to review and update the current planning procedures.","CCI-001639":"The organization makes readily available to individuals requiring access to the information system the rules that describe their responsibilities and expected behavior with regard to information and information system usage.","CCI-001640":"Address information security issues in the updating of a critical infrastructure and key resources protection plan.","CCI-001641":"Defines the process for conducting random vulnerability scans on the system and hosted applications.","CCI-001642":"Defines the organizational document in which risk assessment results are documented (e.g., security plan, privacy plan; risk assessment report).","CCI-001643":"Monitor and scan for vulnerabilities in the system and hosted applications in accordance with the organization-defined process for random scans.","CCI-001644":"The organization employs vulnerability scanning procedures that can demonstrate the depth of coverage (i.e., vulnerabilities checked).","CCI-001645":"The organization identifies the information system components to which privileged access is authorized for selected organization-defined vulnerability scanning activities.","CCI-001646":"Defines the frequency with which to review and update the current system and services acquisition procedures.","CCI-001647":"The organization requires the use of a FIPS-validated, cryptographic module for a technology product that relies on cryptographic functionality to enforce its security policy when no U.S. Government Protection Profile exists for such a specific technology type.","CCI-001648":"The organization makes available to authorized personnel the source code for the information system to permit analysis and testing.","CCI-001649":"The organization identifies and documents (as appropriate) explicit rules to be enforced when governing the installation of software by users.","CCI-001650":"The organization requires the information system developers to manage and control changes to the information system during development.","CCI-001651":"The organization requires the information system integrators to manage and control changes to the information system during development.","CCI-001652":"The organization requires the information system developers to manage and control changes to the information system during implementation.","CCI-001653":"The organization requires the information system integrators to manage and control changes to the information system during implementation.","CCI-001654":"The organization requires the information system developers to manage and control changes to the information system during modification.","CCI-001655":"The organization requires the information system integrators to manage and control changes to the information system during modification.","CCI-001656":"The organization defines the security functions of the information system to be isolated from nonsecurity functions.","CCI-001657":"The organization defines the external boundary of the information system.","CCI-001658":"The organization defines key internal boundaries of the information system.","CCI-001659":"The organization defines the mediation necessary for public access to the organization's internal networks.","CCI-001660":"The organization defines the measures to protect against unauthorized physical connections across boundary protections implemented at organization-defined managed interfaces.","CCI-001661":"Defines the security functions, to at a minimum, include system authentication and re-authentication, for permitting users to invoke the trusted communications path.","CCI-001662":"Take organization-defined corrective action when organization-defined unacceptable mobile code is identified.","CCI-001663":"The information system, when operating as part of a distributed, hierarchical namespace, provides the means to enable verification of a chain of trust among parent and child domains (if the child supports secure resolution services).","CCI-001664":"Recognize only session identifiers that are system-generated.","CCI-001665":"Preserve organization-defined system state information in the event of a system failure.","CCI-001666":"The organization employs cryptographic mechanisms to prevent unauthorized modification of information at rest unless otherwise protected by alternative physical measures.","CCI-001667":"The organization compares the time measured between flaw identification and flaw remediation with organization-defined benchmarks.","CCI-001668":"The organization employs malicious code protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.","CCI-001669":"Defines the frequency of testing malicious code protection mechanisms.","CCI-001670":"Take organization-defined least-disruptive actions to terminate suspicious events.","CCI-001671":"Analyze outbound communications traffic at selected organization-defined interior points within the system to discover anomalies.","CCI-001672":"The organization employs a wireless intrusion detection system to identify rogue wireless devices.","CCI-001673":"Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.","CCI-001674":"The information system responds to security function anomalies in accordance with organization-defined responses and alternative action(s).","CCI-001675":"Defines the personnel or roles that are to receive reports on the results of security function verification.","CCI-001676":"The organization defines, for periodic security function verification, the frequency of the verifications.","CCI-001677":"The organization employs spam protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.","CCI-001678":"Retain information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.","CCI-001679":"The organization provides a mechanism to exchange active and standby roles of the components.","CCI-001680":"Develop an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-001681":"The organization defines the frequency at which each form of security control assessment should be conducted.","CCI-001682":"Automatically remove or disable emergency accounts after an organization-defined time period for each type of account.","CCI-001683":"The information system notifies organization-defined personnel or roles for account creation actions.","CCI-001684":"The information system notifies organization-defined personnel or roles for account modification actions.","CCI-001685":"The information system notifies organization-defined personnel or roles for account disabling actions.","CCI-001686":"The information system notifies organization-defined personnel or roles for account removal actions.","CCI-001687":"Verify that the use of mobile code deployed in system meets organization-defined mobile code requirements.","CCI-001688":"Verify the acquisition of mobile code deployed in the system meets organization-defined mobile code requirements.","CCI-001689":"The organization, if an information system component failure is detected, automatically shuts down the information system.","CCI-001690":"The organization protects, as required, vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system.","CCI-001691":"The organization makes available to authorized personnel vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.","CCI-001692":"The organization makes available to authorized personnel vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.","CCI-001693":"The information system enforces a Discretionary Access Control (DAC) policy that limits propagation of access rights.","CCI-001694":"The information system enforces a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.","CCI-001695":"Prevent the execution of organization-defined unacceptable mobile code.","CCI-001726":"Use software in accordance with contract agreements.","CCI-001727":"Use software documentation in accordance with contract agreements.","CCI-001728":"Use software in accordance with copyright laws.","CCI-001729":"Use software documentation in accordance with copyright laws.","CCI-001730":"Track the use of software protected by quantity licenses to control copying of the software.","CCI-001731":"Track the use of software documentation protected by quantity licenses to control distribution of the software documentation.","CCI-001732":"Control the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.","CCI-001733":"Document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.","CCI-001734":"Defines the restrictions to be followed on the use of open source software.","CCI-001735":"Establish organization-defined restrictions on the use of open source software.","CCI-001736":"Defines the number of previous versions of the baseline configuration of the system required to support rollback.","CCI-001737":"Defines the systems or system components that are to have organization-defined configurations applied when located in areas of significant risk.","CCI-001738":"Defines the configurations to be implemented on systems and system components when they are located in areas of significant risk.","CCI-001739":"Issue organization-defined systems or system components with organization-defined configurations to individuals traveling to locations the organization deems to be of significant risk.","CCI-001740":"Review proposed configuration-controlled changes to the system.","CCI-001741":"Document configuration change decisions associated with the system.","CCI-001742":"Defines the approval authorities to be notified when proposed changes to the system are received.","CCI-001743":"Defines the security responses to be automatically implemented if baseline configurations are changed in an unauthorized manner.","CCI-001744":"Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.","CCI-001745":"Defines the controls that are to be provided by the cryptographic mechanisms are under configuration management.","CCI-001746":"Ensure that cryptographic mechanisms used to provide organization-defined control are under configuration management.","CCI-001747":"The organization defines critical software components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.","CCI-001748":"The organization defines critical firmware components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.","CCI-001749":"The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.","CCI-001750":"The information system prevents the installation of organization-defined firmware components without verification the firmware component has been digitally signed using a certificate that is recognized and approved by the organization.","CCI-001751":"Defines system-level information requiring enforcement of a dual authorization for system changes.","CCI-001752":"Enforce dual authorization for implementing changes to organization-defined system-level information.","CCI-001753":"Limit privileges to change system components within a production or operational environment.","CCI-001754":"Limit privileges to change system-related information within a production or operational environment.","CCI-001755":"Defines the system components for which any deviation from the established configuration settings are to be identified, documented, and approved.","CCI-001756":"Defines the operational requirements on which the configuration settings for the organization-defined system components are to be based.","CCI-001757":"Defines the actions to employ when responding to unauthorized changes to the organization-defined configuration settings.","CCI-001758":"Defines the configuration settings for which to employ organization-defined actions in response to unauthorized changes.","CCI-001759":"Take organization-defined actions in response to unauthorized changes to organization-defined configuration settings.","CCI-001760":"Defines the frequency of system reviews to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services.","CCI-001761":"Defines the functions, ports, protocols, software, and services within the information system that are to be disabled or removed when deemed unnecessary and/or nonsecure.","CCI-001762":"Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.","CCI-001763":"Defines the policies regarding software program usage and restrictions.","CCI-001764":"Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.","CCI-001765":"Defines the software programs not authorized to execute on the system.","CCI-001766":"Identify the organization-defined software programs not authorized to execute on the system.","CCI-001767":"Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system.","CCI-001768":"Defines the frequency on which the list of unauthorized software programs will be reviewed and updated.","CCI-001769":"The organization defines the frequency on which it will update the list of unauthorized software programs.","CCI-001770":"Review and update the list of unauthorized software programs per organization-defined frequency.","CCI-001771":"The organization updates the list of unauthorized software programs per organization-defined frequency.","CCI-001772":"Defines the software programs authorized to execute on the system.","CCI-001773":"Identify the organization-defined software programs authorized to execute on the system.","CCI-001774":"Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.","CCI-001775":"Defines the frequency on which the list of authorized software programs will be reviewed and updated.","CCI-001776":"The organization defines the frequency on which it will update the list of authorized software programs.","CCI-001777":"Review and update the list of authorized software programs per organization-defined frequency.","CCI-001778":"The organization updates the list of authorized software programs per organization-defined frequency.","CCI-001779":"Defines the frequency on which the system component inventory is to be reviewed and updated.","CCI-001780":"Review and update the system component inventory per organization-defined frequency.","CCI-001781":"The organization defines the frequency on which the information system component inventory is to be updated.","CCI-001782":"The organization updates the information system component inventory per organization-defined frequency.","CCI-001783":"Defines the personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the system.","CCI-001784":"When unauthorized hardware, software, and firmware components are detected within the system, the organization takes action to disable network access by such components, isolates the components, and/or notifies organization-defined personnel or roles.","CCI-001785":"Provide a centralized repository for the inventory of system components.","CCI-001786":"Support the tracking of system components by geographic location using organization-defined automated mechanisms.","CCI-001787":"The organization defines the acquired information system components that are to be assigned to an information system.","CCI-001788":"Assign system components to a system.","CCI-001789":"Receive an acknowledgement from organization-defined personnel or roles of the acquired system components to a system.","CCI-001790":"The organization develops a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.","CCI-001791":"The organization documents a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.","CCI-001792":"Implement a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle.","CCI-001793":"The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.","CCI-001794":"The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.","CCI-001795":"Implement a configuration management plan for the system that establishes a process for managing the configuration of the configuration items.","CCI-001796":"The organization develops a configuration management plan for the information system that places the configuration items under configuration management.","CCI-001797":"The organization documents a configuration management plan for the information system that places the configuration items under configuration management.","CCI-001798":"Implement a configuration management plan for the system that places the configuration items under configuration management.","CCI-001799":"Develop and document a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification.","CCI-001800":"The organization documents a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification.","CCI-001801":"Implement a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification.","CCI-001802":"Track the use of software documentation protected by quantity licenses to control copying of the software documentation.","CCI-001803":"Track the use of software protected by quantity licenses to control distribution of the software.","CCI-001804":"Defines the policies for governing the installation of software by users.","CCI-001805":"Establish organization-defined policies governing the installation of software by users.","CCI-001806":"Defines methods to be employed to enforce the software installation policies.","CCI-001807":"Enforce software installation policies through organization-defined methods.","CCI-001808":"Defines the frequency on which it will monitor software installation policy compliance.","CCI-001809":"Monitor software installation policy compliance per an organization-defined frequency.","CCI-001810":"The organization defines the personnel or roles to be notified when unauthorized software is detected.","CCI-001811":"The information system alerts organization-defined personnel or roles when the unauthorized installation of software is detected.","CCI-001812":"The information system prohibits user installation of software without explicit privileged status.","CCI-001813":"Enforce access restrictions using organization-defined mechanisms.","CCI-001814":"The Information system supports auditing of the enforcement actions.","CCI-001815":"Defines the controls to be applied to devices when individuals return from areas of significant risk.","CCI-001816":"Apply organization-defined controls to the systems or components when the individuals return from travel.","CCI-001817":"When analyzing changes to the system, looks for privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.","CCI-001818":"Analyze changes to the system in a separate test environment before installation in an operational environment.","CCI-001819":"Implement approved configuration-controlled changes to the system.","CCI-001820":"The organization documents a configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-001821":"Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management policy is to be disseminated.","CCI-001822":"Disseminate the organization-level; mission/business process-level; and/or system-level configuration management policy to organization-defined personnel or roles.","CCI-001823":"The organization documents the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.","CCI-001824":"Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management procedures are to be disseminated.","CCI-001825":"Disseminate to organization-defined personnel or roles the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls.","CCI-001826":"The organization defines the circumstances upon which the organization reviews the information system changes to determine whether unauthorized changes have occurred.","CCI-001827":"The organization defines the frequency with which to review information system privileges.","CCI-001828":"The organization defines the frequency with which to reevaluate information system privileges.","CCI-001829":"The organization reviews information system privileges per an organization-defined frequency.","CCI-001830":"The organization reevaluates information system privileges per an organization-defined frequency.","CCI-001831":"The organization documents an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-001832":"Disseminate the organization-level; mission/business process-level; and/or system-level audit and accountability policy to organization-defined personnel or roles.","CCI-001833":"The organization documents procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.","CCI-001834":"Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.","CCI-001835":"The organization defines the frequency on which it will review the audit and accountability policy.","CCI-001836":"The organization defines the frequency on which it will update the audit and accountability policy.","CCI-001837":"The organization reviews the audit and accountability policy on an organization-defined frequency.","CCI-001838":"The organization updates the audit and accountability policy on an organization-defined frequency.","CCI-001839":"The organization defines the frequency on which it will review the audit and accountability procedures.","CCI-001840":"The organization defines the frequency on which it will update the audit and accountability procedures.","CCI-001841":"The organization reviews the audit and accountability procedures on an organization-defined frequency.","CCI-001842":"The organization updates the audit and accountability procedures on an organization-defined frequency.","CCI-001843":"The organization defines a frequency for updating the list of organization-defined auditable events.","CCI-001844":"The information system provides centralized management and configuration of the content to be captured in audit records generated by organization-defined information system components.","CCI-001845":"The information system provides centralized configuration of the content to be captured in audit records generated by organization-defined information system components.","CCI-001846":"The organization defines information system components that will generate the audit records which are to be captured for centralized management of the content.","CCI-001847":"The organization defines information system components that will generate the audit records which are to be captured for centralized configuration of the content.","CCI-001848":"Defines the audit log retention requirements for allocating audit log storage capacity.","CCI-001849":"Allocate audit log storage capacity to accommodate organization-defined audit log retention requirements.","CCI-001850":"Defines the frequency to off-load audit records onto a different system or media than the system being audited.","CCI-001851":"Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.","CCI-001852":"Defines the personnel, roles and/or locations to receive a warning when allocated audit log storage volume reaches a defined percentage of maximum audit log storage capacity.","CCI-001853":"Defines the time period within which organization-defined personnel, roles, and/or locations are to receive warnings when allocated audit log storage volume reaches an organization-defined percentage of maximum audit log storage capacity.","CCI-001854":"Defines the percentage of maximum audit log storage capacity that is to be reached, at which time the system will provide a warning to organization-defined personnel, roles, and/or locations.","CCI-001855":"Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.","CCI-001856":"Defines the real-time period in which to provide an alert when organization-defined audit failure events occur.","CCI-001857":"Defines the personnel, roles, and/or locations to receive alerts when organization-defined audit failure events occur.","CCI-001858":"Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.","CCI-001859":"Defines the network communication traffic volume thresholds reflecting limits on auditing capacity, specifying when the information system will reject or delay network traffic that exceed those thresholds.","CCI-001860":"Defines the audit logging failures which, should they occur, will invoke an organization-defined system mode.","CCI-001861":"Invoke a full system shutdown, partial system shutdown, or degraded operational mode with limited mission or business functionality available in the event of organization-defined audit logging failures, unless an alternate audit logging capability exists.","CCI-001862":"Defines the types of inappropriate or unusual activity to be reviewed and analyzed in the audit records.","CCI-001863":"Defines the personnel or roles to receive the reports of organization-defined inappropriate or unusual activity.","CCI-001864":"Integrate audit review and analysis using organization-defined automated mechanisms.","CCI-001865":"Integrate reporting processes using organization-defined automated mechanisms.","CCI-001866":"Defines the data/information to be collected from other sources to enhance its ability to identify inappropriate or unusual activity.","CCI-001867":"Integrate analysis of audit records with analysis of vulnerability scanning information, performance data, system monitoring information, and/or organization-defined data/information collected from other sources to further enhance the ability to identify inappropriate or unusual activity.","CCI-001868":"Specify the permitted actions for each information system process, role, and/or user associated with the review and analysis of audit information.","CCI-001869":"Specify the permitted actions for each information system process, role, and/or user associated with the reporting of audit information.","CCI-001870":"Perform a full-text analysis of logged privileged commands in a physically-distinct component or subsystem of the system, or other system that is dedicated to that analysis.","CCI-001871":"Correlate information from non-technical sources with audit record information to enhance organization-wide situational awareness.","CCI-001872":"The organization adjusts the level of audit review and analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.","CCI-001873":"The organization adjusts the level of audit analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.","CCI-001874":"The organization adjusts the level of audit reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.","CCI-001875":"Provide an audit reduction capability that supports on-demand audit review and analysis.","CCI-001876":"Provide an audit reduction capability that supports on-demand reporting requirements.","CCI-001877":"Provide an audit reduction capability that supports after-the-fact investigations of incidents.","CCI-001878":"Provide a report generation capability that supports on-demand audit review and analysis.","CCI-001879":"Provide a report generation capability that supports on-demand reporting requirements.","CCI-001880":"Provide a report generation capability that supports after-the-fact investigations of security incidents.","CCI-001881":"Provide an audit reduction capability that does not alter original content or time ordering of audit records.","CCI-001882":"Provide a report generation capability that does not alter original content or time ordering of audit records.","CCI-001883":"Defines the audit fields within audit records to be processed, sorted, and searched for events of interest by the system.","CCI-001884":"The organization defines the audit fields within audit records to be sorted for events of interest by the information system.","CCI-001885":"The organization defines the audit fields within audit records to be searched for events of interest by the information system.","CCI-001886":"The information system provides the capability to sort audit records for events of interest based on the content of organization-defined audit fields within audit records.","CCI-001887":"The information system provides the capability to search audit records for events of interest based on the content of organization-defined audit fields within audit records.","CCI-001888":"Defines the granularity of time measurement for time stamps generated for audit records.","CCI-001889":"Record time stamps for audit records that meet organization-defined granularity of time measurement.","CCI-001890":"Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.","CCI-001891":"The information system compares internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.","CCI-001892":"The organization defines the time difference which, when exceeded, will require the information system to synchronize the internal information system clocks to the organization-defined authoritative time source.","CCI-001893":"The information system identifies a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source.","CCI-001894":"Defines the subset of privileged users who will be authorized access to the management of audit functionality.","CCI-001895":"Defines the audit information requiring dual authorization for movement or deletion actions.","CCI-001896":"Enforce dual authorization for movement and/or deletion of organization-defined audit information.","CCI-001897":"Defines the subset of privileged users or roles who will be authorized read-only access to audit information.","CCI-001898":"Authorize read-only access to audit information to an organization-defined subset of privileged users or roles.","CCI-001899":"Defines the actions to be covered by non-repudiation.","CCI-001900":"Defines the strength of binding to be applied to the binding of the identity of the information producer with the information.","CCI-001901":"Bind the identity of the information producer with the information to an organization-defined strength of binding.","CCI-001902":"Provide the means for authorized individuals to determine the identity of the producer of the information.","CCI-001903":"Defines the frequency on which the system is to validate the binding of the information producer identity to the information.","CCI-001904":"Validate the binding of the information producer identity to the information at an organization-defined frequency.","CCI-001905":"Defines the actions to be performed in the event of an error when validating the binding of the information producer identity to the information.","CCI-001906":"Perform organization-defined actions in the event of an error when validating the binding of the information producer identity to the information.","CCI-001907":"Defines the security domains which will require the system validate the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer.","CCI-001908":"Defines the action the system is to perform in the event of an information reviewer identity binding validation error.","CCI-001909":"Perform organization-defined actions in the event of an information reviewer identity binding validation error.","CCI-001910":"Defines the personnel or roles allowed to select which event types are to be logged by specific components of the system.","CCI-001911":"Defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined system components, by organization-defined individuals or roles, within organization-defined time thresholds.","CCI-001912":"Defines the time thresholds for organization-defined individuals or roles to change the auditing to be performed based on organization-defined selectable event criteria.","CCI-001913":"Defines the individuals or roles that are to be provided the capability to change the auditing to be performed based on organization-defined selectable event criteria, within organization-defined time thresholds.","CCI-001914":"Provide the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.","CCI-001915":"Defines the open source information and/or information sites to be monitored for evidence of unauthorized exfiltration or disclosure of organizational information.","CCI-001916":"The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner.","CCI-001917":"Defines the frequency for reviewing the open source information sites being monitored.","CCI-001918":"Review the open source information sites being monitored per organization-defined frequency.","CCI-001919":"Provide the capability for organization-defined users or roles to select a user session to record; view; hear; or log the content of a user session under organization-defined circumstances.","CCI-001920":"Provide the capability for authorized users to remotely view and hear content related to an established user session in real time.","CCI-001921":"The organization defines the alternative audit functionality to be provided in the event of a failure in the primary audit capability.","CCI-001922":"The organization provides an alternative audit capability in the event of a failure in primary audit capability that provides organization-defined alternative audit functionality.","CCI-001923":"Defines the audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries.","CCI-001924":"Defines the methods to be employed when coordinating audit information among external organizations when audit information is transmitted across organizational boundaries.","CCI-001925":"Employ organization-defined methods for coordinating organization-defined audit information among external organizations when audit information is transmitted across organizational boundaries.","CCI-001926":"Preserve the identity of individuals in cross-organizational audit trails.","CCI-001927":"Defines the organizations that will be provided cross-organizational audit information.","CCI-001928":"Defines the cross-organizational sharing agreements to be established with organization-defined organizations authorized to be provided cross-organizational sharing of audit information.","CCI-001929":"Provide cross-organizational audit information to organization-defined organizations based on organization-defined cross organizational sharing agreements.","CCI-001930":"Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level audit and accountability policy is to be disseminated.","CCI-001931":"Defines the personnel or roles to whom the audit and accountability procedures are to be disseminated.","CCI-001932":"The organization documents an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-001933":"The organization defines the personnel or roles to be recipients of the identification and authentication policy and the procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.","CCI-001934":"The organization documents procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.","CCI-001935":"The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to privileged accounts.","CCI-001936":"The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.","CCI-001937":"The device used in the information system implementation of multifactor authentication for network access to privileged accounts meets organization-defined strength of mechanism requirements.","CCI-001938":"The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to non-privileged accounts.","CCI-001939":"The information system implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.","CCI-001940":"The device used in the information system implementation of multifactor authentication for network access to non-privileged accounts meets organization-defined strength of mechanism requirements.","CCI-001941":"Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.","CCI-001942":"The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.","CCI-001943":"Defines the system accounts for which single sign-on capability will be provided.","CCI-001944":"Defines the system services for which single sign-on capability will be provided.","CCI-001945":"Provide a single sign-on capability for organization-defined system accounts.","CCI-001946":"Provide a single sign-on capability for organization-defined system services.","CCI-001947":"The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to privileged accounts.","CCI-001948":"The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.","CCI-001949":"The device used in the information system implementation of multifactor authentication for remote access to privileged accounts meets organization-defined strength of mechanism requirements.","CCI-001950":"The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to non-privileged accounts.","CCI-001951":"The information system implements multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.","CCI-001952":"The device used in the information system implementation of multifactor authentication for remote access to non-privileged accounts meets organization-defined strength of mechanism requirements.","CCI-001953":"Accept Personal Identity Verification-compliant credentials.","CCI-001954":"Electronically verify Personal Identity Verification-compliant credentials.","CCI-001955":"Defines the out-of-band authentication to be implemented under organization-defined conditions.","CCI-001956":"Defines the conditions for implementing organization-defined out-of-band authentication.","CCI-001957":"Implement organization-defined out-of-band authentication mechanisms under organization-defined conditions.","CCI-001958":"Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.","CCI-001959":"Defines the devices and/or types of devices the system is to authenticate before establishing a connection.","CCI-001960":"Defines the lease information to be assigned to devices.","CCI-001961":"Defines the lease duration to be assigned to devices.","CCI-001962":"Where addresses are allocated dynamically, standardize dynamic address allocation lease information assigned to devices in accordance with organization-defined lease information.","CCI-001963":"Where addresses are allocated dynamically, standardize dynamic address allocation lease duration assigned to devices in accordance with organization-defined lease duration.","CCI-001964":"The organization defines the configuration management process that is to handle the device identification procedures.","CCI-001965":"Defines the configuration management process that is to handle the device authentication procedures.","CCI-001966":"Handle device identification based on attestation is handled by the organization-defined configuration management process.","CCI-001967":"Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.","CCI-001968":"Defines the configuration management process that is to handle the device identification procedures.","CCI-001969":"Handle device authentication based on attestation is handled by the organization-defined configuration management process.","CCI-001970":"Defines the personnel or roles that authorize the assignment of individual, group, role, and device identifiers.","CCI-001971":"Manage system identifiers by receiving authorization from organization-defined personnel or roles to assign an individual, group, role, or device identifier.","CCI-001972":"Manage system identifiers by selecting an identifier that identifies an individual, group, role, or device.","CCI-001973":"Manage system identifiers by assigning the identifier to the intended individual, group, role, or device.","CCI-001974":"Defines the time period for which the reuse of identifiers is prohibited.","CCI-001975":"Manage system identifiers by preventing reuse of identifiers for an organization-defined time period.","CCI-001976":"Manage individual identifiers dynamically in accordance with organization-defined identifier policy.","CCI-001977":"Defines the external organizations with which it will coordinate for cross-management of identifiers.","CCI-001978":"Coordinate with organization-defined external organizations for cross-organization management of identifiers.","CCI-001979":"The organization requires the registration process to receive an individual identifier be conducted in person before a designated registration authority.","CCI-001980":"Manage system authenticators by verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator.","CCI-001981":"Manage system authenticators by establishing administrative procedures for initial authenticator distribution.","CCI-001982":"The organization manages information system authenticators by establishing administrative procedures for lost/compromised authenticators.","CCI-001983":"The organization manages information system authenticators by establishing administrative procedures for damaged authenticators.","CCI-001984":"Manage system authenticators by establishing administrative procedures for revoking authenticators.","CCI-001985":"Manage system authenticators by implementing administrative procedures for initial authenticator distribution.","CCI-001986":"The organization manages information system authenticators by implementing administrative procedures for lost/compromised authenticators.","CCI-001987":"The organization manages information system authenticators by implementing administrative procedures for damaged authenticators.","CCI-001988":"Manage system authenticators by implementing administrative procedures for revoking authenticators.","CCI-001989":"The organization manages information system authenticators by changing default content of authenticators prior to information system installation.","CCI-001990":"Manage system authenticators by changing authenticators for group or role accounts when membership to those accounts changes.","CCI-001991":"The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.","CCI-001992":"The organization defines the personnel or roles responsible for authorizing the organization's registration authority accountable for the authenticator registration process.","CCI-001993":"The organization defines the registration authority accountable for the authenticator registration process.","CCI-001994":"The organization defines the types of and/or specific authenticators that are subject to the authenticator registration process.","CCI-001995":"The organization requires that the registration process, to receive organization-defined types of and/or specific authenticators, be conducted in person, or by a trusted third-party, before an organization-defined registration authority with authorization by organization-defined personnel or roles.","CCI-001996":"The organization defines the requirements required by the automated tools to determine if password authenticators are sufficiently strong.","CCI-001997":"The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy organization-defined requirements.","CCI-001998":"Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.","CCI-001999":"The organization defines the external organizations to be coordinated with for cross-organization management of credentials.","CCI-002000":"The organization coordinates with organization-defined external organizations for cross-organization management of credentials.","CCI-002001":"Bind identities and authenticators dynamically using organization-defined binding rules.","CCI-002002":"The organization defines the token quality requirements to be employed by the information system mechanisms for token-based authentication.","CCI-002003":"The information system, for token-based authentication, employs mechanisms that satisfy organization-defined token quality requirements.","CCI-002004":"Defines the biometric quality requirements to be employed by the mechanisms for biometric-based authentication.","CCI-002005":"For biometric-based authentication, employ mechanisms that satisfy organization-defined biometric quality requirements.","CCI-002006":"Defines the time period after which the use of cached authenticators is prohibited.","CCI-002007":"Prohibit the use of cached authenticators after an organization-defined time period.","CCI-002008":"For PKI-based authentication, employs an organization-wide methodology for managing the content of PKI trust stores installed across all platforms including networks, operating systems, browsers, and applications.","CCI-002009":"Accept Personal Identity Verification-compliant credentials from other federal agencies.","CCI-002010":"Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.","CCI-002011":"The information system accepts FICAM-approved third-party credentials.","CCI-002012":"The organization defines the information systems which will employ only FICAM-approved information system components.","CCI-002013":"The organization employs only FICAM-approved information system components in organization-defined information systems to accept third-party credentials.","CCI-002014":"The information system conforms to FICAM-issued profiles.","CCI-002015":"Accept federated or PKI credentials that meet organization-defined policy.","CCI-002016":"Verify federated PKI credentials that meet organization-defined policy.","CCI-002017":"The organization defines the information system services requiring identification.","CCI-002018":"Defines the system services and applications requiring authentication.","CCI-002019":"The organization defines the security safeguards to be used when identifying information system services.","CCI-002020":"The organization defines the security safeguards to be used when authenticating information system services.","CCI-002021":"Uniquely identify organization-defined system services and applications before establishing communications with devices, users, or other services or applications.","CCI-002022":"Uniquely authenticate organization-defined system services and applications before establishing communications with devices, users, or other services or applications.","CCI-002023":"The organization ensures that service providers receive identification information.","CCI-002024":"The organization ensures that service providers validate identification information.","CCI-002025":"The organization ensures that service providers transmit identification information.","CCI-002026":"The organization ensures that service providers receive authentication information.","CCI-002027":"The organization ensures that service providers validate authentication information.","CCI-002028":"The organization ensures that service providers transmit authentication information.","CCI-002029":"The organization defines the services between which identification decisions are to be transmitted.","CCI-002030":"The organization defines the services between which authentication decisions are to be transmitted.","CCI-002031":"The organization ensures that identification decisions are transmitted between organization-defined services consistent with organizational policies.","CCI-002032":"The organization ensures that authentication decisions are transmitted between organization-defined services consistent with organizational policies.","CCI-002033":"Defines the specific circumstances or situations when individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms.","CCI-002034":"Defines the supplemental authentication techniques or mechanisms to be employed in specific organization-defined circumstances or situations by individuals accessing the system.","CCI-002035":"Require individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms under specific organization-defined circumstances or situations.","CCI-002036":"Defines the circumstances or situations under which users will be required to reauthenticate.","CCI-002037":"The organization defines the circumstances or situations under which devices will be required to reauthenticate.","CCI-002038":"The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.","CCI-002039":"The organization requires devices to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.","CCI-002040":"The organization requires that the registration process to receive an individual identifier includes supervisor authorization.","CCI-002041":"The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.","CCI-002042":"Manage system authenticators by protecting authenticator content from unauthorized modification.","CCI-002043":"The organization uses only FICAM-approved path discovery and validation products and services.","CCI-002044":"Defines measures to be employed to ensure that long-term audit records generated by the system can be retrieved.","CCI-002045":"Employ organization-defined measures to ensure that long-term audit records generated by the information system can be retrieved.","CCI-002046":"The information system synchronizes the internal system clocks to the authoritative time source when the time difference is greater than the organization-defined time period.","CCI-002047":"Defines the system components on which the auditing that is to be performed can be changed by organization-defined individuals or roles.","CCI-002048":"Defines the personnel or roles to whom the awareness and training policy is disseminated.","CCI-002049":"Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level awareness and training procedures are disseminated.","CCI-002050":"Defines the personnel or roles to whom initial and refresher training in the employment and operation of environmental controls is to be provided.","CCI-002051":"Defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.","CCI-002052":"Provide practical exercises in security training that reinforce training objectives.","CCI-002053":"The organization provides training to its personnel on organization-defined indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.","CCI-002054":"The organization defines indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.","CCI-002055":"Provide literacy training on recognizing and reporting potential indicators of insider threat.","CCI-002056":"Defines the time period the records of configuration-controlled changes are to be retained.","CCI-002057":"Defines the personnel to be notified when approved changes to the system are completed.","CCI-002058":"Employ automated mechanisms to notify organization-defined personnel when approved changes to the system are completed.","CCI-002059":"Defines the system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.","CCI-002060":"The organization develops and documents a security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-002061":"Defines the personnel or roles to whom the organization-level; mission/business process; system-level assessment, authorization, and monitoring policy is to be disseminated.","CCI-002062":"Defines the personnel or roles to whom the assessment, authorization, monitoring procedures are to be disseminated.","CCI-002063":"The organization defines the level of independence for assessors or assessment teams to conduct security control assessments of organizational information systems.","CCI-002064":"The organization selects one or more security assessment techniques to be conducted.","CCI-002065":"Defines the frequency at which to conduct control assessments.","CCI-002066":"Leverage the results of control assessments of the organization-defined system performed by an organization-defined external organization when the assessment meets organization-defined requirements.","CCI-002067":"Defines the system for which the results of control assessments will be leveraged.","CCI-002068":"Defines the external organizations from which control assessment results for organization-defined systems will be accepted.","CCI-002069":"Defines the requirements the control assessments for organization-defined systems from organization-defined external organizations must meet.","CCI-002070":"Develop a control assessment plan that describes the scope of the assessment including assessment team, and assessment roles and responsibilities.","CCI-002071":"Defines the individuals or roles to whom the results of the control assessment are to be provided.","CCI-002072":"The organization defines the unclassified, national security systems that are prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.","CCI-002073":"The organization defines the boundary protection device to be used to connect organization-defined unclassified, national security systems to an external network.","CCI-002074":"The organization defines the boundary protection device to be used for the direct connection of classified, national security system to an external network.","CCI-002075":"The organization prohibits the direct connection of an organization-defined unclassified, non-national security system to an external network without the use of organization-defined boundary protection device.","CCI-002076":"The organization defines the unclassified, non-national security system that is prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.","CCI-002077":"The organization defines the boundary protection device to be used to directly connect an organization-defined unclassified, non-national security system to an external network.","CCI-002078":"The organization prohibits the direct connection of an organization-defined information system to a public network.","CCI-002079":"The organization defines the information system that is prohibited from directly connecting to a public network.","CCI-002080":"The organization employs either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.","CCI-002081":"The organization defines the information systems that employ either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing connections to external information systems.","CCI-002082":"The organization selects either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.","CCI-002083":"Review and update the agreements on an organization-defined frequency.","CCI-002084":"Defines the frequency at which reviews and updates to the agreements must be conducted.","CCI-002085":"The organization defines the level of independence the assessors or assessment teams must have to monitor the security controls in the information system on an ongoing basis.","CCI-002086":"Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.","CCI-002087":"Establish organization-defined system-level metrics to be monitored.","CCI-002088":"Establish organization-defined frequencies for monitoring.","CCI-002089":"The organization establishes and defines the frequencies for assessments supporting continuous monitoring.","CCI-002090":"Implement ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy.","CCI-002091":"Implement a continuous monitoring program that includes correlation and analysis of information generated by assessments and monitoring.","CCI-002092":"Implement a continuous monitoring program that includes response actions to address results of the analysis of control assessment and monitoring information.","CCI-002093":"Conduct penetration testing in accordance with organization-defined frequency on organization-defined systems or system components.","CCI-002094":"Defines the frequency for conducting penetration testing on organization-defined systems or system components.","CCI-002095":"Defines the systems or system components on which penetration testing will be conducted.","CCI-002096":"Employ an independent penetration agent or penetration team to perform penetration testing on the system or system components.","CCI-002097":"Defines red team exercises to simulate attempts by adversaries to compromise organizational systems.","CCI-002098":"The organization defines rules of engagement for red team exercises to simulate attempts by adversaries to compromise organizational information systems.","CCI-002099":"Employ organization-defined red team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.","CCI-002100":"Perform security compliance checks on constituent components prior to the establishment of the internal connection.","CCI-002101":"Authorizes internal connections of organization-defined system components or classes of components to the system.","CCI-002102":"Defines the system components or classes of components that are authorized internal connections to the system.","CCI-002103":"Document, for each internal connection, the interface characteristics.","CCI-002104":"Document, for each internal connection, the security requirements.","CCI-002105":"Document, for each internal connection, the nature of the information communicated.","CCI-002106":"The organization documents the access control policy.","CCI-002107":"Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level access control policy necessary to facilitate the implementation of the access control policy and associated access controls.","CCI-002108":"Defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls.","CCI-002109":"The organization documents procedures to facilitate the implementation of the access control policy and associated access controls.","CCI-002110":"The organization defines the information system account types that support the organizational missions/business functions.","CCI-002111":"The organization identifies and selects the organization-defined information system account types of information system accounts which support organizational missions/business functions.","CCI-002112":"Assign account managers.","CCI-002113":"The organization establishes conditions for role membership.","CCI-002114":"The organization specifies authorized users of the information system for each account.","CCI-002115":"Specify authorized users of the system.","CCI-002116":"Specify authorized users of the group.","CCI-002117":"Specify authorized users of the role membership.","CCI-002118":"Specify authorized access authorizations (i.e., privileges) for each account.","CCI-002119":"Specify organization-attributes (as required) for each account on the system.","CCI-002120":"Defines the personnel or roles authorized to approve the creation of accounts.","CCI-002121":"Defines the procedures to be employed when creating, enabling, modifying, disabling, and removing information system accounts.","CCI-002122":"Monitor the use of accounts.","CCI-002123":"Notify account managers and organization-defined personnel or roles within an organization-defined time-period when accounts are no longer required.","CCI-002124":"Notify account managers and organization-defined personnel or roles within an organization-defined time-period when users are terminated or transferred.","CCI-002125":"Notify account managers and organization-defined personnel or roles within an organization-defined time-period when system usage or need-to-know changes for an individual.","CCI-002126":"Authorize access to the system based on a valid access authorization.","CCI-002127":"Authorize access to the system based on intended system usage.","CCI-002128":"Authorize access to the system based on organization-defined attributes (as required).","CCI-002129":"Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group.","CCI-002130":"Automatically audit account enabling actions.","CCI-002131":"The organization defines the personnel or roles to be notified on account creation, modification, enabling, disabling, and removal actions.","CCI-002132":"The information system notifies organization-defined personnel or roles for account enabling actions.","CCI-002133":"Defines other conditions when users are required to log out.","CCI-002134":"Defines a list of dynamic privilege management capabilities to be implemented.","CCI-002135":"Implement the organization-defined list of dynamic privilege management capabilities.","CCI-002136":"The organization defines the actions to be taken when privileged role assignments are no longer appropriate.","CCI-002137":"Revoke access when privileged role or attribute assignments are no longer appropriate.","CCI-002138":"Defines the system accounts that can be dynamically created.","CCI-002139":"Create organization-defined system accounts dynamically.","CCI-002140":"Defines the conditions for establishing shared/group accounts.","CCI-002141":"Only permit the use of shared and group accounts that meet organization-defined conditions for establishing shared and group accounts.","CCI-002142":"The information system terminates shared/group account credentials when members leave the group.","CCI-002143":"Defines the circumstances and/or usage conditions that are to be enforced for organization-defined information system accounts.","CCI-002144":"Defines the system accounts that are to be subject to the enforcement of organization-defined circumstances and/or usage conditions.","CCI-002145":"Enforce organization-defined circumstances and/or usage conditions for organization-defined system accounts.","CCI-002146":"Defines atypical usage for which the system accounts are to be monitored.","CCI-002147":"Monitor system accounts for organization-defined atypical usage.","CCI-002148":"Defines the personnel or roles to whom atypical usage of system accounts are to be reported.","CCI-002149":"Report atypical usage of system accounts to organization-defined personnel or roles.","CCI-002150":"Defines the time period within which the accounts of users posing a significant risk are to be disabled after discovery of the risk.","CCI-002151":"Disable accounts of individuals within an organization-defined time-period of discovery of organization-defined significant risk.","CCI-002152":"Defines other actions necessary for which dual authorization is to be enforced.","CCI-002153":"Defines the mandatory access control policies that are to be enforced over all subjects and objects.","CCI-002154":"Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy is uniformly enforced across the covered subjects and objects within the system.","CCI-002155":"Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects.","CCI-002156":"Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects.","CCI-002157":"Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the system, or system components.","CCI-002158":"Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects.","CCI-002159":"Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects.","CCI-002160":"Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing the rules governing access control.","CCI-002161":"Defines subjects which may explicitly be granted organization-defined privileges such that they are not limited by any of the mandatory access control constraints.","CCI-002162":"Defines the privileges that may explicitly be granted to organization-defined subjects such that they are not limited by any of the mandatory access control constraints.","CCI-002163":"Defines the discretionary access control policies the information system is to enforce over subjects and objects.","CCI-002164":"Enforce organization-defined discretionary access control policy that over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: pass the information to any other subjects or objects; grant its privileges to other subjects; change security attributes on subjects, objects, the system, or the system's components; choose the security attributes to be associated with newly created or revised objects; and/or change the rules governing access control.","CCI-002165":"Enforce organization-defined discretionary access control policies over defined subjects and objects.","CCI-002166":"Defines the role-based access control policies to enforce over all subjects and objects.","CCI-002167":"The organization defines the subjects over which the information system will enforce a role-based access control policy.","CCI-002168":"The organization defines the objects over which the information system will enforce a role-based access control policy.","CCI-002169":"Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.","CCI-002170":"Control access based upon organization-defined roles and users authorized to assume such roles.","CCI-002171":"The information system enforces a role-based access control policy over organization-defined subjects.","CCI-002172":"The information system enforces a role-based access control policy over organization-defined objects.","CCI-002173":"Defines the roles authorized to control access based upon the role-based access control policy.","CCI-002174":"Defines the users authorized to control access based upon the role-based access control policy.","CCI-002175":"The information system controls access based upon organization-defined roles authorized to assume such roles, employing the organization-defined role-based access control policy.","CCI-002176":"The information system controls access based upon organization-defined users authorized to assume such roles, employing the organization-defined role-based access control policy.","CCI-002177":"Defines the rules governing the timing of revocation of access authorizations.","CCI-002178":"Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects based on organization-defined rules governing the timing of revocations of access authorizations.","CCI-002179":"Enforce the revocation of access authorizations resulting from changes to the security attributes of objects based on organization-defined rules governing the timing of revocations of access authorizations.","CCI-002180":"Defines the controls the organization-defined system or system component is to provide to protect information released outside the established system boundary.","CCI-002181":"Defines system or system components that are to provide organization-defined controls to protect information received outside the established system boundary.","CCI-002182":"Release information outside of the established system boundary only if organization-defined system or system components provides organization-defined controls.","CCI-002183":"Defines the controls to be used to validate the appropriateness of the information designated for release.","CCI-002184":"Release information outside of the established system boundary only if organization-defined controls are used to validate the appropriateness of the information designated for release.","CCI-002185":"Defines the conditions on which it will employ an audited override of automated access control mechanisms.","CCI-002186":"Employ an audited override of automated access control mechanisms under organization-defined conditions by organization-defined roles.","CCI-002187":"Defines the security attributes to be used to enforce organization-defined information flow control policies.","CCI-002188":"Defines the information, source, and destination objects with which the organization-defined security attributes are to be associated.","CCI-002189":"Defines the information flow control policies to be enforced for flow control decisions.","CCI-002190":"Use organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.","CCI-002191":"Defines the information flow control policies to be enforced by the information system using protected processing domains.","CCI-002192":"Defines the policies to enforce dynamic information flow control.","CCI-002193":"Defines procedures or methods to be employed to prevent encrypted information from bypassing flow control mechanisms, such as decrypting the information, blocking the flow of the encrypted information, and/or terminating communications sessions attempting to pass encrypted information.","CCI-002194":"Defines the metadata the information system uses to enforce information flow control.","CCI-002195":"Defines the information flows against which the organization-defined security or privacy policy filters are to be enforced.","CCI-002196":"Defines the information flows for which will enforce the use of human reviews under organization-defined conditions.","CCI-002197":"Defines the conditions which will require the use of human reviews of organization-defined information flows.","CCI-002198":"Enforce the use of human reviews for organization-defined information flows under organization-defined conditions.","CCI-002199":"Defines the conditions that provides the capability for privileged administrators to enable and disable organization-defined security policy filters.","CCI-002200":"Defines the data type identifiers to be used to validate data being transferred between different security domains.","CCI-002201":"When transferring information between different security domains, use organization-defined data type identifiers to validate data essential for information flow decisions.","CCI-002202":"Defines the policy-relevant subcomponents into which information being transferred between different security domains is to be decomposed for submission to policy enforcement mechanisms.","CCI-002203":"Defines the unsanctioned information when transferring information between different security domains.","CCI-002204":"Defines the security or privacy policy which prohibits the transfer of unsanctioned information between different security domains.","CCI-002205":"Uniquely identify and authenticate source by organization, system, application, service, and/or individual for information transfer.","CCI-002206":"The information system uniquely authenticates source by organization, system, application, and/or individual for information transfer.","CCI-002207":"Uniquely identify and authenticate destination points by organization, system, application, service, and/or individual for information transfer.","CCI-002208":"The information system uniquely authenticates destination by organization, system, application, and/or individual for information transfer.","CCI-002209":"The organization defines the techniques to be used to bind security attributes to information.","CCI-002210":"The information system binds security attributes to information using organization-defined binding techniques to facilitate information flow policy enforcement.","CCI-002211":"When transferring information between different security domains, implement organization-defined security or privacy filters on metadata.","CCI-002212":"Defines the solutions in approved configurations to be employed to control the flow of organization-defined information across security domains.","CCI-002213":"Defines the information to be subjected to flow control across security domains.","CCI-002214":"Employ organization-defined solutions in approved configurations to control the flow of organization-defined information across security domains.","CCI-002215":"Defines the mechanisms and/or techniques to be used to logically or physically separate information flows.","CCI-002216":"Defines the types of information required to accomplish logical or physical separation of information flows.","CCI-002217":"Separate information flows logically or physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations by types of information.","CCI-002218":"Provide access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.","CCI-002219":"Defines the duties of individuals requiring separation.","CCI-002220":"Define system access authorizations to support separation of duties.","CCI-002221":"Defines the security-relevant information for which access must be explicitly authorized.","CCI-002222":"Authorize access for organization-defined individuals or roles to organization-defined security functions (deployed in hardware, software, and firmware).","CCI-002223":"Authorize access for organization-defined individuals or roles to organization-defined security-relevant information.","CCI-002224":"Defines the compelling operational needs that must be met in order to be authorized network access to organization-defined privileged commands.","CCI-002225":"Provide separate processing domains to enable finer-grained allocation of user privileges.","CCI-002226":"Defines the personnel or roles to whom privileged accounts are to be restricted on the information system.","CCI-002227":"Restrict privileged accounts on the system to organization-defined personnel or roles.","CCI-002228":"Defines the frequency on which it conducts reviews of the privileges assigned to organization-defined roles or classes of users.","CCI-002229":"Defines the roles or classes of users that are to have their privileges reviewed on an organization-defined frequency.","CCI-002230":"Review, on an organization-defined frequency, the privileges assigned to organization-defined roles or classes of users to validate the need for such privileges.","CCI-002231":"Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.","CCI-002232":"Defines the software that is prevented from executing at a higher privilege than users executing the software.","CCI-002233":"Prevent the organization-defined software from executing at higher privilege levels than users executing the software.","CCI-002234":"Log the execution of privileged functions.","CCI-002235":"Prevent non-privileged users from executing privileged functions.","CCI-002236":"Defines the time period the information system will automatically lock the account or node when the maximum number of unsuccessful logon attempts is exceeded.","CCI-002237":"Defines the delay algorithm to delay the next logon prompt when the maximum number of unsuccessful logon attempts is exceeded.","CCI-002238":"Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.","CCI-002239":"Defines the mobile devices that are to be purged or wiped after an organization-defined number of consecutive, unsuccessful device logon attempts.","CCI-002240":"Defines the purging or wiping requirements and techniques to be used on organization-defined mobile devices after an organization-defined number of consecutive, unsuccessful device logon attempts.","CCI-002241":"Defines the number of consecutive, unsuccessful device logon attempts after which the organization-defined mobile devices will be purged or wiped.","CCI-002242":"Purge or wipe information from organization-defined mobile devices based on organization-defined purging or wiping requirements and techniques after an organization-defined number of consecutive, unsuccessful device logon attempts.","CCI-002243":"Organization-defined system use notification message or banner is to state that users are accessing a U.S. Government system.","CCI-002244":"Organization-defined system use notification message or banner is to state that system usage may be monitored, recorded, and subject to audit.","CCI-002245":"Organization-defined system use notification message or banner is to state that unauthorized use of the system is prohibited and subject to criminal and civil penalties.","CCI-002246":"Organization-defined system use notification message or banner is to state that use of the system indicates consent to monitoring and recording.","CCI-002247":"Defines the use notification message or banner the system displays to users before granting access to the system.","CCI-002248":"Defines the conditions of use which are to be displayed to users of the system before granting further access.","CCI-002249":"Defines the additional information to be included in the notification to the user upon successful logon.","CCI-002250":"Notify the user, upon successful logon, of the following additional information: organization-defined additional information.","CCI-002251":"The information system notifies the user, upon successful logon (access), of the date and time of the last logon (access).","CCI-002252":"Defines the accounts and/or account types for which will limit the number of concurrent sessions.","CCI-002253":"The organization defines the account types for which the information system will limit the number of concurrent sessions.","CCI-002254":"The organization defines the conditions or trigger events requiring session disconnect to be employed by the information system when automatically terminating a user session.","CCI-002255":"The organization defines the user actions that can be performed on the information system without identification and authentication.","CCI-002256":"Defines security attributes having organization-defined types of security attribute values which are associated with information in storage.","CCI-002257":"Defines security attributes having organization-defined types of security attribute values which are associated with information in process.","CCI-002258":"Defines security attributes, having organization-defined types of security attribute values, which are associated with information in transmission.","CCI-002259":"Defines security attribute values associated with organization-defined types of security attributes for information in storage.","CCI-002260":"Defines security attribute values associated with organization-defined types of security attributes for information in process.","CCI-002261":"Defines security attribute values associated with organization-defined types of security attributes for information in transmission.","CCI-002262":"Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.","CCI-002263":"Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in process.","CCI-002264":"Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.","CCI-002265":"Ensure that the attribute associations are made and retained with the information.","CCI-002266":"Ensure that the security attribute associations are retained with the information.","CCI-002267":"Defines the security attributes that are permitted for organization-defined systems.","CCI-002268":"Defines the systems for which permitted organization-defined attributes are to be established.","CCI-002269":"Establish the following permitted organization-defined security attributes in AC-16a for organization-defined systems.","CCI-002270":"Defines the attribute values or ranges permitted for each of the established security attributes.","CCI-002271":"Determine organization-defined attribute values or ranges for each of the established attributes.","CCI-002272":"Dynamically associate security attributes with organization-defined objects in accordance with organization-defined security policies as information is created and combined.","CCI-002273":"Defines the security policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects.","CCI-002274":"Defines the subjects with which the system is to dynamically associate security attributes as information is created and combined.","CCI-002275":"Defines the objects with which the system is to dynamically associate security attributes as information is created and combined.","CCI-002276":"The organization identifies the individuals authorized to define the value of associated security attributes.","CCI-002277":"Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes.","CCI-002278":"Defines the security attributes for which the association and integrity to organization-defined subjects and objects is maintained.","CCI-002279":"Defines the subjects for which the association and integrity of organization-defined security attributes is maintained.","CCI-002280":"Defines the objects for which the association and integrity of organization-defined security attributes is maintained.","CCI-002281":"Maintain the association of organization-defined security attributes to organization-defined subjects.","CCI-002282":"Maintain the association of organization-defined security attributes to organization-defined objects.","CCI-002283":"Maintain the integrity of organization-defined security attributes associated with organization-defined subjects.","CCI-002284":"Maintain the integrity of organization-defined security attributes associated with organization-defined objects.","CCI-002285":"The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined subjects.","CCI-002286":"Defines the subjects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).","CCI-002287":"Defines the objects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).","CCI-002288":"Defines the security attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.","CCI-002289":"Provide the capability to associate organization-defined security attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).","CCI-002290":"Provide the capability to associate organization-defined security attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).","CCI-002291":"Defines the security policies to be followed by personnel when associating organization-defined security attributes with organization-defined subjects and objects.","CCI-002292":"Defines the security attributes which are to be associated with organization-defined subjects and objects.","CCI-002293":"Defines the subjects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.","CCI-002294":"Defines the objects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.","CCI-002295":"Require personnel to associate organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.","CCI-002296":"Require personnel to associate organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.","CCI-002297":"Require personnel to maintain the association of organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.","CCI-002298":"Require personnel to maintain the association of organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.","CCI-002299":"Provide a consistent interpretation of security attributes transmitted between distributed system components.","CCI-002300":"Defines the techniques and technologies to be implemented when associating security attributes with information.","CCI-002301":"Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating security attributes to information.","CCI-002302":"Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating security attributes to information.","CCI-002303":"Defines the techniques or procedures to be employed to validate re-grading mechanisms.","CCI-002304":"Change security attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.","CCI-002305":"The organization identifies individuals authorized to define or change the type and value of security attributes available for association with subjects and objects.","CCI-002306":"Provide authorized individuals the capability to define or change the type of security attributes available for association with subjects.","CCI-002307":"Provide authorized individuals the capability to define or change the value of security attributes available for association with subjects.","CCI-002308":"Provide authorized individuals the capability to define or change the type of security attributes available for association with objects.","CCI-002309":"Provide authorized individuals the capability to define or change the value of security attributes available for association with objects.","CCI-002310":"Establish and document usage restrictions for each type of remote access allowed.","CCI-002311":"Establish and document configuration/connection requirements for each type of remote access allowed.","CCI-002312":"Establish and document implementation guidance for each type of remote access allowed.","CCI-002313":"The information system controls remote access methods.","CCI-002314":"Employ automated mechanisms to control remote access methods.","CCI-002315":"The organization defines the number of managed network access control points through which the information system routes all remote access.","CCI-002316":"Authorize access to security-relevant information via remote access only in a format that provides assessable evidence for organization-defined needs.","CCI-002317":"Defines the needs for when the execution of privileged commands via remote access is to be authorized.","CCI-002318":"Defines the needs for when access to security-relevant information via remote access is to be authorized.","CCI-002319":"Document the rationale for authorization of the execution of privilege commands via remote access.","CCI-002320":"Document the rationale for authorization of access to security-relevant information via remote access.","CCI-002321":"Defines the time-period within which it disconnects or disables remote access to the system.","CCI-002322":"Provide the capability to disconnect or disable remote access to the system within the organization-defined time period.","CCI-002323":"Establish configuration requirements and connection requirements for wireless access.","CCI-002324":"Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.","CCI-002325":"Establish configuration requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.","CCI-002326":"Establish connection requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.","CCI-002327":"Defines the security policies which restrict the connection of classified mobile devices to classified systems.","CCI-002328":"Restrict the connection of classified mobile devices to classified systems in accordance with organization-defined security policies.","CCI-002329":"Defines the mobile devices that are to employ full-device or container encryption to protect the confidentiality and integrity of the information on the device.","CCI-002330":"Employ full-device encryption or container encryption to protect the confidentiality of information on organization-defined mobile devices.","CCI-002331":"Employ full-device encryption or container encryption to protect the integrity of information on organization-defined mobile devices.","CCI-002332":"Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using the external systems.","CCI-002333":"The organization permits authorized individuals to use an external information system to access the information system only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.","CCI-002334":"The organization permits authorized individuals to use an external information system to process organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.","CCI-002335":"The organization permits authorized individuals to use an external information system to store organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.","CCI-002336":"The organization permits authorized individuals to use an external information system to transmit organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.","CCI-002337":"Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after the system retains approved system connection or processing agreements with the organizational entity hosting the external system.","CCI-002338":"Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using organization-defined restrictions.","CCI-002339":"Defines the network accessible storage devices that are to be prohibited from being used in external systems.","CCI-002340":"Prohibit the use of organization-defined network accessible storage devices in external systems.","CCI-002341":"Defines the information sharing restrictions to be enforced when implementing information search and retrieval services.","CCI-002342":"Implement information search and retrieval services that enforce organization-defined information sharing restrictions.","CCI-002343":"Defines the data mining prevention techniques to be employed to protect organization-defined data storage objects against data mining.","CCI-002344":"Defines the data mining detection techniques to be employed to detect data mining attempts against organization-defined data storage objects.","CCI-002345":"Defines the data storage objects that are to be protected against data mining attempts.","CCI-002346":"Employ organization-defined data mining prevention techniques for organization-defined data storage objects to protect against unauthorized data mining.","CCI-002347":"Employ organization-defined data mining detection techniques for organization-defined data storage objects to detect data mining attempts.","CCI-002348":"Defines the access control decisions that are to be applied to each access request prior to access enforcement.","CCI-002349":"Establish procedures or implement mechanisms to ensure organization-defined access control decisions are applied to each access request prior to access enforcement.","CCI-002350":"Defines the access authorization information that is to be transmitted using organization-defined security safeguards to organization-defined systems that enforce access control decisions.","CCI-002351":"Defines the controls to be employed when transmitting organization-defined access authorization information to organization-defined systems that enforce access control decisions.","CCI-002352":"Defines the systems that are to be recipients of organization-defined access authorization information using organization-defined security safeguards.","CCI-002353":"Transmit organization-defined access authorization information using organization-defined controls to organization-defined systems that enforce access control decisions.","CCI-002354":"Defines the security attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.","CCI-002355":"Enforce access control decisions based on organization-defined security or privacy attributes that do not include the identity of the user or process acting on behalf of the user.","CCI-002356":"Defines the access control policies to be implemented by the reference monitor.","CCI-002357":"Implement a reference monitor for organization-defined access control policies that is tamperproof.","CCI-002358":"Implement a reference monitor for organization-defined access control policies that is always invoked.","CCI-002359":"Implement a reference monitor for organization-defined access control policies that is small enough to be subject to analysis and testing, the completeness of which can be assured.","CCI-002360":"Defines the conditions or trigger events requiring session disconnect when automatically terminating a user session.","CCI-002361":"Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.","CCI-002362":"Defines the information resources requiring authentication in order to gain access.","CCI-002363":"Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources.","CCI-002364":"Display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.","CCI-002365":"The organization manages information system authenticators by requiring individuals to take specific security safeguards to protect authenticators.","CCI-002366":"The organization manages information system authenticators by having devices implement specific security safeguards to protect authenticators.","CCI-002367":"The organization ensures unencrypted static authenticators are not embedded in applications.","CCI-002368":"Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level risk assessment policy is disseminated.","CCI-002369":"Defines the personnel or roles to whom the risk assessment procedures are disseminated.","CCI-002370":"Disseminate risk assessment results to organization-defined personnel or roles.","CCI-002371":"Defines the personnel or roles to whom the risk assessment results will be disseminated.","CCI-002372":"Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.","CCI-002373":"Define the breadth and depth of vulnerability scanning coverage (i.e., information system components scanned and vulnerabilities checked).","CCI-002374":"Defines the corrective actions if unintended information about the system is discovered.","CCI-002375":"Take organization-defined corrective actions if information about the system is discovered.","CCI-002376":"Defines the personnel or roles with whom the information obtained from the vulnerability monitoring process and control assessments will be shared.","CCI-002377":"The organization documents the system and communications protection policy.","CCI-002378":"Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level system and communications protection policy.","CCI-002379":"The organization documents procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.","CCI-002380":"Defines the personnel or roles to be recipients of the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.","CCI-002381":"Minimize the number of nonsecurity functions included within the isolation boundary containing security functions.","CCI-002382":"Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.","CCI-002383":"Defines the procedures to be employed to prevent unauthorized information transfer via shared resources when system processing explicitly switches between different information classification levels or security categories.","CCI-002384":"Prevent unauthorized information transfer via shared resources in accordance with organization-defined procedures when system processing explicitly switches between different information classification levels or security categories.","CCI-002385":"Protect against or limit the effects of organization-defined types of denial-of-service events.","CCI-002386":"The organization defines the security safeguards to be employed to protect the information system against, or limit the effects of, denial of service attacks.","CCI-002387":"Defines the denial of service attacks against other systems that the system is to restrict the ability of individuals to launch.","CCI-002388":"Defines the monitoring tools to be employed to detect indicators of denial-of-service attacks against the system.","CCI-002389":"Employ organization-defined monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system.","CCI-002390":"Defines the system resources to be monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks.","CCI-002391":"Monitor organization-defined system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks.","CCI-002392":"Defines the resources to be allocated to protect the availability of system resources.","CCI-002393":"Defines the controls to be employed to protect the availability of system resources.","CCI-002394":"Protect the availability of resources by allocating organization-defined resources based on priority, quota, and/or organization-defined controls.","CCI-002395":"Implement subnetworks for publicly accessible system components that are physically and/or logically separated from internal organizational networks.","CCI-002396":"Protect the confidentiality and integrity of the information being transmitted across each interface for each external telecommunication service.","CCI-002397":"Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using organization-defined safeguards.","CCI-002398":"Detect outgoing communications traffic posing a threat to external systems.","CCI-002399":"Deny outgoing communications traffic posing a threat to external systems.","CCI-002400":"Audit the identity of internal users associated with denied outgoing communications traffic posing a threat to external systems.","CCI-002401":"Defines the authorized sources from which the system will allow incoming communications.","CCI-002402":"Defines the authorized destinations for routing inbound communications.","CCI-002403":"Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.","CCI-002404":"Defines the host-based boundary protection mechanisms that are to be implemented at organization-defined system components.","CCI-002405":"Defines the system components at which organization-defined host-based boundary protection mechanisms will be implemented.","CCI-002406":"Implement organization-defined host-based boundary protection mechanisms at organization-defined system components.","CCI-002407":"Defines the managed interfaces at which protect against unauthorized physical connections.","CCI-002408":"Defines the communication clients that are independently configured by end users and external service providers which will block both inbound and outbound communications traffic.","CCI-002409":"Block inbound and outbound communications traffic between organization-defined communication clients that are independently configured by end users and external service providers.","CCI-002410":"Defines system components that are to be dynamically isolated from other system components.","CCI-002411":"Provide the capability to dynamically isolate organization-defined system components from other system components.","CCI-002412":"The organization defines the information system components supporting organization-defined missions and/or business functions that are to be separated using boundary protection mechanisms.","CCI-002413":"Defines the system components supporting organization-defined missions and/or business functions that are to be isolated using boundary protection mechanisms.","CCI-002414":"Defines the missions and/or business functions for which boundary protection mechanisms will be employed to isolate the supporting organization-defined system components.","CCI-002415":"Employ boundary protection mechanisms to isolate organization-defined system components supporting organization-defined missions and/or business functions.","CCI-002416":"Implement separate network addresses to connect to systems in different security domains.","CCI-002417":"Disable feedback to senders on protocol format validation failure.","CCI-002418":"Protect the confidentiality and/or integrity of transmitted information.","CCI-002419":"The organization defines the alternative physical safeguards to be employed when cryptographic mechanisms are not implemented to protect information during transmission.","CCI-002420":"Maintain the confidentiality and/or integrity of information during preparation for transmission.","CCI-002421":"Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.","CCI-002422":"Maintain the confidentiality and/or integrity of information during reception.","CCI-002423":"Implement cryptographic mechanisms to protect message externals unless otherwise protected by organization-defined alternative physical controls.","CCI-002424":"Defines the alternative physical controls to be employed when cryptographic mechanisms to conceal or randomize communication patterns are not implemented.","CCI-002425":"Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by organization-defined alternative physical controls.","CCI-002426":"Provide a trusted communications path that is irrefutably distinguishable from other communications paths.","CCI-002427":"Defines the alternative physical controls to be employed to protect message externals when cryptographic mechanisms are not implemented.","CCI-002428":"Defines the requirements for cryptographic key generation to be employed within the system.","CCI-002429":"Defines the requirements for cryptographic key distribution to be employed within the system.","CCI-002430":"Defines the requirements for cryptographic key storage to be employed within the system.","CCI-002431":"Defines the requirements for cryptographic key access to be employed within the system.","CCI-002432":"Defines the requirements for cryptographic key destruction to be employed within the system.","CCI-002433":"Establish cryptographic keys when cryptography is employed within the system in accordance with organization-defined requirements for key generation.","CCI-002434":"Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution.","CCI-002435":"Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage.","CCI-002436":"Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access.","CCI-002437":"Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction.","CCI-002438":"Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key generation.","CCI-002439":"Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution.","CCI-002440":"Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage.","CCI-002441":"Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access.","CCI-002442":"Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction.","CCI-002443":"Produce symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.","CCI-002444":"Control symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.","CCI-002445":"Distribute symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.","CCI-002446":"Produce asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.","CCI-002447":"Control asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.","CCI-002448":"Distribute asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.","CCI-002449":"Defines the cryptographic uses, and type of cryptography required for each use, to be implemented by the system.","CCI-002450":"Implement organization-defined types of cryptography for each specified cryptography use.","CCI-002451":"Defines the systems or system components from which collaborative computing devices and applications in organization-defined secure work areas are to be disabled or removed.","CCI-002452":"Defines the online meetings and teleconferences for which the system provides an explicit indication of current participants.","CCI-002453":"Provide an explicit indication of current participants in organization-defined online meetings and teleconferences.","CCI-002454":"Defines the security attributes to associate with the information being exchanged between systems and between system components.","CCI-002455":"Associate organization-defined security attributes with information exchanged between system components.","CCI-002456":"Defines the certificate policy employed to issue public key certificates.","CCI-002457":"Defines the corrective actions to be taken when organization-defined unacceptable mobile code is identified.","CCI-002458":"Defines what constitutes unacceptable mobile code by using corrective actions.","CCI-002459":"Defines the unacceptable mobile code to prevent download and execution.","CCI-002460":"Enforce organization-defined actions prior to executing mobile code.","CCI-002461":"Allow execution of permitted mobile code only in confined virtual machine environments.","CCI-002462":"Provide additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.","CCI-002463":"Provide data origin artifacts for internal name/address resolution queries.","CCI-002464":"Provide data integrity protection artifacts for internal name/address resolution queries.","CCI-002465":"Request data origin authentication verification on the name/address resolution responses the system receives from authoritative sources.","CCI-002466":"Request data integrity verification on the name/address resolution responses the system receives from authoritative sources.","CCI-002467":"Perform data integrity verification on the name/address resolution responses the system receives from authoritative sources.","CCI-002468":"Perform data origin verification authentication on the name/address resolution responses the system receives from authoritative sources.","CCI-002469":"Defines the certificate authorities allowed to be used for verification of the establishment of protected sessions.","CCI-002470":"Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.","CCI-002471":"Defines the system components, with minimal functionality and information storage, to be employed.","CCI-002472":"Defines the information at rest that is to be protected.","CCI-002473":"Defines the information at rest for which cryptographic mechanisms will be implemented.","CCI-002474":"Defines the system components which require the implementation of cryptographic mechanisms to prevent unauthorized disclosure and modification of organization-defined information at rest.","CCI-002475":"Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined system components.","CCI-002476":"Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.","CCI-002477":"Defines the information to be removed from online storage and stored in an offline secure location.","CCI-002478":"Remove organization-defined information from online storage.","CCI-002479":"Store organization-defined information in an offline secure location.","CCI-002480":"Defines the system components for which a diverse set of information technologies are to be employed.","CCI-002481":"Employ virtualization techniques to support the deployment of a diversity of applications that are changed per organization-defined frequency.","CCI-002482":"Defines the concealment and misdirection techniques employed for organization-defined systems to confuse and mislead adversaries.","CCI-002483":"Defines the systems for which organization-defined concealment and misdirection techniques are to be employed.","CCI-002484":"Defines the time periods at which to employ organization-defined concealment and misdirection techniques on organization-defined systems.","CCI-002485":"Employ organization-defined concealment and misdirection techniques for organization-defined systems at organization-defined time periods to confuse and mislead adversaries.","CCI-002486":"Defines the techniques to be employed to introduce randomness into organizational operations and assets.","CCI-002487":"Employ organization-defined techniques to introduce randomness into organizational operations.","CCI-002488":"Employ organization-defined techniques to introduce randomness into organizational assets.","CCI-002489":"Defines the processing and/or storage locations to be changed at random intervals or at an organization-defined frequency.","CCI-002490":"Defines the frequency at which the location of organization-defined processing and/or storage changes.","CCI-002491":"The organization changes the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.","CCI-002492":"Change the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.","CCI-002493":"Defines the system components in which it will employ realistic but misleading information regarding its security state or posture.","CCI-002494":"Employ realistic, but misleading, information in organization-defined system components about its security state or posture.","CCI-002495":"Defines the techniques to be employed to hide or conceal organization-defined system components.","CCI-002496":"Defines the system components to be hidden or concealed.","CCI-002497":"Employ organization-defined techniques to hide or conceal organization-defined system components.","CCI-002498":"Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert storage and/or timing channels.","CCI-002499":"Estimate the maximum bandwidth of the covert storage and timing channels.","CCI-002500":"Defines the maximum bandwidth values to which covert storage and/or timing channels are to be reduced.","CCI-002501":"Reduce the maximum bandwidth for identified covert storage and/or timing channels to organization-defined values.","CCI-002502":"Defines the subset of identified covert channels in the operational environment of the system that are to have the bandwidth measured.","CCI-002503":"Measure the bandwidth of an organization-defined subset of identified covert channels in the operational environment of the information system.","CCI-002504":"Defines the system components into which the system is partitioned.","CCI-002505":"Defines the circumstances under which the system components are to be physically or logically separated to support partitioning.","CCI-002506":"Partition the system into organization-defined system components residing in separate physical or logical domains or environments based on organization-defined circumstances for physical or logical separation of components.","CCI-002507":"Control read-only media after information has been recorded onto the media.","CCI-002508":"Defines the system firmware components for which hardware-based, write-protect is employed.","CCI-002509":"Employ hardware-based, write-protect for organization-defined information system firmware components.","CCI-002510":"Defines the individuals authorized to manually disable hardware-based, write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.","CCI-002511":"Implement specific procedures for organization-defined authorized individuals to manually disable hardware-based, write-protect for firmware modifications.","CCI-002512":"Implement specific procedures for organization-defined authorized individuals to manually re-enable hardware write-protect prior to returning to operational mode.","CCI-002513":"Defines the processing that is to be distributed across multiple physical locations or logical domains.","CCI-002514":"Defines the storage components that is to be distributed across multiple physical locations or logical domains.","CCI-002515":"Distributes organization-defined processing across multiple physical locations or logical domains.","CCI-002516":"Distributes organization-defined storage components across multiple physical locations or logical domains.","CCI-002517":"Defines the distributed processing components that are to be polled to identify potential faults, errors, or compromises.","CCI-002518":"Defines the distributed storage components that are to be polled to identify potential faults, errors, or compromises.","CCI-002519":"Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed processing components.","CCI-002520":"Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed storage components.","CCI-002521":"Defines the out-of-band channels to be employed for the physical delivery or electronic transmission of organization-defined information, system components, or devices.","CCI-002522":"Defines the information, system components, or devices that are to be electronically transmitted or physically delivered via organization-defined out-of-band channels.","CCI-002523":"Defines the individuals or systems authorized to be recipients of organization-defined information, system components, or devices to be delivered by employing organization-defined out-of-band channels for electronic transmission or physical delivery.","CCI-002524":"Employ organization-defined out-of-band channels for the physical delivery or electronic transmission of organization-defined information, system components, or devices to organization-defined individuals or systems.","CCI-002525":"Defines the controls to be employed to ensure only organization-defined individuals or systems receive organization-defined information, system components, or devices.","CCI-002526":"Defines the information, system components, or devices which are to be received only by organization-defined individuals or systems.","CCI-002527":"Employ organization-defined controls to ensure only organization-defined individuals or systems receive the organization-defined information, system components, or devices.","CCI-002528":"Defines the operations security controls to be employed to protect key organizational information throughout the system development life cycle.","CCI-002529":"Employ organization-defined operations security controls to protect key organizational information throughout the system development life cycle.","CCI-002530":"Maintain a separate execution domain for each executing system process.","CCI-002531":"Implement hardware separation mechanisms to facilitate process isolation.","CCI-002532":"Defines the multi-threaded processing in which a separate execution domain is maintained by the system for each thread.","CCI-002533":"Maintain a separate execution domain for each thread in organization-defined multi-threaded processing.","CCI-002534":"Defines types of signal parameter attacks or references to sources for such attacks from which the system protects organization-defined wireless links.","CCI-002535":"Defines the external and internal wireless links the system is to protect from organization-defined types of signal parameter attacks or references to sources for such attacks.","CCI-002536":"Protect organization-defined external and internal wireless links from organization-defined types of signal parameter attacks or references to sources for such attacks.","CCI-002537":"Defines the level of protection against the effects of intentional electromagnetic interference to be achieved by implemented cryptographic mechanisms.","CCI-002538":"Implement cryptographic mechanisms that achieve an organization-defined level of protection against the effects of intentional electromagnetic interference.","CCI-002539":"Defines the level of reduction the system is to implement to reduce the detection potential of wireless links.","CCI-002540":"Implement cryptographic mechanisms to reduce the detection potential of wireless links to an organization-defined level of reduction.","CCI-002541":"Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.","CCI-002542":"Defines the wireless transmitters that are to have cryptographic mechanisms implemented to prevent the identification of the wireless transmitters.","CCI-002543":"Implement cryptographic mechanisms to prevent the identification of organization-defined wireless transmitters by using the transmitter signal parameters.","CCI-002544":"Defines the systems or system components on which organization-defined connection ports or input/output devices are to be physically or logically disabled or removed.","CCI-002545":"Defines the connection ports or input/output devices that are to be physically or logically disabled or removed from organization-defined systems or system components.","CCI-002546":"Physically or logically disable or remove organization-defined connection ports or input/output devices on organization-defined systems or system components.","CCI-002547":"Defines the exceptions where remote activation of sensors is allowed.","CCI-002548":"Prohibit the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems; and/or the remote activation of environmental sensing capabilities on organizational systems or system components except for the organization-defined exceptions where remote activation of sensors is allowed.","CCI-002549":"Defines the class of users to receive explicit indication of sensor use.","CCI-002550":"Provide an explicit indication of sensor use to the organization-defined class of users.","CCI-002551":"Defines the sensors to be configured so that collected data or information is reported only to authorized individuals or roles.","CCI-002552":"Verify that the system is configured so that data or information collected by the organization-defined sensors is only reported to authorized individuals or roles.","CCI-002553":"Defines the measures to be employed to ensure data or information collected by organization-defined sensors is used only for authorized purposes.","CCI-002554":"Defines the sensors that are to collect data or information for authorized purposes.","CCI-002555":"Employ organization-defined measures, so that data or information collected by organization-defined sensors is only used for authorized purposes.","CCI-002556":"Defines the environmental sensing capabilities prohibited on devices used in organization-defined facilities, areas, or systems.","CCI-002557":"Defines the facilities, areas, or systems where devices processing organization-defined environmental sensing capabilities are prohibited.","CCI-002558":"The organization prohibits the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems.","CCI-002559":"Defines the system components for which usage restrictions and implementation guidance are to be established.","CCI-002560":"Establish usage restrictions and implementation guidance for organization-defined system components based on the potential to cause damage to the system if used maliciously.","CCI-002561":"Authorize the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.","CCI-002562":"Monitor the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.","CCI-002563":"Control the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.","CCI-002564":"Defines the system, system component, or location where a detonation chamber capability is employed.","CCI-002565":"Employ a detonation chamber capability within an organization-defined system, system component, or location.","CCI-002566":"Defines personnel or roles to whom a media protection policy and procedures will be disseminated.","CCI-002567":"Review and approve media sanitization.","CCI-002568":"Track and document media sanitization.","CCI-002569":"Verify media sanitization.","CCI-002570":"Review and approve media disposal actions.","CCI-002571":"Track and document media disposal actions.","CCI-002572":"Verify media disposal actions.","CCI-002573":"Enforce dual authorization for the sanitization of organization-defined system media.","CCI-002574":"Defines the system media that dual authorization is enforced for sanitization.","CCI-002575":"Defines systems or system components from which information is purged or wiped, either remotely or under the organization-defined conditions.","CCI-002576":"Defines conditions under which information from organization-defined systems or system components are to be purged or wiped.","CCI-002577":"Provide the capability to purge or wipe information from organization-defined systems, system components either remotely or under organization-defined conditions.","CCI-002578":"Defines system media to sanitize prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures.","CCI-002579":"Defines the sanitization techniques and procedures to be used to sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse.","CCI-002580":"Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.","CCI-002581":"Defines the types of system media to restrict or prohibit on organization-defined systems or system components using organization-defined controls.","CCI-002582":"Defines the systems or system components on which to restrict or prohibit the use of organization-defined types of system media using organization-defined controls.","CCI-002583":"Defines the controls to use for restricting or prohibiting the use of organization-defined types of system media on organization-defined systems or system components.","CCI-002584":"Restrict or prohibit the use of organization-defined types of system media on organization-defined systems or system components using organization-defined controls.","CCI-002585":"Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.","CCI-002586":"Prohibit the use of sanitization-resistant media in organizational systems.","CCI-002587":"Document system media downgrading actions.","CCI-002588":"The organization employs organization-defined tests of downgrading equipment in accordance with organization-defined frequency.","CCI-002589":"The organization employs procedures to verify correct performance of organization-defined tests of downgrading equipment in accordance with organization-defined frequency.","CCI-002590":"The organization defines tests to employ for downgrading equipment.","CCI-002591":"Defines the frequency with which to test downgrading equipment and procedures to ensure correct performance.","CCI-002592":"The organization defines Controlled Unclassified Information (CUI).","CCI-002593":"Downgrade system media containing Controlled Unclassified Information (CUI) prior to public release.","CCI-002594":"Downgrade system media containing classified information prior to release to individuals without required access authorizations.","CCI-002595":"The organization establishes an organization-defined information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.","CCI-002596":"The organization establishes and defines an information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.","CCI-002597":"The organization defines strength and integrity for downgrading mechanisms to establish an organization-defined information system media downgrading process.","CCI-002598":"The organization ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information.","CCI-002599":"The organization defines and identifies the information system media requiring downgrading.","CCI-002600":"Downgrade the identified system media using the established process.","CCI-002601":"Defines the personnel or roles to whom the system and information integrity policy and procedures are to be disseminated.","CCI-002602":"Test firmware updates related to flaw remediation for effectiveness before installation.","CCI-002603":"Test firmware updates related to flaw remediation for potential side effects before installation.","CCI-002604":"Defines the time period following the release of updates within which security-related software updates are to be installed.","CCI-002605":"Install security-relevant software updates within an organization-defined time period of the release of the updates.","CCI-002606":"Defines the time period following the release of updates within which security-related firmware updates are to be installed.","CCI-002607":"Install security-relevant firmware updates within an organization-defined time period of the release of the updates.","CCI-002608":"Establish organization-defined benchmarks for the time taken to apply corrective actions after flaw identification.","CCI-002609":"Defines the system components on which organization-defined security-relevant software updates will be automatically installed.","CCI-002610":"Defines the system components on which organization-defined security-relevant firmware updates will be automatically installed.","CCI-002611":"Defines the security-relevant software updates to be automatically installed on organization-defined system components.","CCI-002612":"Defines the security-relevant firmware updates to be automatically installed on organization-defined system components.","CCI-002613":"Install organization-defined security-relevant software updates automatically to organization-defined system components.","CCI-002614":"Install organization-defined security-relevant firmware updates automatically to organization-defined system components.","CCI-002615":"Defines the software components to remove previous versions after updated versions have been installed.","CCI-002616":"Defines the firmware components to remove previous versions after updated versions have been installed.","CCI-002617":"Remove previous versions of organization-defined software components after updated versions have been installed.","CCI-002618":"Remove previous versions of organization-defined firmware components after updated versions have been installed.","CCI-002619":"The organization employs malicious code protection mechanisms at information system entry points to detect malicious code.","CCI-002620":"The organization employs malicious code protection mechanisms at information system exit points to detect malicious code.","CCI-002621":"The organization employs malicious code protection mechanisms at information system entry points to eradicate malicious code.","CCI-002622":"The organization employs malicious code protection mechanisms at information system exit points to eradicate malicious code.","CCI-002623":"Defines the frequency for performing periodic scans of the system for malicious code.","CCI-002624":"Configure malicious code protection mechanisms to perform real-time scans of files from external sources at endpoint; and/or network entry and exit points as the files are downloaded, opened, or executed in accordance with organizational policy.","CCI-002625":"When testing malicious code protection mechanisms, verify the detection of the code.","CCI-002626":"When testing malicious code protection mechanisms, verify the associated incident reporting of the code occurs.","CCI-002627":"The information system implements nonsignature-based malicious code detection mechanisms.","CCI-002628":"Defines the unauthorized operating system commands that are to be detected through the kernel application programming interface on organization-defined system hardware components.","CCI-002629":"Defines the system hardware components that are to detect organization-defined unauthorized operating system commands through the kernel programming application interface.","CCI-002630":"Detect organization-defined unauthorized operating system commands through the kernel application programming interface at organization-defined system hardware components.","CCI-002631":"Issue a warning; audit the command execution; and/or prevent the execution of the command when organization-defined unauthorized operating system commands are detected.","CCI-002632":"The organization defines the remote commands that are to be authenticated using organization-defined safeguards for malicious code protection.","CCI-002633":"The organization defines the security safeguards to be implemented to authenticate organization-defined remote commands for malicious code protection.","CCI-002634":"Defines the tools to be employed to analyze the characteristics and behavior of malicious code.","CCI-002635":"Defines the techniques to be employed to analyze the characteristics and behavior of malicious code.","CCI-002636":"Employ organization-defined tools to analyze the characteristics and behavior of malicious code.","CCI-002637":"The information system implements organization-defined security safeguards to authenticate organization-defined remote commands for malicious code protection.","CCI-002638":"Employ organization-defined techniques to analyze the characteristics and behavior of malicious code.","CCI-002639":"Incorporate the results from malicious code analysis into organizational incident response processes.","CCI-002640":"Incorporate the results from malicious code analysis into organizational flaw remediation processes.","CCI-002641":"Monitor the system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives.","CCI-002642":"Monitor the system to detect unauthorized local connections.","CCI-002643":"Monitor the system to detect unauthorized network connections.","CCI-002644":"Monitor the system to detect unauthorized remote connections.","CCI-002645":"Defines the techniques and methods to be used to identify unauthorized use of the system.","CCI-002646":"Identify unauthorized use of the system through organization-defined techniques and methods.","CCI-002647":"The organization protects information obtained from intrusion-monitoring tools from unauthorized access.","CCI-002648":"The organization protects information obtained from intrusion-monitoring tools from unauthorized modification.","CCI-002649":"The organization protects information obtained from intrusion-monitoring tools from unauthorized deletion.","CCI-002650":"Defines the system monitoring information that is to be provided the organization-defined personnel or roles.","CCI-002651":"Defines the personnel or roles that are to be provided organization-defined system monitoring information.","CCI-002652":"Defines the frequency at which the organization will provide the organization-defined system monitoring information to organization-defined personnel or roles.","CCI-002653":"The organization provides organization-defined information system monitoring information to organization-defined personnel or roles as needed or per organization-defined frequency.","CCI-002654":"Provide organization-defined system monitoring information to organization-defined personnel or roles as needed, and/or per organization-defined frequency.","CCI-002655":"Connect individual intrusion detection tools into a system-wide intrusion detection system.","CCI-002656":"Configure individual intrusion detection tools into a system-wide intrusion detection system.","CCI-002657":"Employ automated tools to integrate intrusion detection tools into access control mechanisms.","CCI-002658":"Employ automated tools to integrate intrusion detection tools into flow control mechanisms.","CCI-002659":"Defines the frequency on which it will monitor inbound communications for unusual or unauthorized activities or conditions.","CCI-002660":"Defines the frequency on which it will monitor outbound communications for unusual or unauthorized activities or conditions.","CCI-002661":"Monitor inbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions.","CCI-002662":"Monitor outbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions.","CCI-002663":"Defines the personnel or roles to receive alerts when organization-defined indicators of compromise or potential compromise occur.","CCI-002664":"Alert organization-defined personnel or roles when organization-defined compromise indicators generate the occurrence of a compromise or a potential compromise.","CCI-002665":"Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring tools.","CCI-002666":"Defines the system monitoring tools that will have visibility into organization-defined encrypted communications traffic.","CCI-002667":"Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring tools.","CCI-002668":"Defines the interior points within the system where outbound communications will be analyzed to discover anomalies.","CCI-002669":"Use the traffic and event profiles in tuning system-monitoring devices.","CCI-002670":"Defines the interior points within the system where outbound communications will be analyzed to detect covert exfiltration of information.","CCI-002671":"Analyze outbound communications traffic at the external interfaces of the system to detect covert exfiltration of information.","CCI-002672":"Analyze outbound communications traffic at organization-defined interior points within the system to detect covert exfiltration of information.","CCI-002673":"Defines the additional monitoring to be implemented for individuals identified as posing an increased level of risk.","CCI-002674":"Defines the sources that may be used to identify individuals who pose an increased level of risk.","CCI-002675":"Implement organization-defined additional monitoring of individuals who have been identified by organization-defined sources as posing an increased level of risk.","CCI-002676":"Defines additional monitoring to be implemented for privileged users.","CCI-002677":"Implement organization-defined additional monitoring of privileged users.","CCI-002678":"Defines additional monitoring to be implemented for individuals during an organization-defined probationary period.","CCI-002679":"Defines the probationary period during which additional monitoring will be implemented for individuals.","CCI-002680":"Implement organization-defined additional monitoring of individuals during an organization-defined probationary period.","CCI-002681":"Defines the authorization or approval process for network services.","CCI-002682":"Defines the personnel or roles to be alerted when unauthorized or unapproved network services are detected.","CCI-002683":"Detect network services that have not been authorized or approved by the organization-defined authorization or approval processes.","CCI-002684":"Audit and/or alert organization-defined personnel when unauthorized network services are detected.","CCI-002685":"Defines the host-based monitoring mechanisms to be implemented at organization-defined system components.","CCI-002686":"Defines the system components at which organization-defined host-based monitoring mechanisms are to be implemented.","CCI-002687":"Implement organization-defined host-based monitoring mechanisms at organization-defined system components.","CCI-002688":"Discover indicators of compromise.","CCI-002689":"Collect indicators of compromise.","CCI-002690":"Distribute indicators of compromise provided by organization-defined sources, to organization-defined personnel or roles.","CCI-002691":"The information system uses indicators of compromise.","CCI-002692":"Defines the external organizations from which it receives information system security alerts, advisories, and directives.","CCI-002693":"Defines the elements within the organization to whom the organization will disseminate security alerts, advisories, and directives.","CCI-002694":"Defines the external organizations to which the organization will disseminate security alerts, advisories, and directives.","CCI-002695":"Defines the security functions that require verification of correct operation.","CCI-002696":"Verify correct operation of organization-defined security functions.","CCI-002697":"Defines the frequency at which it will verify correct operation of organization-defined security functions.","CCI-002698":"Defines the system transitional states when the system will verify correct operation of organization-defined security functions.","CCI-002699":"Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.","CCI-002700":"Defines the personnel or roles to be notified when security verification tests fail.","CCI-002701":"Defines alternative action(s) to be taken when anomalies in the operation of organization-defined security functions are discovered.","CCI-002702":"Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.","CCI-002703":"Defines the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes.","CCI-002704":"Employ integrity verification tools to detect unauthorized changes to organization-defined software, firmware, and information.","CCI-002705":"Defines the software on which integrity checks will be performed.","CCI-002706":"Defines the firmware on which integrity checks will be performed.","CCI-002707":"Defines the information on which integrity checks will be performed.","CCI-002708":"Defines the transitional state or security-relevant events when performing integrity checks on software, firmware, and information.","CCI-002709":"Defines the frequency at which integrity checks of software, firmware, and information will be performed.","CCI-002710":"Perform an integrity check of organization-defined software at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.","CCI-002711":"Perform an integrity check of organization-defined firmware at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.","CCI-002712":"Perform an integrity check of organization-defined information at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.","CCI-002713":"Defines the personnel or roles to be notified when discrepancies are discovered during integrity verification.","CCI-002714":"Defines the controls that are to be employed when integrity violations are discovered.","CCI-002715":"Automatically shut the system down, restart the system, and/or implement organization-defined controls when integrity violations are discovered.","CCI-002716":"Implement cryptographic mechanisms to detect unauthorized changes to software.","CCI-002717":"Implement cryptographic mechanisms to detect unauthorized changes to firmware.","CCI-002718":"Implement cryptographic mechanisms to detect unauthorized changes to information.","CCI-002719":"Defines the unauthorized security-relevant changes to the system that are to be incorporated into the organizational incident response capability.","CCI-002720":"Incorporate the detection of organization-defined security-relevant unauthorized changes into the organizational incident response capability.","CCI-002721":"Defines the personnel or roles that are to be alerted when a potential integrity violation is detected.","CCI-002722":"Defines other actions that can be taken when a potential integrity violation is detected.","CCI-002723":"Upon detection of a potential integrity violation, provides the capability to audit the event.","CCI-002724":"Upon detection of a potential integrity violation, initiate one or more of the following actions: generate an audit record; alert the current user; alert organization-defined personnel or roles; and/or organization-defined other actions.","CCI-002725":"Defines the system component which will have the integrity of the boot process verified.","CCI-002726":"Verify the integrity of the boot process of organization-defined system components.","CCI-002727":"Defines the mechanisms to be implemented to protect the integrity of the boot firmware in organization-defined system components.","CCI-002728":"Defines the system components on which organization-defined mechanisms will be implemented to protect the integrity of the boot firmware.","CCI-002729":"Implement organization-defined mechanisms to protect the integrity of boot firmware in organization-defined system components.","CCI-002730":"The organization defines the user-installed software that is to be executed in a confined physical or virtual machine environment with limited privileges.","CCI-002731":"The organization requires that organization-defined user-installed software execute in a confined physical or virtual machine environment with limited privileges.","CCI-002732":"Defines the user-installed software that is to have its integrity verified prior to execution.","CCI-002733":"Require that the integrity of organization-defined user-installed software be verified prior to execution.","CCI-002734":"Defines the personnel or roles which have the authority to explicitly approve binary or machine-executable code.","CCI-002735":"The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only in confined physical or virtual machine environments.","CCI-002736":"The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only with the explicit approval of organization-defined personnel or roles.","CCI-002737":"The organization prohibits the use of binary or machine-executable code from sources with limited or no warranty and without the provision of source code.","CCI-002738":"The organization provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.","CCI-002739":"Defines the software or firmware components on which cryptographic mechanisms are to be implemented to support authentication prior to installation.","CCI-002740":"Implement cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation.","CCI-002741":"Employ spam protection mechanisms at system entry points to detect and take action on unsolicited messages.","CCI-002742":"Employ spam protection mechanisms at system exit points to detect and take action on unsolicited messages.","CCI-002743":"Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.","CCI-002744":"Defines the inputs on which the system is to conduct validity checks.","CCI-002745":"Defines the inputs defined in base control (SI-10), which provide a manual override capability for input validation.","CCI-002746":"Provide a manual override capability for input validation of organization-defined inputs defined in base control (SI-10).","CCI-002747":"Defines the individuals who have the authorization to use the manual override capability for input validation.","CCI-002748":"Restrict the use of the manual override capability to only organization-defined authorized individuals.","CCI-002749":"Audit the use of the manual override capability.","CCI-002750":"Defines the time-period within which input validation errors are to be reviewed.","CCI-002751":"Defines the time-period within which input validation errors are to be resolved.","CCI-002752":"Review input validation errors within an organization-defined time period.","CCI-002753":"Resolve input validation errors within an organization-defined time period.","CCI-002754":"Verify that the system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.","CCI-002755":"Account for timing interactions among system components in determining appropriate responses for invalid inputs.","CCI-002756":"Defines the trusted sources to which the usage of information inputs will be restricted (e.g., whitelisting).","CCI-002757":"Defines the acceptable formats to which information inputs are restricted.","CCI-002758":"Restrict the use of information inputs to organization-defined trusted sources and/or organization-defined formats.","CCI-002759":"Defines the personnel or roles to whom error messages are to be revealed.","CCI-002760":"Determines mean time to failure (MTTF) for organization-defined system components in specific environments of operation.","CCI-002761":"Defines the system components in specific environments of operation for which the mean time to failure (MTTF) is to be determined.","CCI-002762":"Defines the mean time to failure (MTTF) substitution criteria to be employed as a means to determine the need to exchange active and standby components.","CCI-002763":"Provide a means to exchange active and standby components in accordance with the organization-defined mean time to failure (MTTF) substitution criteria.","CCI-002764":"Defines non-persistent system components and services to be implemented.","CCI-002765":"Defines the frequency at which the organization-defined non-persistent system components and services will be terminated.","CCI-002766":"Implement organization-defined non-persistence system components and services that are initiated in a known state.","CCI-002767":"Implement organization-defined non-persistence system components and services that are terminated upon end of session of use and/or periodically at an organization-defined frequency.","CCI-002768":"Defines the trusted sources from which it obtains software and data employed during the refreshing of non-persistent system components and services.","CCI-002769":"Obtain software and data employed during non-persistent system component and service refreshes are obtained from organization-defined trusted sources.","CCI-002770":"Defines the software programs and/or applications from which the system is to validate the information output to ensure the information is consistent with expected content.","CCI-002771":"Validate information output from organization-defined software programs and/or applications to ensure that the information is consistent with the expected content.","CCI-002772":"The organization defines the security safeguards to be implemented to protect the information system's memory from unauthorized code execution.","CCI-002773":"Defines the fail-safe procedures to be implemented when organization-defined failure conditions occur.","CCI-002774":"Defines the failure conditions which, when they occur, will result in the information system implementing organization-defined fail-safe procedures.","CCI-002775":"Implement organization-defined fail-safe procedures when organization-defined failure conditions occur.","CCI-002776":"Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level incident response policy is disseminated.","CCI-002777":"Defines the personnel or roles to whom the incident response procedures are disseminated.","CCI-002778":"Defines the time period in which system users who assume an incident response role or responsibility receive incident response training.","CCI-002779":"Provide incident response training to system users consistent with assigned roles and responsibilities when required by system changes.","CCI-002780":"Coordinate incident response testing with organizational elements responsible for related plans.","CCI-002781":"Defines the system components for dynamic reconfiguration as part of the incident response capability.","CCI-002782":"Implement an incident handling capability for incidents involving insider threats.","CCI-002783":"The organization coordinates an incident handling capability for insider threats across organization-defined components or elements of the organization.","CCI-002784":"The organization defines components or elements of the organization across which an incident handling capability for insider threats will be coordinated.","CCI-002785":"Coordinate with organization-defined external organizations to correlate and share organization-defined incident information to achieve a cross-organization perspective on incident awareness and more effective incident responses.","CCI-002786":"Defines external organizations with which to correlate and share organization-defined incident information.","CCI-002787":"Defines incident information to correlate and share with organization-defined external organizations.","CCI-002788":"Employ organization-defined dynamic response capabilities to effectively respond to incidents.","CCI-002789":"Defines dynamic response capabilities to effectively respond to incidents.","CCI-002790":"Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.","CCI-002791":"Defines authorities to whom incident information is reported.","CCI-002792":"Defines personnel or roles to whom system vulnerabilities associated with reported incident information are reported.","CCI-002793":"Provide incident information to other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.","CCI-002794":"Develop an incident response plan.","CCI-002795":"Develop an incident response plan that provides the organization with a roadmap for implementing its incident response capability.","CCI-002796":"Develop an incident response plan that describes the structure and organization of the incident response capability.","CCI-002797":"Develop an incident response plan that provides a high-level approach for how the incident response capability fits into the overall organization.","CCI-002798":"Develop an incident response plan that meets the unique requirements of the organization, which relate to mission, size, structure, and functions.","CCI-002799":"Develop an incident response plan that defines reportable incidents.","CCI-002800":"Develop an incident response plan that provides metrics for measuring the incident response capability within the organization.","CCI-002801":"Develop an incident response plan that defines the resources and management support needed to effectively maintain and mature an incident response capability.","CCI-002802":"Defines personnel or roles to review and approve the incident response plan.","CCI-002803":"Defines incident response personnel (identified by name and/or by role) and organizational elements to whom incident response plan changes will be communicated.","CCI-002804":"Protect the incident response plan from unauthorized disclosure and modification.","CCI-002805":"Respond to information spills by identifying the specific information involved in the system contamination.","CCI-002806":"Respond to information spills by alerting organization-defined personnel or roles of the information spill using a method of communication not associated with the spill.","CCI-002807":"Defines the personnel or roles to be alerted of information spills using a method of communication not associated with the spill.","CCI-002808":"Respond to information spills by isolating the contaminated system or system component.","CCI-002809":"Respond to information spills by eradicating the information from the contaminated system or component.","CCI-002810":"Respond to information spills by identifying other systems or system components that may have been subsequently contaminated.","CCI-002811":"Respond to information spills by performing additional organization-defined actions.","CCI-002812":"Defines additional actions required to respond to information spills.","CCI-002813":"The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.","CCI-002814":"The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.","CCI-002815":"The organization defines personnel or roles to whom responsibility for responding to information spills will be assigned.","CCI-002816":"Provide information spillage response training according to an organization-defined frequency.","CCI-002817":"Defines the frequency with which to provide information spillage response training.","CCI-002818":"Implement organization-defined procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.","CCI-002819":"Defines the procedures to be implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.","CCI-002820":"Employ organization-defined controls for personnel exposed to information not within assigned access authorizations.","CCI-002821":"Defines the controls to be employed for personnel exposed to information not within assigned access authorizations.","CCI-002822":"The organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.","CCI-002823":"Defines the controls to be implemented to protect the system memory from unauthorized code execution.","CCI-002824":"Implement organization-defined controls to protect the system memory from unauthorized code execution.","CCI-002825":"Defines the personnel or roles to whom the organizational-level; mission/business process-level; and/or system-level contingency planning policy is to be disseminated.","CCI-002826":"Defines personnel or roles to whom the contingency planning procedures are disseminated.","CCI-002827":"Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.","CCI-002828":"Identify critical system assets supporting all or essential mission functions.","CCI-002829":"Identify critical system assets supporting all or essential business functions.","CCI-002830":"Defines the personnel or roles who review and approve the contingency plan for the system.","CCI-002831":"Defines a list of key contingency personnel (identified by name and/or by role) and organizational elements to whom contingency plan changes are to be communicated.","CCI-002832":"Protects the contingency plan from unauthorized disclosure and modification.","CCI-002833":"Defines the time period that contingency training is to be provided to system users consistent with assigned roles and responsibilities within assuming a contingency role or responsibility.","CCI-002834":"Provide contingency training to system users consistent with assigned roles and responsibilities when required by system changes.","CCI-002835":"Test the contingency plan at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.","CCI-002836":"Ensure that the alternate storage site provides security controls equivalent to that of the primary site.","CCI-002837":"Plan for circumstances that preclude returning to the primary processing site.","CCI-002838":"Prepare for circumstances that preclude returning to the primary processing site.","CCI-002839":"Defines system operations that are permitted to transfer and resume at an alternate processing site for essential missions/business functions when the primary processing capabilities are unavailable.","CCI-002840":"Defines the system operations to be resumed for essential mission functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.","CCI-002841":"Defines the system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.","CCI-002842":"Review provider contingency plans to ensure that the plans meet organizational contingency requirements.","CCI-002843":"Defines the frequency with which to obtain evidence of contingency testing by providers.","CCI-002844":"Defines the frequency with which to obtain evidence of contingency training by providers.","CCI-002845":"Obtain evidence of contingency testing by providers in accordance with organization-defined frequency.","CCI-002846":"Obtain evidence of contingency training by providers in accordance with organization-defined frequency.","CCI-002847":"Defines the frequency with which to test alternate telecommunication services.","CCI-002848":"Test alternate telecommunication services per organization-defined frequency.","CCI-002849":"Defines critical system software and other security-related information, of which backup copies must be stored in a separate facility or in a fire-rated container.","CCI-002850":"Store backup copies of organization-defined critical system software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the operational system.","CCI-002851":"Defines the backup information that requires dual authorization for deletion or destruction.","CCI-002852":"Enforce dual authorization for the deletion or destruction of organization-defined backup information.","CCI-002853":"Provide the capability to employ organization-defined alternative communications protocols in support of maintaining continuity of operations.","CCI-002854":"Defines the alternative communications protocols the system must be capable of providing in support of maintaining continuity of operations.","CCI-002855":"When organization-defined conditions are detected, enters a safe mode of operation with organization-defined restrictions of safe mode of operation.","CCI-002856":"Defines the conditions that, when detected, the system enters a safe mode of operation with organization-defined restrictions of safe mode of operation.","CCI-002857":"Defines the restrictions of the safe mode of operation that the system will enter when organization-defined conditions are detected.","CCI-002858":"Employ organization-defined alternative or supplemental security mechanisms for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.","CCI-002859":"Defines the alternative or supplemental security mechanisms that will be employed for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.","CCI-002860":"Defines the security functions that must be satisfied when the primary means of implementing the security function is unavailable or compromised.","CCI-002861":"Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level maintenance policy is disseminated.","CCI-002862":"Defines the personnel or roles to whom system maintenance procedures are to be disseminated.","CCI-002863":"The organization employs automated mechanisms to schedule, conduct, and document repairs.","CCI-002864":"Produce up-to date, accurate, and complete records of all maintenance requested, scheduled, in process, and completed.","CCI-002865":"Produce up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed.","CCI-002866":"Schedule maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-002867":"The organization performs maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-002868":"Document records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-002869":"Review records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-002870":"Schedule repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-002871":"The organization performs repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-002872":"Document repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-002873":"Review records of repairs on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-002874":"Defines the personnel or roles who can explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repairs or replacement.","CCI-002875":"Include organization-defined information in organizational maintenance records.","CCI-002876":"Defines the information to include in organizational maintenance records.","CCI-002877":"The organization prevents the unauthorized removal of maintenance equipment containing organizational information by verifying that there is no organizational information contained on the equipment.","CCI-002878":"The organization prevents the unauthorized removal of maintenance equipment containing organizational information by sanitizing or destroying the equipment.","CCI-002879":"The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.","CCI-002880":"The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.","CCI-002881":"The organization prevents the unauthorized removal of maintenance equipment containing organizational information by obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.","CCI-002882":"Defines the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility.","CCI-002883":"Restrict the use of maintenance tools to authorized personnel only.","CCI-002884":"Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.","CCI-002885":"Defines the audit events for logged for nonlocal maintenance and diagnostic sessions.","CCI-002886":"Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.","CCI-002887":"Defines the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions.","CCI-002888":"Defines the personnel or roles authorized to approve each nonlocal maintenance session.","CCI-002889":"Notify organization-defined personnel or roles of the date and time of planned nonlocal maintenance.","CCI-002890":"Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.","CCI-002891":"Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.","CCI-002892":"The organization develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.","CCI-002893":"Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorization.","CCI-002894":"Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations.","CCI-002895":"Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.","CCI-002896":"Defines the system components for which it obtains maintenance support and/or spare parts.","CCI-002897":"Defines a time period for obtaining maintenance support and/or spare parts for organization-defined system components after a failure.","CCI-002898":"Perform preventive maintenance on organization-defined information system components at organization-defined time intervals.","CCI-002899":"Defines system components on which to perform preventive maintenance.","CCI-002900":"Defines time intervals at which to perform preventive maintenance on organization-defined system components.","CCI-002901":"Perform predictive maintenance on organization-defined system components at organization-defined intervals.","CCI-002902":"Defines system components on which to perform predictive maintenance.","CCI-002903":"Defines time intervals at which to perform predictive maintenance on organization-defined system components.","CCI-002904":"Transfer predictive maintenance data to a maintenance management system using organization-defined automated mechanisms.","CCI-002905":"The organization employs automated mechanisms to schedule, conduct, and document maintenance.","CCI-002906":"Defines the vulnerability scanning activities in which the system implements privileged access authorization to organization-identified system components.","CCI-002907":"Defines the system mode to be invoked, such as a full system shutdown, a partial system shutdown, or a degraded operational mode with limited mission or business functionality available, in the event of organization-defined audit logging failures.","CCI-002908":"Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy is disseminated.","CCI-002909":"Defines the personnel or roles to whom the physical and environmental protection procedures are disseminated.","CCI-002910":"Approve a list of individuals with authorized access to the facility where the system resides.","CCI-002911":"Maintain a list of individuals with authorized access to the facility where the system resides.","CCI-002912":"Defines a list of acceptable forms of identification for visitor access to the facility where the system resides.","CCI-002913":"Restrict unescorted access to the facility where the system resides to personnel with one or more of the following: security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; organization-defined physical access authorizations.","CCI-002914":"Defines the credentials required for personnel to have unescorted access to the facility where the system resides.","CCI-002915":"Defines the entry and exit points to the facility where the system resides.","CCI-002916":"Defines the physical access control systems or devices or guards that control ingress and egress to the facility where the system resides.","CCI-002917":"Maintain physical access audit logs for organization-defined entry/exit points to the facility where the system resides.","CCI-002918":"Defines entry and exit points to the facility where the system resides that require physical access audit logs be maintained.","CCI-002919":"Control access to areas within the facility designated as publicly accessible by implementing organization-defined access controls.","CCI-002920":"Defines physical access controls to control access to areas within the facility designated as publicly accessible.","CCI-002921":"Escort visitors in the facility where the system resides during organization-defined circumstances requiring visitor escorts.","CCI-002922":"Defines circumstances requiring visitor escorts in the facility where the system resides.","CCI-002923":"Monitor visitor activity in the facility where the system resides during organization-defined circumstances requiring visitor monitoring.","CCI-002924":"Define circumstances requiring visitor monitoring in the facility where the system resides.","CCI-002925":"Defines the physical access devices to inventory.","CCI-002926":"Defines the physical spaces containing one or more components of the system that require physical access authorizations and controls at the facility where the system resides.","CCI-002927":"Defines the frequency with which to perform security checks at the physical boundary of the facility or system for exfiltration of information or removal of system components.","CCI-002928":"Defines anti-tamper technologies to detect and prevent physical tampering or alteration of organization-defined hardware components within the system.","CCI-002929":"Defines hardware components within the system for which to employ organization-defined security safeguards to detect and prevent physical tampering or alteration.","CCI-002930":"Defines system distribution and transmission lines within organizational facilities to control physical access to using organization-defined security controls.","CCI-002931":"Defines security controls to control physical access to organization-defined system distribution and transmission lines within organizational facilities.","CCI-002932":"The organization controls physical access to output from organization-defined output devices.","CCI-002933":"The organization defines output devices for which physical access to output is controlled.","CCI-002934":"The organization ensures that only authorized individuals receive output from organization-defined output devices.","CCI-002935":"The information system controls physical access to output from organization-defined output devices.","CCI-002936":"The information system links individual identity to receipt of output from organization-defined output devices.","CCI-002937":"The organization marks organization-defined information system output devices indicating the appropriate security marking of the information permitted to be output from the device.","CCI-002938":"The organization defines the information system output devices marked indicating the appropriate security marking of the information permitted to be output from the device.","CCI-002939":"Monitor physical access to the facility where the system resides to detect and respond to physical security incidents.","CCI-002940":"Review physical access logs upon occurrence of organization-defined events or potential indications of events.","CCI-002941":"Defines events or potential indications of events requiring review of physical access logs.","CCI-002942":"Recognize organization-defined classes or types of intrusions, using organization-defined automated mechanisms.","CCI-002943":"Defines the classes or types of intrusions to recognize using automated mechanisms.","CCI-002944":"Initiate organization-defined response actions to organization-defined classes or types of intrusions, using organization-defined automated mechanisms.","CCI-002945":"Defines the response actions to initiate when organization-defined classes or types of intrusions are recognized.","CCI-002946":"Employ video surveillance of organization-defined operational areas.","CCI-002947":"Defines the operational areas in which to employ video surveillance.","CCI-002948":"Retain video surveillance recordings for an organization-defined time period.","CCI-002949":"Defines the time period to retain video surveillance recordings.","CCI-002950":"Monitor physical access to the system in addition to the physical access monitoring of the facility as organization-defined physical spaces containing one or more components of the system.","CCI-002951":"Defines physical spaces containing one or more components of the system in which physical access is monitored.","CCI-002952":"Defines the time period to maintain visitor access records to the facility where the system resides.","CCI-002953":"Employ redundant power cabling paths that are physically separated by an organization-defined distance.","CCI-002954":"Defines the distance by which to physically separate redundant power cabling paths.","CCI-002955":"Provide an uninterruptible power supply to facilitate an orderly shutdown of the system, and/or transition of the system to long-term alternate power in the event of a primary power source loss.","CCI-002956":"Provide an alternate power supply for the system that is activated manually or automatically and that is self-contained.","CCI-002957":"Provide an alternate power supply for the system that is activated manually or automatically and that is not reliant on external power generation.","CCI-002958":"Provide an alternate power supply for the system that is activated manually or automatically and that is capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source.","CCI-002959":"Provide emergency lighting for all areas within the facility supporting essential mission functions.","CCI-002960":"Provide emergency lighting for all areas within the facility supporting essential business functions.","CCI-002961":"Employ fire detection systems for the system that activate automatically.","CCI-002962":"Employ fire detection systems for the system that automatically activate to notify organization-defined personnel or roles and organization-defined emergency responders in the event of a fire.","CCI-002963":"Defines the personnel or roles to be notified in the event of a fire.","CCI-002964":"Defines the emergency responders to be notified in the event of a fire.","CCI-002965":"Employ fire suppression systems that activate automatically and notify organization-defined personnel or roles and organization-defined emergency responders.","CCI-002966":"Defines the personnel or roles to be automatically notified of any activation of fire suppression systems.","CCI-002967":"Defines the emergency responders to be automatically notified of any activation of fire suppression systems.","CCI-002968":"Ensure that the facility undergoes, on an organization-defined frequency, fire protection inspections by authorized and qualified inspectors.","CCI-002969":"Defines a frequency with which the facility undergoes fire protection inspections.","CCI-002970":"Ensure the identified deficiencies are resolved within an organization-defined time period.","CCI-002971":"Defines the time period within which to resolve deficiencies identified during facility fire protection inspections.","CCI-002972":"The organization employs automated mechanisms to detect the presence of water in the vicinity of the information system and alerts organization-defined personnel or roles.","CCI-002973":"Defines the personnel or roles to be alerted when automated mechanisms detect the presence of water near the system.","CCI-002974":"Defines types of system components to authorize and control entering and exiting the facility and to maintain records.","CCI-002975":"Defines controls to employ at alternate work sites.","CCI-002976":"Defines physical and environmental hazards that could cause potential damage to system components within the facility.","CCI-002977":"The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards.","CCI-002978":"The organization considers the physical and environmental hazards in its risk mitigation strategy for existing facilities.","CCI-002979":"Employ organization-defined asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.","CCI-002980":"Defines asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.","CCI-002981":"Defines the assets within the organization-defined controlled areas which are to be tracked and monitored for their location and movement.","CCI-002982":"Defines controlled areas where the location and movement of organization-defined assets are tracked and monitored.","CCI-002983":"The organization ensures that asset location technologies are employed in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance.","CCI-002984":"Develop an organization-wide information security program plan that reflects the coordination among organizational entities responsible for information security.","CCI-002985":"Disseminate an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.","CCI-002986":"Disseminate an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-002987":"Disseminate an organization-wide information security plan that reflects the coordination among organizational entities responsible for information security.","CCI-002988":"Disseminate an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.","CCI-002989":"Protect the information security program plan from unauthorized disclosure.","CCI-002990":"Protect the information security program plan from unauthorized modification.","CCI-002991":"Implement a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed.","CCI-002992":"The organization implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems are reported in accordance with OMB FISMA reporting requirements.","CCI-002993":"Review plans of action and milestones for the security program and associated organization systems for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.","CCI-002994":"Review and update the risk management strategy in accordance with organization-defined frequency or as required, to address organizational changes.","CCI-002995":"Defines the frequency with which to review and update the risk management strategy to address organizational changes.","CCI-002996":"Implement an insider threat program that includes a cross-discipline insider threat incident handling team.","CCI-002997":"Establish a security workforce development and improvement program.","CCI-002998":"Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are developed.","CCI-002999":"Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are maintained.","CCI-003000":"Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are developed.","CCI-003001":"Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are maintained.","CCI-003002":"Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems are developed.","CCI-003003":"Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems are maintained.","CCI-003004":"Implement a process for ensuring that organizational plans for conducting security testing associated with organizational systems continue to be executed.","CCI-003005":"Implement a process for ensuring that organizational plans for conducting security training associated with organizational systems continue to be executed.","CCI-003006":"Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems continue to be executed.","CCI-003007":"Review testing plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.","CCI-003008":"Review training plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.","CCI-003009":"Review monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.","CCI-003010":"Establish and institutionalize contact with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel.","CCI-003011":"Establish and institutionalize contact with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies.","CCI-003012":"Establish and institutionalize contact with selected groups and associations within the security community to share current security information including threats, vulnerabilities, and incidents.","CCI-003013":"Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.","CCI-003014":"Enforce organization-defined mandatory access control policies over all subjects and objects.","CCI-003015":"Specifies that organization-defined subjects may explicitly be granted organization-defined privileges such that they are not limited by any defined subset (or all) of the above constraints.","CCI-003016":"The organization, upon termination of individual employment, notifies organization-defined personnel or roles within an organization-defined time period.","CCI-003017":"Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level personnel security policy is disseminated.","CCI-003018":"Defines the personnel or roles to whom the personnel security procedures are disseminated.","CCI-003019":"Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties.","CCI-003020":"Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy organization-defined additional personnel screening criteria.","CCI-003021":"Defines additional personnel screening criteria that individuals accessing a system processing, storing, or transmitting information requiring protection must satisfy.","CCI-003022":"Defines the time period within which to disable system access upon termination of individual employment.","CCI-003023":"Upon termination of individual employment, terminate or revoke any authenticators and credentials associated with the individual.","CCI-003024":"Defines information security topics to be discussed while conducting exit interviews.","CCI-003025":"The organization defines personnel or roles to notify upon termination of individual employment.","CCI-003026":"The organization defines the time period within which to notify organization-defined personnel or roles upon termination of individual employment.","CCI-003027":"Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information.","CCI-003028":"Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.","CCI-003029":"Use organization-defined automated mechanisms to notify organization-defined personnel or roles of individual termination actions; and/or disable access to system resources.","CCI-003030":"Defines the personnel or roles to be notified by automated mechanism of individual termination actions, and/or disable access to system resources.","CCI-003031":"Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.","CCI-003032":"Notify organization-defined personnel or roles within an organization-defined time period when individuals are transferred or reassigned to other positions within the organization.","CCI-003033":"Defines personnel or roles to be notified when individuals are transferred or reassigned to other positions within the organization.","CCI-003034":"Defines the time period within which organization-defined personnel or roles are to be notified when individuals are transferred or reassigned to other positions within the organization.","CCI-003035":"Develop and document access agreements for organizational systems.","CCI-003036":"The organization ensures that individuals requiring access to organizational information and information systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.","CCI-003037":"The organization defines the frequency for individuals requiring access to organization information and information systems to re-sign access agreements.","CCI-003038":"Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information.","CCI-003039":"Require individuals to sign an acknowledgement of legally binding post-employment requirements for protection of organizational information, if applicable, as part of granting initial access to covered information.","CCI-003040":"The organization requires third-party providers to comply with personnel security policies and procedures established by the organization.","CCI-003041":"Require external providers to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within an organization-defined time period.","CCI-003042":"Defines personnel or roles whom external providers are to notify when external personnel who possess organizational credentials and /or badges or who have system privileges are transferred or terminated.","CCI-003043":"Defines the time period for external providers to notify organization-defined personnel or roles when external personnel who possess organizational credentials and/or badges, or who have system privileges are transferred or terminated.","CCI-003044":"Notify organization-defined personnel or roles within an organization-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.","CCI-003045":"Defines personnel or roles who are to be notified when a formal employee sanctions process is initiated.","CCI-003046":"Defines the time period within which to notify organization-defined personnel or roles when a formal employee sanctions process is initiated.","CCI-003047":"Defines the personnel or roles to whom the planning policy is disseminated.","CCI-003048":"Defines the personnel or roles to whom the planning procedures are disseminated.","CCI-003049":"Develop security and privacy plans for the system.","CCI-003050":"Develop security and privacy plans for the system that are consistent with the organization's enterprise architecture.","CCI-003051":"Develop security and privacy plans for the system that explicitly defines the authorization boundary for the system.","CCI-003052":"Develop security and privacy plans for the system that describes the operational context of the system in terms of missions and business processes.","CCI-003053":"Develop security and privacy plans for the system that provide the security categorization of the system, including supporting rationale.","CCI-003054":"Develop security and privacy plans for the system that describe the operational environment for the system and any dependencies on or connections to, other systems or system components.","CCI-003055":"Develop security and privacy plans for the system that provide an overview of the security and privacy requirements for the system.","CCI-003056":"Develop security and privacy plans for the system that identify any relevant control baselines or overlays, if applicable.","CCI-003057":"Develop security and privacy plans for the system that describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions.","CCI-003058":"The organization distributes copies of the security plan to organization-defined personnel or roles.","CCI-003059":"Distribute copies of the plans to organization-defined personnel or roles.","CCI-003060":"Defines the personnel or roles to whom copies of the plans are distributed.","CCI-003061":"Communicate subsequent changes to the plans to organization-defined personnel or roles.","CCI-003062":"Defines the personnel or roles to whom changes to the plans are communicated.","CCI-003063":"Protect the plans from unauthorized disclosure.","CCI-003064":"Protect the plans from unauthorized modification.","CCI-003065":"The organization plans and coordinates security-related activities affecting the information system with organization-defined individuals or groups before conducting such activities in order to reduce the impact on other organizational entities.","CCI-003066":"The organization defines the individuals or groups with whom security-related activities are planned and coordinated.","CCI-003067":"The organization defines the individuals or groups with whom security-related activities are planned and coordinated.","CCI-003068":"Review and update the rules of behavior in accordance with organization-defined frequency.","CCI-003069":"Defines the frequency with which to review and update the rules of behavior.","CCI-003070":"Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge, on an organization-defined frequency, and/or when the rules of behavior are revised or updated.","CCI-003071":"Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security.","CCI-003072":"Develop security architectures for the system.","CCI-003073":"Develop security architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.","CCI-003074":"Develop security architectures for the system that describe how the architectures are integrated into and support the enterprise architecture.","CCI-003075":"Develop security architectures for the system that describe any assumptions about, and dependencies on, external systems and services.","CCI-003076":"Review and update the architectures in accordance with organization-defined frequency to reflect updates in the enterprise architecture.","CCI-003077":"Defines the frequency with which to review and update the system architecture.","CCI-003078":"Reflect planned security architecture changes in the security plans.","CCI-003079":"Reflect planned security architecture changes in the security Concept of Operations (CONOPS).","CCI-003080":"Reflect planned security architecture changes in the security organizational procurements and acquisitions.","CCI-003081":"Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations.","CCI-003082":"Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers.","CCI-003083":"Defines the controls to be allocated to organization-defined locations for the security architecture.","CCI-003084":"Defines the controls to be allocated to organization-defined architectural layers.","CCI-003085":"Defines the locations to which the system allocates organization-defined controls in the security architecture.","CCI-003086":"Defines the architectural layers to which the system allocates organization-defined controls in the security architecture.","CCI-003087":"Design the security architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.","CCI-003088":"Require that organization-defined controls allocated to organization-defined locations and architectural layers be obtained from different suppliers.","CCI-003089":"Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level system and services acquisition policy is disseminated.","CCI-003090":"Defines the personnel or roles to whom procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are disseminated.","CCI-003091":"Determine the high-level information security requirements for the system or system service in mission and business process planning.","CCI-003092":"Defines a system development life cycle that is used to manage the system.","CCI-003093":"Integrate the organizational information security risk management process into system development life cycle activities.","CCI-003094":"Include the security functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the system, system component, or system service.","CCI-003095":"Include the strength of mechanism requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-003096":"Include the security assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-003097":"Include the security documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-003098":"Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-003099":"Include the description of the system development environment and environment in which the system is intended to operate, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-003100":"Include the acceptance criteria, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-003101":"Require the developer of the system, system component, or system service to provide design information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined design information at an organization-defined level of detail.","CCI-003102":"Require the developer of the system, system component, or system service to provide implementation information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined implementation information at an organization-defined level of detail.","CCI-003103":"Defines the design information that the developer of the system, system component, or system service is required to provide for the controls to be designed.","CCI-003104":"Defines the implementation information that the developer of the system, system component, or system service is required to provide for the security controls to be implemented.","CCI-003105":"Defines the level of detail for the design information of the controls that is required to be provided by the developer of the information system, system component, or information system services.","CCI-003106":"Defines the level of detail for the implementation information of the security controls that is required to be provided by the developer of the information system, system component, or information system services.","CCI-003107":"The organization requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes organization-defined state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes.","CCI-003108":"The organization defines the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service is required to include when demonstrating the use of a system development life cycle.","CCI-003109":"Require the developer of the system, system component, or system service to deliver the system, component, or service with organization-defined security configurations implemented.","CCI-003110":"Defines the security configurations required to be implemented when the developer delivers the system, system component, or system service.","CCI-003111":"Requires the developer of the system, system component, or system service to use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade.","CCI-003112":"Require the developer of the system, system component, or system service to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.","CCI-003113":"The organization defines the level of detail to be contained in the plan for the continuous monitoring of security control effectiveness that the developer of the information system, system component, or information system services is required to produce.","CCI-003114":"Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.","CCI-003115":"The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.","CCI-003116":"Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.","CCI-003117":"Centrally manage organization-defined controls and related processes.","CCI-003118":"Defines the controls and related processes to be centrally managed.","CCI-003119":"Employ a technical surveillance countermeasures survey at organization-defined locations on an organization-defined frequency or when organization-defined events or indicators occur.","CCI-003120":"Defines the locations where technical surveillance countermeasures surveys are to be employed.","CCI-003121":"Defines the frequency on which to employ technical surveillance countermeasures surveys.","CCI-003122":"Defines the events or indicators upon which technical surveillance countermeasures surveys are to be employed.","CCI-003123":"Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.","CCI-003124":"Obtain or develop administrator documentation for the system, system component, or system service that describes secure configuration of the system, component, or service.","CCI-003125":"Obtain or develop administrator documentation for the system, system component, or system service that describes secure installation of the system, component, or service.","CCI-003126":"Obtain or develop administrator documentation for the system, system component, or system service that describes secure operation of the system, component, or service.","CCI-003127":"Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of security functions and mechanisms.","CCI-003128":"Obtain or develop administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding configuration and use of administrative or privileged functions.","CCI-003129":"Obtain or develop user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms and how to effectively use those functions and mechanisms.","CCI-003130":"Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to use the system, component, or service in a more secure manner.","CCI-003131":"Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the security of the system, component, or service.","CCI-003132":"Take organization-defined actions in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service.","CCI-003133":"Defines actions to be taken in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service.","CCI-003134":"The organization protects information system, system component, or information system service documentation as required, in accordance with the risk management strategy.","CCI-003135":"Distribute system, system component, or system service documentation to organization-defined personnel or roles.","CCI-003136":"Defines the personnel or roles to whom system, system component, or system service documentation is to be distributed.","CCI-003137":"The organization defines security controls that providers of external information system services employ in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.","CCI-003138":"Employ organization-defined processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis.","CCI-003139":"Defines processes, methods, and techniques to employ to monitor control compliance by external service providers on an ongoing basis.","CCI-003140":"Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services.","CCI-003141":"Verify that the acquisition or outsourcing of dedicated information security services is approved by organization-defined personnel or roles.","CCI-003142":"Defines the personnel or roles authorized to approve the acquisition or outsourcing of dedicated information security services.","CCI-003143":"Require providers of organization-defined external system services to identify the functions, ports, protocols, and other services required for the use of such services.","CCI-003144":"Defines the external system services for which the providers are required to identify the functions, ports, protocols, and other services required for the use of such services.","CCI-003145":"Establish trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.","CCI-003146":"Document trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.","CCI-003147":"Maintain trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.","CCI-003148":"Defines security requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.","CCI-003149":"Take organization-defined actions to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests.","CCI-003150":"Defines the actions taken to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests.","CCI-003151":"Defines external service providers whose interests are consistent with and reflect organizational interests.","CCI-003152":"Restrict the location of information processing, information or data, and/or system services to organization-defined locations based on organization-defined requirements or conditions.","CCI-003153":"Defines the locations for which to restrict information processing, information or data, and/or system services based on organization-defined requirements or conditions.","CCI-003154":"Defines the requirements or conditions on which to base restricting the location of information processing, information or data, and/or system services to organization-defined locations.","CCI-003155":"Require the developer of the system, system component, or system service to perform configuration management during system, component, or service design, development, implementation, operation and/or disposal.","CCI-003156":"Require the developer of the system, system component, or system service to document the integrity of changes to organization-defined configuration items under configuration management.","CCI-003157":"Require the developer of the system, system component, or system service to manage the integrity of changes to organization-defined configuration items under configuration management.","CCI-003158":"Require the developer of the system, system component, or system service to control the integrity of changes to organization-defined configuration items under configuration management.","CCI-003159":"Defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.","CCI-003160":"Require the developer of the system, system component, or system service to document the potential security impacts of approved changes to the system, component, or service.","CCI-003161":"Require the developer of the system, system component, or system service to track security flaws within the system, component, or service.","CCI-003162":"Require the developer of the system, system component, or system service to track flaw resolution within the system, component, or service.","CCI-003163":"Require the developer of the system, system component, or system service to report findings of security flaws and flaw resolution within the system, component, or service to organization-defined personnel.","CCI-003164":"Defines the personnel to whom security flaw findings and flaw resolution within the system, component, or service are reported.","CCI-003165":"Require the developer of the system, system component, or system service to enable integrity verification of hardware components.","CCI-003166":"Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions.","CCI-003167":"Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of source code with previous versions.","CCI-003168":"Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of object code with previous versions.","CCI-003169":"Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.","CCI-003170":"Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.","CCI-003171":"Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing security control assessment.","CCI-003172":"Require the developer of the system, system component, or system service to implement a plan for ongoing security control assessment.","CCI-003173":"Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency, at an organization-defined depth and coverage.","CCI-003174":"Defines the depth and coverage at which to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency.","CCI-003175":"Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce evidence of the execution of the assessment plan.","CCI-003176":"Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce the results of the testing and evaluation.","CCI-003177":"Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to implement a verifiable flaw remediation process.","CCI-003178":"Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to correct flaws identified during testing/evaluation.","CCI-003179":"Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws.","CCI-003180":"Require the developer of the system, system component, or system service to document the results of static code analysis.","CCI-003181":"Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development.","CCI-003182":"Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analysis during subsequent testing and evaluation of the system, component, or service.","CCI-003183":"Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer security assessment plan.","CCI-003184":"Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during security testing and evaluation.","CCI-003185":"Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing and evaluation.","CCI-003186":"Verify that the independent agent either is provided with sufficient information to complete the verification process or has been granted the authority to obtain such information.","CCI-003187":"Require the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code using organization-defined processes, procedures, and/or techniques.","CCI-003188":"Defines the specific code for which the developer of the system, system component, or system service is required to perform a manual code review using organization-defined process, procedures, and/or techniques.","CCI-003189":"Defines the processes, procedures, and/or techniques to be used by the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code.","CCI-003190":"The organization requires the developer of the information system, system component, or information system service to perform penetration testing at an organization-defined breadth/depth and with organization-defined constraints.","CCI-003191":"Defines the breadth and depth at which the developer of the system, system component, or system service is required to perform penetration testing.","CCI-003192":"Defines the constraints on penetration testing performed by the developer of the system, system component, or system service.","CCI-003193":"Require the developer of the system, system component, or system service to perform attack surface reviews.","CCI-003194":"Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of required controls at an organization-defined depth of testing and evaluation.","CCI-003195":"Defines the depth of testing and evaluation to which the developer of the system, system component, or system service is required to verify that the scope of security testing and evaluation provides complete coverage of the required controls.","CCI-003196":"Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws.","CCI-003197":"Require the developer of the system, system component, or system service to document the results of the dynamic code analysis.","CCI-003198":"The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.","CCI-003199":"The organization defines tailored acquisition strategies, contract tools, and procurement methods to employ for the purchase of the information system, system component, or information system service from suppliers.","CCI-003200":"The organization conducts a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service.","CCI-003201":"The organization employs organization-defined security safeguards to limit harm from potential adversaries identifying and targeting the organizational supply chain.","CCI-003202":"The organization defines security safeguards to employ to limit harm from potential adversaries identifying and targeting the organizational supply chain.","CCI-003203":"The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update.","CCI-003204":"The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update.","CCI-003205":"The organization uses all-source intelligence analysis of suppliers and potential suppliers of the information system, system component, or information system service.","CCI-003206":"The organization employs organization-defined Operations Security (OPSEC) safeguards in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.","CCI-003207":"The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.","CCI-003208":"The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.","CCI-003209":"The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.","CCI-003210":"The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.","CCI-003211":"The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.","CCI-003212":"The organization employs organization-defined security safeguards to validate that the information system or system component received is genuine and has not been altered.","CCI-003213":"The organization defines the security safeguards to be employed to validate that the information system or system component received is genuine and has not been altered.","CCI-003214":"The organization employs organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of organization-defined supply chain elements, processes, and actors associated with the information system, system component, or information system service.","CCI-003215":"The organization defines the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing.","CCI-003216":"The organization establishes inter-organizational agreements with entities involved in the supply chain for the information system, system component, or information system service.","CCI-003217":"The organization establishes inter-organizational procedures with entities involved in the supply chain for the information system, system component, or information system service.","CCI-003218":"The organization employs organization-defined security safeguards to ensure an adequate supply of organization-defined critical information system components.","CCI-003219":"The organization defines the security safeguards to be employed to ensure an adequate supply of organization-defined critical information system components.","CCI-003220":"The organization defines the critical information system components for which organization-defined security safeguards are employed to ensure adequate supply.","CCI-003221":"The organization establishes unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service.","CCI-003222":"The organization retains unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service.","CCI-003223":"The organization defines the supply chain elements, processes, and actors for the information system, system component, or information system service to establish and retain unique identification.","CCI-003224":"The organization establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements.","CCI-003225":"The organization describes the trustworthiness required in the organization-defined information system, information system component, or information system service supporting its critical missions/business functions.","CCI-003226":"The organization defines the information system, information system component, or information system service supporting its critical missions/business functions in which the trustworthiness must be described.","CCI-003227":"The organization implements an organization-defined assurance overlay to achieve trustworthiness required to support its critical missions/business functions.","CCI-003228":"The organization defines an assurance overlay to be implemented to achieve trustworthiness required to support its critical missions/business functions.","CCI-003229":"The organization identifies critical information system components by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle.","CCI-003230":"The organization identifies critical information system functions by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle.","CCI-003231":"The organization defines the information systems, information system components, or information system services for which the organization identifies critical information system components and functions for criticality analysis.","CCI-003232":"The organization defines the decision points in the system development life cycle at which to perform a criticality analysis to identify critical information system components and functions for organization-defined information systems, information system components, or information system services.","CCI-003233":"Require the developer of the system, system component, or system service to follow a documented development process.","CCI-003234":"Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses security requirements.","CCI-003235":"Require the developer of the system, system component, or system service to follow a documented development process that identifies the standards used in the development process.","CCI-003236":"Require the developer of the system, system component, or system service to follow a documented development process that identifies the tools used in the development process.","CCI-003237":"Require the developer of the system, system component, or system service to follow a documented development process that documents the specific tool options and tool configurations used in the development process.","CCI-003238":"Require the developer of the system, system component, or system service to follow a documented development process that documents changes to the process and/or tools used in development.","CCI-003239":"Require the developer of the system, system component, or system service to follow a documented development process that manages changes to the process and/or tools used in development.","CCI-003240":"Require the developer of the system, system component, or system service to follow a documented development process that ensures the integrity of changes to the process and/or tools used in development.","CCI-003241":"Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined security requirements.","CCI-003242":"Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined security requirements.","CCI-003243":"Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined security requirements.","CCI-003244":"Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined security requirements.","CCI-003245":"Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined security requirements.","CCI-003246":"Defines the security requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations.","CCI-003247":"Require the developer of the system, system component, or system service to define quality metrics at the beginning of the development process.","CCI-003248":"Require the developer of the system, system component, or system service to provide evidence of meeting the quality metrics in accordance with organization-defined frequency, organization-defined program review milestones, and/or upon delivery.","CCI-003249":"Defines the frequency on which the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics.","CCI-003250":"Defines the program review milestones at which the developer of the information system, system component, or information system service is required to provide evidence of meeting the quality metrics.","CCI-003251":"Require the developer of the system, system component, or system service to select a security tracking tool for use during the development process.","CCI-003252":"Require the developer of the system, system component, or system service to employ a security tracking tool for use during the development process.","CCI-003253":"The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at an organization-defined breadth/depth and at organization-defined decision points in the system development life cycle.","CCI-003254":"Defines the breadth/depth of criticality analysis at which the developer of the system, system component, or system service is required to perform a criticality analysis.","CCI-003255":"Defines decision points in the system development life cycle at which the developer of the system, system component, or system service is required to perform a criticality analysis.","CCI-003256":"The organization requires that developers perform threat modeling for the information system at an organization-defined breadth/depth.","CCI-003257":"The organization requires that developers perform a vulnerability analysis for the information system at an organization-defined breadth/depth.","CCI-003258":"The organization defines the breadth/depth at which threat modeling for the information system must be performed by developers.","CCI-003259":"The organization defines the breadth/depth at which vulnerability analysis for the information system must be performed by developers.","CCI-003260":"Threat modeling performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.","CCI-003261":"Vulnerability analysis performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.","CCI-003262":"The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform threat modeling for the information system by the developer.","CCI-003263":"The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform a vulnerability analysis for the information system by the developer.","CCI-003264":"The organization requires the threat modeling performed by the developers employ organization-defined tools and methods.","CCI-003265":"The organization requires the vulnerability analysis performed by the developers employ organization-defined tools and methods.","CCI-003266":"The organization defines tools and methods to be employed to perform threat modeling for the information system by the developer.","CCI-003267":"The organization defines tools and methods to be employed to perform a vulnerability analysis for the information system by the developer.","CCI-003268":"The organization requires that developers performing threat modeling for the information system produce evidence that meets organization-defined acceptance criteria.","CCI-003269":"The organization requires that developers performing vulnerability analysis for the information system produce evidence that meets organization-defined acceptance criteria.","CCI-003270":"The organization defines the acceptance criteria that must be met when threat modeling of the information system is performed by the developer.","CCI-003271":"The organization defines the acceptance criteria that must be met when vulnerability analysis of the information system is performed by the developer.","CCI-003272":"Require the developer of the system, system component, or system service to reduce attack surfaces to organization-defined thresholds.","CCI-003273":"Defines the thresholds to which the developer of the system, system component, or system service is required to reduce attack surfaces.","CCI-003274":"Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.","CCI-003275":"Require the developer of the system, system component, or system services, on an organization-defined frequency, to perform an automated vulnerability analysis using organization-defined tools.","CCI-003276":"Defines the tools the developer of the system, system component, or system services uses to perform an automated vulnerability analysis.","CCI-003277":"Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine the exploitation potential for discovered vulnerabilities.","CCI-003278":"Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine potential risk mitigations for delivered vulnerabilities.","CCI-003279":"Require the developer of the system, system component, or system services, on an organization-defined frequency, to deliver the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles.","CCI-003280":"Defines the personnel or roles to whom the outputs of the tools and results of the vulnerability analysis are delivered.","CCI-003281":"Require the developer of the system, system component, or system service to use threat modeling from similar systems, components, or services to inform the current development process.","CCI-003282":"Require the developer of the system, system component, or system service to use vulnerability analysis from similar systems, components, or services to inform the current development process.","CCI-003283":"The organization approves the use of live data in development environments for the information system, system component, or information system service.","CCI-003284":"The organization approves the use of live data in test environments for the information system, system component, or information system service.","CCI-003285":"The organization documents the use of live data in development environments for the information system, system component, or information system service.","CCI-003286":"The organization documents the use of live data in test environments for the information system, system component, or information system service.","CCI-003287":"The organization controls the use of live data in development environments for the information system, system component, or information system service.","CCI-003288":"The organization controls the use of live data in test environments for the information system, system component, or information system service.","CCI-003289":"Require the developer of the system, system component, or system service to provide an incident response plan.","CCI-003290":"Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review.","CCI-003291":"Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented security functions, controls, and/or mechanisms.","CCI-003292":"Defines the training the developer of the system, system component, or system service is required to provide on the correct use and operation of the implemented security functions, controls, and/or mechanisms.","CCI-003293":"Require the developer of the system, system component, or system service to produce a design specification and security architecture.","CCI-003294":"Require the developer of the system, system component, or system service to produce a design specification and security architecture that is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture.","CCI-003295":"Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the required security functionality.","CCI-003296":"Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the allocation of security controls among physical and logical components.","CCI-003297":"Require the developer of the system, system component, or system service to produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.","CCI-003298":"Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational security policy to be enforced.","CCI-003299":"Defines the elements of organizational security policy to be described in the formal policy model for enforcement on the system, system component, or system service.","CCI-003300":"Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.","CCI-003301":"Require the developer of the system, system component, or system service to define security-relevant hardware.","CCI-003302":"The organization requires the developer of the information system, system component, or information system service to define security-relevant hardware.","CCI-003303":"Require the developer of the system, system component, or system service to define security-relevant software.","CCI-003304":"Require the developer of the system, system component, or system service to define security-relevant firmware.","CCI-003305":"Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant hardware is complete.","CCI-003306":"Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant software is complete.","CCI-003307":"Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant firmware is complete.","CCI-003308":"Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.","CCI-003309":"Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.","CCI-003310":"Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.","CCI-003311":"Require the developer of the system, system component, or system service to show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model.","CCI-003312":"Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware.","CCI-003313":"Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant software.","CCI-003314":"Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant firmware.","CCI-003315":"Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware.","CCI-003316":"Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant software.","CCI-003317":"Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant firmware.","CCI-003318":"Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware.","CCI-003319":"Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant software.","CCI-003320":"Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant firmware.","CCI-003321":"Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.","CCI-003322":"Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.","CCI-003323":"Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.","CCI-003324":"Require the developer of the system, system component, or system service to show via informal demonstration or convincing argument with formal methods as feasible that the descriptive top-level specification is consistent with the formal policy model.","CCI-003325":"Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware.","CCI-003326":"Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant software.","CCI-003327":"Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant firmware.","CCI-003328":"Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware.","CCI-003329":"Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant software.","CCI-003330":"Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware.","CCI-003331":"Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware.","CCI-003332":"Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant software.","CCI-003333":"Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant firmware.","CCI-003334":"Require the developer of the system, system component, or system service to design and structure the security-relevant hardware to use a complete, conceptually simple protection mechanism with precisely defined semantics.","CCI-003335":"Require the developer of the system, system component, or system service to design and structure the security-relevant software to use a complete, conceptually simple protection mechanism with precisely defined semantics.","CCI-003336":"Require the developer of the system, system component, or system service to design and structure the security-relevant firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.","CCI-003337":"Require the developer of the system, system component, or system service to internally structure the security-relevant hardware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.","CCI-003338":"Require the developer of the system, system component, or system service to internally structure the security-relevant software with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.","CCI-003339":"Require the developer of the system, system component, or system service to internally structure the security-relevant firmware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.","CCI-003340":"Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate testing.","CCI-003341":"Require the developer of the system, component, or system service to structure security-relevant software to facilitate testing.","CCI-003342":"Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate testing.","CCI-003343":"Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate controlling access with least privilege.","CCI-003344":"Require the developer of the system, component, or system service to structure security-relevant software to facilitate controlling access with least privilege.","CCI-003345":"Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate controlling access with least privilege.","CCI-003346":"The organization implements a tamper protection program for the information system, system component, or information system service.","CCI-003347":"The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including design.","CCI-003348":"The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including development.","CCI-003349":"The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including integration.","CCI-003350":"The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including operations.","CCI-003351":"The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including maintenance.","CCI-003352":"The organization inspects organization-defined information systems, system components, or devices at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.","CCI-003353":"The organization defines the information systems, system components, or devices to inspect at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.","CCI-003354":"The organization defines the frequency on which to inspect organization-defined information systems, system components, or devices to detect tampering.","CCI-003355":"The organization defines indications of need for inspection to detect tampering during inspections of organization-defined information systems, system components, or devices.","CCI-003356":"The organization develops an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.","CCI-003357":"The organization develops an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.","CCI-003358":"The organization develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.","CCI-003359":"The organization develops anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.","CCI-003360":"The organization implements an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.","CCI-003361":"The organization implements an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.","CCI-003362":"The organization implements anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.","CCI-003363":"The organization implements anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.","CCI-003364":"The organization reports counterfeit information system components to the source of the counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles.","CCI-003365":"The organization defines the external reporting organizations to which counterfeit information system components are to be reported.","CCI-003366":"The organization defines the personnel or roles to whom counterfeit information system components are to be reported.","CCI-003367":"The organization trains organization-defined personnel or roles to detect counterfeit information system components (including hardware, software, and firmware).","CCI-003368":"The organization defines the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware).","CCI-003369":"The organization maintains configuration control over organization-defined information system components awaiting service/repair.","CCI-003370":"The organization defines the information system components awaiting service/repair over which configuration control must be maintained.","CCI-003371":"The organization maintains configuration control over serviced/repaired components awaiting return to service.","CCI-003372":"Define the support from external providers to be provided for alternative sources for continued support for unsupported system components.","CCI-003373":"Provide in-house support and/or organization-defined support from external providers for alternative sources for continued support for unsupported components.","CCI-003374":"The organization documents approval for the continued use of unsupported system components required to satisfy mission/business needs.","CCI-003375":"The organization provides justification for the continued use of unsupported system components required to satisfy mission/business needs.","CCI-003376":"Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.","CCI-003377":"The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied.","CCI-003378":"The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied.","CCI-003379":"The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required screening criteria are satisfied.","CCI-003380":"The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required access authorizations are satisfied.","CCI-003381":"Defines additional personnel screening criteria that must be satisfied by the developer of an organization-defined system, system component, or system service.","CCI-003382":"Require that the developer of an organization-defined system, system component, or system service satisfies organization-defined additional personnel screening criteria.","CCI-003383":"Defines the official government duties to be assigned to the developer of an organization-defined system, system component, or system service.","CCI-003384":"Defines the system, system component, or system service which requires the system developer to have appropriate access authorizations, satisfy additional personnel screening criteria, and provide information that the access authorizations and screening criteria are satisfied.","CCI-003385":"Require that the developer of an organization-defined system, system component, or system service has appropriate access authorizations as determined by assigned organization-defined official government duties.","CCI-003386":"Defines the critical system components to re-implement or custom develop.","CCI-003387":"Re-implement or custom develops organization-defined critical system components.","CCI-003388":"The organization defines the frequency on which to scan for counterfeit information system components.","CCI-003389":"The organization scans for counterfeit information system components in accordance with organization-defined frequency.","CCI-003390":"The organization defines the techniques and methods used to dispose of information system components.","CCI-003391":"The organization disposes of information system components using organization-defined techniques and methods.","CCI-003392":"The organization determines and documents the legal authority that permits the collection of personally identifiable information (PII), either generally or in support of a specific program or information system need.","CCI-003393":"The organization determines and documents the legal authority that permits the use of personally identifiable information (PII), either generally or in support of a specific program or information system need.","CCI-003394":"The organization determines and documents the legal authority that permits the maintenance of personally identifiable information (PII), either generally or in support of a specific program or information system need.","CCI-003395":"The organization determines and documents the legal authority that permits the sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need.","CCI-003396":"The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is collected.","CCI-003397":"The organization appoints a Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) accountable for developing, implementing, and maintaining an organization-wide governance and privacy program to ensure compliance with all applicable laws and regulations regarding the collection, use, maintenance, sharing, and disposal of personally identifiable information (PII) by programs and information systems.","CCI-003398":"The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is used.","CCI-003399":"The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is maintained.","CCI-003400":"The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is shared.","CCI-003401":"The organization monitors federal privacy laws and policy for changes that affect the privacy program.","CCI-003402":"The organization defines the allocation of budget resources sufficient to implement and operate the organization-wide privacy program.","CCI-003403":"The organization defines the allocation of staffing resources sufficient to implement and operate the organization-wide privacy program.","CCI-003404":"The organization allocates sufficient organization-defined budget resources to implement and operate the organization-wide privacy program.","CCI-003405":"The organization allocates sufficient organization-defined staffing resources to implement and operate the organization-wide privacy program.","CCI-003406":"The organization develops a strategic organizational privacy plan for implementing applicable privacy controls, policies, and procedures.","CCI-003407":"The organization develops operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).","CCI-003408":"The organization disseminates operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).","CCI-003409":"The organization implements operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).","CCI-003410":"The organization develops operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).","CCI-003411":"The organization disseminates operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).","CCI-003412":"The organization implements operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).","CCI-003413":"The organization defines the frequency, minimally biennially, on which the privacy plan, policies, and procedures are to be updated.","CCI-003414":"The organization updates the privacy plan per organization-defined frequency.","CCI-003415":"The organization updates the privacy policies per organization-defined frequency.","CCI-003416":"The organization updates the privacy procedures per organization-defined frequency.","CCI-003417":"The organization documents a privacy risk management process which assesses the privacy risk to individuals.","CCI-003418":"The organization implements a privacy risk management process which assesses the privacy risk to individuals.","CCI-003419":"The organization's privacy risk management process assesses the privacy risk to individuals resulting from the collection of personally identifiable information (PII).","CCI-003420":"The organization's privacy risk management process assesses the privacy risk to individuals resulting from the sharing of personally identifiable information (PII).","CCI-003421":"The organization's privacy risk management process assesses the privacy risk to individuals resulting from the storing of personally identifiable information (PII).","CCI-003422":"The organization's privacy risk management process assesses the privacy risk to individuals resulting from the transmitting of personally identifiable information (PII).","CCI-003423":"The organization's privacy risk management process assesses the privacy risk to individuals resulting from the use of personally identifiable information (PII).","CCI-003424":"The organization's privacy risk management process assesses the privacy risk to individuals resulting from the disposal of personally identifiable information (PII).","CCI-003425":"The organization conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.","CCI-003426":"The organization establishes privacy roles for contractors.","CCI-003427":"The organization establishes privacy responsibilities for contractors.","CCI-003428":"The organization establishes access requirements for contractors.","CCI-003429":"The organization establishes privacy roles for service providers.","CCI-003430":"The organization establishes privacy responsibilities for service providers.","CCI-003431":"The organization establishes access requirements for service providers.","CCI-003432":"The organization includes privacy requirements in contracts.","CCI-003433":"The organization includes privacy requirements in other acquisition-related documents.","CCI-003434":"The organization defines the frequency for monitoring privacy controls and internal privacy policy to ensure effective implementation.","CCI-003435":"The organization defines the frequency for auditing privacy controls and internal privacy policy to ensure effective implementation.","CCI-003436":"The organization monitors privacy controls, per organization-defined frequency, to ensure effective implementation.","CCI-003437":"The organization monitors internal privacy policy to ensure effective implementation.","CCI-003438":"The organization audits privacy controls, per organization-defined frequency, to ensure effective implementation.","CCI-003439":"The organization audits internal privacy policy, per organization-defined frequency, to ensure effective implementation.","CCI-003440":"The organization develops a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.","CCI-003441":"The organization implements a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.","CCI-003442":"The organization updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.","CCI-003443":"The organization defines the frequency, minimally annually, for administering its basic privacy training.","CCI-003444":"The organization defines the frequency, minimally annually, for administering the targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII.","CCI-003445":"The organization administers basic privacy training per the organization-defined frequency.","CCI-003446":"The organization administers, per organization-defined frequency, targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII.","CCI-003447":"The organization defines the frequency, minimally annually, on which personnel certify acceptance of responsibilities for privacy requirements.","CCI-003448":"The organization ensures personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements per organization-defined frequency.","CCI-003449":"The organization develops reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.","CCI-003450":"The organization disseminates reports to the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.","CCI-003451":"The organization updates reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.","CCI-003452":"The organization develops reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.","CCI-003453":"The organization disseminates reports to senior management and other personnel with responsibility for monitoring privacy program progress and compliance.","CCI-003454":"The organization updates reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.","CCI-003455":"The organization designs information systems to support privacy by automating privacy controls.","CCI-003456":"The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the date of each disclosure of a record.","CCI-003457":"The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the nature of each disclosure of a record.","CCI-003458":"The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the purpose of each disclosure of a record.","CCI-003459":"The organization keeps an accurate accounting of disclosures of Privacy Act information held in each system of records under its control.","CCI-003460":"The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the name and address of the person or agency to which the disclosure was made.","CCI-003461":"The organization retains the accounting of disclosures for the life of the record or five years after the disclosure is made, whichever is longer.","CCI-003462":"The organization makes the accounting of disclosures available to the person named in the record upon request.","CCI-003463":"The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the accuracy of that information.","CCI-003464":"The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the relevancy of that information.","CCI-003465":"The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the timeliness of that information.","CCI-003466":"The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the completeness of that information.","CCI-003467":"The organization collects personally identifiable information (PII) directly from the individual to the greatest extent practicable.","CCI-003468":"The organization defines the frequency on which it will check for, and correct as necessary, inaccurate or outdated personally identifiable information (PII) used by its programs or systems.","CCI-003469":"The organization checks for, and corrects as necessary, any inaccurate or outdated personally identifiable information (PII) used by its programs or systems on an organization-defined frequency.","CCI-003470":"The organization issues guidelines ensuring the quality of disseminated Privacy Act information.","CCI-003471":"The organization issues guidelines ensuring the utility of disseminated Privacy Act information.","CCI-003472":"The organization issues guidelines ensuring the objectivity of disseminated Privacy Act information.","CCI-003473":"The organization issues guidelines ensuring the integrity of disseminated Privacy Act information.","CCI-003474":"The organization issues guidelines maximizing the quality of disseminated Privacy Act information.","CCI-003475":"The organization issues guidelines maximizing the utility of disseminated Privacy Act information.","CCI-003476":"The organization issues guidelines maximizing the objectivity of disseminated Privacy Act information.","CCI-003477":"The organization issues guidelines maximizing the integrity of disseminated Privacy Act information.","CCI-003478":"The organization requests the individual or individual's authorized representative validate personally identifiable information (PII) during the collection process.","CCI-003479":"The organization defines the frequency on which it will request the individual, or individual's authorized representative, revalidate that personally identifiable information (PII) collected is still accurate.","CCI-003480":"On an organization-defined frequency, the organization requests the individual, or individual's authorized representative, revalidate that personally identifiable information (PII) collected is still accurate.","CCI-003481":"The organization documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls.","CCI-003482":"The organization, when appropriate, establishes a Data Integrity Board.","CCI-003483":"The organization's Data Integrity Board oversees the organizational Computer Matching Agreements.","CCI-003484":"The organization's Data Integrity Board ensures the Computer Matching Agreements comply with the computer matching provisions of the Privacy Act.","CCI-003485":"The organization publishes Computer Matching Agreements on its public website.","CCI-003486":"The organization identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection.","CCI-003487":"The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes described in the published privacy notice.","CCI-003488":"The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes which the individual has provided consent.","CCI-003489":"The organization defines the frequency, minimally annually, for conducting reviews of its personally identifiable information (PII) holdings.","CCI-003490":"The organization conducts an initial evaluation of personally identifiable information (PII) holdings.","CCI-003491":"The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained.","CCI-003492":"The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained.","CCI-003493":"The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose.","CCI-003494":"The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose.","CCI-003495":"The organization, where feasible and within the limits of technology, locates and removes/redacts specified personally identifiable information (PII).","CCI-003496":"The organization, where feasible and within the limits of technology, uses anonymization and de-identification techniques to permit use of the retained Privacy Act information while reducing its sensitivity and reducing the risk resulting from disclosure.","CCI-003497":"The organization defines the time period for retaining each collection of personally identifiable information (PII) that is required to fulfill the purpose(s) identified in the published privacy notice or required by law.","CCI-003498":"The organization retains each collection of personally identifiable information (PII) for the organization-defined time period to fulfill the purpose(s) identified in the published privacy notice or as required by law.","CCI-003499":"The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in accordance with a NARA-approved record retention schedule.","CCI-003500":"The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in a manner that prevents loss, theft, misuse, or unauthorized access.","CCI-003501":"The organization defines the techniques or methods to be employed to ensure the secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records).","CCI-003502":"The organization uses organization-defined techniques or methods to ensure secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records).","CCI-003503":"The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is collected, created, or updated.","CCI-003504":"The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is created.","CCI-003505":"The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is updated.","CCI-003506":"The organization, where feasible, configures its information systems to record when personally identifiable information (PII) is to be deleted or archived under an approved record retention schedule.","CCI-003507":"The organization develops policies that minimize the use of personally identifiable information (PII) for testing.","CCI-003508":"The organization develops policies that minimize the use of personally identifiable information (PII) for training.","CCI-003509":"The organization develops policies that minimize the use of personally identifiable information (PII) for research.","CCI-003510":"The organization develops procedures that minimize the use of personally identifiable information (PII) for testing.","CCI-003511":"The organization develops procedures that minimize the use of personally identifiable information (PII) for training.","CCI-003512":"The organization develops procedures that minimize the use of personally identifiable information (PII) for research.","CCI-003513":"The organization implements controls to protect personally identifiable information (PII) used for testing.","CCI-003514":"The organization implements controls to protect personally identifiable information (PII) used for training.","CCI-003515":"The organization implements controls to protect personally identifiable information (PII) used for research.","CCI-003516":"The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for research.","CCI-003517":"The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for testing.","CCI-003518":"The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for training.","CCI-003519":"The organization provides means, where feasible and appropriate, for individuals to authorize the collection of personally identifiable information (PII) prior to its collection.","CCI-003520":"The organization provides means, where feasible and appropriate, for individuals to authorize the use of personally identifiable information (PII) prior to its collection.","CCI-003521":"The organization provides means, where feasible and appropriate, for individuals to authorize the maintaining of personally identifiable information (PII) prior to its collection.","CCI-003522":"The organization provides means, where feasible and appropriate, for individuals to authorize sharing of personally identifiable information (PII) prior to its collection.","CCI-003523":"The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection of personally identifiable information (PII).","CCI-003524":"The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the use of personally identifiable information (PII).","CCI-003525":"The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the dissemination of personally identifiable information (PII).","CCI-003526":"The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the retention of personally identifiable information (PII).","CCI-003527":"The organization obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected personally identifiable information (PII).","CCI-003528":"The organization ensures that individuals are aware of all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII.","CCI-003529":"The organization ensures that individuals, where feasible, consent to all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII.","CCI-003530":"The organization implements mechanisms to support itemized or tiered consent for specific uses of personally identifiable information (PII) data.","CCI-003531":"The organization provides individuals the ability to have access to their personally identifiable information (PII) maintained in its system(s) of records.","CCI-003532":"The organization publishes rules and regulations governing how individuals may request access to records maintained in a Privacy Act system of records.","CCI-003533":"The organization publishes regulations governing how individuals may request access to records maintained in a Privacy Act system of records.","CCI-003534":"The organization publishes access procedures for Privacy Act systems of records in System of Records Notices (SORNs).","CCI-003535":"The organization adheres to Privacy Act requirements for the proper processing of Privacy Act requests.","CCI-003536":"The organization adheres to OMB policies and guidance for the proper processing of Privacy Act requests.","CCI-003537":"The organization provides a process for individuals to have inaccurate personally identifiable information (PII) maintained by the organization corrected or amended, as appropriate.","CCI-003538":"The organization establishes a process for disseminating corrections or amendments of the personally identifiable information (PII) to other authorized users of the PII, such as external information-sharing partners.","CCI-003539":"The organization establishes a process, where feasible and appropriate, to notify affected individuals that their personally identifiable information (PII) information has been corrected or amended.","CCI-003540":"The organization implements a process for receiving complaints, concerns, or questions from individuals about the organizational privacy practices.","CCI-003541":"The organization implements a process for responding to complaints, concerns, or questions from individuals about the organizational privacy practices.","CCI-003542":"The organization defines the time period within which it must respond to complaints, concerns, or questions from individuals about the organizational privacy practices.","CCI-003543":"The organization responds to complaints, concerns, or questions from individuals about the organizational privacy practices within the organization-defined time period.","CCI-003544":"The organization defines the frequency on which it will update the inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).","CCI-003545":"The organization establishes an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).","CCI-003546":"The organization establishes an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).","CCI-003547":"The organization maintains an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).","CCI-003548":"The organization maintains an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).","CCI-003549":"The organization updates, per organization-defined frequency, an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).","CCI-003550":"The organization updates, per organization-defined frequency, an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).","CCI-003551":"The organization defines the frequency for providing each update of the personally identifiable information (PII) inventory to the CIO or information security official.","CCI-003552":"The organization provides each update of the personally identifiable information (PII) inventory to the CIO or information security official, per organization-defined frequency, to support the establishment of information security requirements for all new or modified information systems containing PII.","CCI-003553":"The organization develops a Privacy Incident Response Plan.","CCI-003554":"The organization implements a Privacy Incident Response Plan.","CCI-003555":"The organization provides an organized and effective response to privacy incidents in accordance with the organizational Privacy Incident Response Plan.","CCI-003556":"The organization provides effective notice to the public regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).","CCI-003557":"The organization provides effective notice to individuals regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).","CCI-003558":"The organization provides effective notice to the public regarding its authority for collecting personally identifiable information (PII).","CCI-003559":"The organization provides effective notice to individuals regarding its authority for collecting personally identifiable information (PII).","CCI-003560":"The organization provides effective notice to the public regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII).","CCI-003561":"The organization provides effective notice to individuals regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII).","CCI-003562":"The organization provides effective notice to the public regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII).","CCI-003563":"The organization provides effective notice to individuals regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII).","CCI-003564":"The organization provides effective notice to the public regarding the ability of individuals to access personally identifiable information (PII).","CCI-003565":"The organization provides effective notice to individuals regarding the ability to access personally identifiable information (PII).","CCI-003566":"The organization provides effective notice to the public regarding the ability to have personally identifiable information (PII) amended or corrected if necessary.","CCI-003567":"The organization provides effective notice to individuals regarding the ability to have personally identifiable information (PII) amended or corrected if necessary.","CCI-003568":"The organization describes the personally identifiable information (PII) the organization collects.","CCI-003569":"The organization describes the purpose(s) for which it collects the personally identifiable information (PII).","CCI-003570":"The organization describes how the organization uses personally identifiable information (PII) internally.","CCI-003571":"The organization describes whether the organization shares personally identifiable information (PII) with external entities.","CCI-003572":"The organization describes the categories of those external entities with whom personally identifiable information (PII) is shared.","CCI-003573":"The organization describes the purposes for sharing personally identifiable information (PII) with external entities.","CCI-003574":"The organization describes whether individuals have the ability to consent to specific uses or sharing of personally identifiable information (PII).","CCI-003575":"The organization describes how individuals may exercise their consent regarding specific uses or sharing of personally identifiable information (PII).","CCI-003576":"The organization describes how individuals may obtain access to personally identifiable information (PII).","CCI-003577":"The organization describes how the personally identifiable information (PII) will be protected.","CCI-003578":"The organization revises its public notices to reflect changes in practice or policy that affect personally identifiable information (PII), before or as soon as practicable after the change.","CCI-003579":"The organization revises its public notices to reflect changes in practice or policy that impact privacy, before or as soon as practicable after the change.","CCI-003580":"The organization provides real-time notice and/or layered notice when it collects personally identifiable information (PII).","CCI-003581":"The organization publishes System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII).","CCI-003582":"The organization keeps System of Records Notices (SORNs) current.","CCI-003583":"The organization includes Privacy Act Statements on its forms that collect personally identifiable information (PII), or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected.","CCI-003584":"The organization publishes System of Records Notices (SORNs) on its public website.","CCI-003585":"The organization ensures the public has access to information about its privacy activities.","CCI-003586":"The organization ensures the public is able to communicate with its Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO).","CCI-003587":"The organization ensures its privacy practices are publicly available through organizational websites or otherwise.","CCI-003588":"The organization uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices.","CCI-003589":"The organization shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes.","CCI-003590":"The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the personally identifiable information (PII) covered.","CCI-003591":"The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically enumerate the purposes for which the personally identifiable information (PII) may be used.","CCI-003592":"The organization monitors its staff on the authorized sharing of personally identifiable information (PII) with third parties.","CCI-003593":"The organization audits its staff on the authorized sharing of personally identifiable information (PII) with third parties.","CCI-003594":"The organization trains its staff on the authorized sharing of personally identifiable information (PII) with third parties.","CCI-003595":"The organization trains its staff on the consequences of unauthorized use or sharing of personally identifiable information (PII).","CCI-003596":"The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether the sharing is authorized.","CCI-003597":"The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether additional or new public notice is required.","CCI-003598":"The organization defines the individuals or information systems to be the only recipients of organization-defined information, information system components, or devices, by employing organization-defined security safeguards.","CCI-003599":"The organization defines the individuals or information systems to be the only recipients of organization-defined information, information system components, or devices, by employing organization-defined security safeguards.","CCI-003601":"Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-003602":"Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-003603":"Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines to organization-defined personnel or roles.","CCI-003604":"Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and the associated access control.","CCI-003605":"Designate an organization-defined official to manage the development and documentation of the access control policy and procedures.","CCI-003606":"Designate an organization-defined official to manage the dissemination of the access control policy and procedures.","CCI-003607":"Defines the official designated to manage the development, documentation, and dissemination of the access control policy and procedures.","CCI-003608":"Review and update the current access control policy following organization-defined events.","CCI-003609":"Defines the events following reviewing and updating the current access control policy.","CCI-003610":"Review and update the current access control procedures following organization-defined events.","CCI-003611":"Defines the events following reviewing and updating the current access control procedures.","CCI-003612":"Define and document the types of accounts allowed and specifically prohibited for use within the system.","CCI-003613":"Require organization-defined prerequisites and criteria for group membership.","CCI-003614":"Require organization-defined prerequisites and criteria for role membership.","CCI-003615":"Defines the prerequisites and criteria for group and role membership.","CCI-003616":"Defines the attributes (as required) for each account.","CCI-003617":"Create, enable, modify, disable, and remove system accounts in accordance with organization-defined policy.","CCI-003618":"Create, enable, modify, disable, and remove system accounts in accordance with organization-defined criteria.","CCI-003619":"Create, enable, modify, disable, and remove system accounts in accordance with organization-defined prerequisites.","CCI-003620":"Defines the policy to be employed when creating, enabling, modifying, disabling, and removing information system accounts.","CCI-003621":"Defines the prerequisites to be employed when creating, enabling, modifying, disabling, and removing information system accounts.","CCI-003622":"Defines the criteria to be employed when creating, enabling, modifying, disabling, and removing information system accounts.","CCI-003623":"Defines the personnel or roles of whom to notify when accounts are no longer required; when users are terminated or transferred; and when system usage or need-to-know changes for an individual.","CCI-003624":"Defines the time period of when to notify account managers for each situation.","CCI-003625":"Defines the attributes (as required) for authorizing access to the system.","CCI-003626":"Align account management processes with personnel termination and transfer processes.","CCI-003627":"Disable accounts when the accounts have expired.","CCI-003628":"Disable accounts when the accounts are no longer associated to a user.","CCI-003629":"Disable accounts when the accounts are in violation of organizational policy.","CCI-003630":"Monitor changes to roles or attributes.","CCI-003631":"Defines the system accounts that can be dynamically activated.","CCI-003632":"Activate organization-defined system accounts dynamically.","CCI-003633":"Defines the system accounts that can be dynamically managed.","CCI-003634":"Manage organization-defined system accounts dynamically.","CCI-003635":"Defines the system accounts that can be dynamically deactivated.","CCI-003636":"Deactivate organization-defined system accounts dynamically.","CCI-003637":"Defines the significant risks that may be discovered requiring disabled accounts of individuals.","CCI-003638":"Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects.","CCI-003639":"Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects.","CCI-003640":"Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system's components.","CCI-003641":"Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects.","CCI-003642":"Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change the rules governing access control.","CCI-003643":"Defines the organization-defined roles for which it will employ an audited override of automated access control mechanisms.","CCI-003644":"Restrict direct access to data repositories containing organization-defined information types.","CCI-003645":"Defines the information types of which to restrict direct access to data repositories.","CCI-003646":"Require applications to assert, as part of the installation process, the access needed to the organization-defined system applications and functions.","CCI-003647":"Defines the organization-defined system applications and functions as required of the applications as part of the installation process.","CCI-003648":"Require applications to provide an enforcement mechanism to prevent other-than-asserted access.","CCI-003649":"Approve access changed after initial installations of the application.","CCI-003650":"Enforce attribute-based access control policy over defined subjects and objects based upon organization-defined attributes to assume access permissions.","CCI-003651":"Defines the attributes to assume access permissions for enforcing attribute-based access control policy.","CCI-003652":"Enforce attribute-based control access over defined subjects and objects based upon organization-defined attributes to assume access permissions.","CCI-003653":"Defines the attributes to assume access permissions for enforcing attribute-based control access.","CCI-003654":"Provide organization-defined mechanisms to enable individuals to have access to the following elements of their personally identifiable information: organization-defined elements.","CCI-003655":"Defines the mechanisms to be provided for access to elements of personally identifiable information.","CCI-003656":"Defines the elements of personally identifiable information.","CCI-003657":"Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy.","CCI-003658":"Defines the mandatory access control policies that are to be enforced over all subjects and objects.","CCI-003659":"Enforce organization-defined discretionary access control policy over the set of covered subjects and objects specified in the policy.","CCI-003660":"Defines the discretionary access control policies the system is to enforce over subjects and objects.","CCI-003661":"Defines the privacy attributes to be used to enforce organization-defined information flow control policies.","CCI-003662":"Defines the information flow control mechanisms to prevent the bypassing of encrypted information.","CCI-003663":"Enforce information flow control using organization-defined privacy policy filters as a basis for flow control decisions for organization-defined information flows.","CCI-003664":"Enforce information flow control using block; strip; modify and/or quarantine data after a filter processing failure in accordance with organization-defined security or privacy policy.","CCI-003665":"Defines the security or privacy policy to be enforced using block; strip; modify and/or quarantine data after a filter processing failure.","CCI-003666":"Defines the security or privacy policy filters implemented when transferring information between security domains.","CCI-003667":"When transferring information between security domains, modify non-releasable information by implementing organization-defined modification action.","CCI-003668":"Defines the modification action when transferring information between different security domains.","CCI-003669":"When transferring information between different security domains, parse incoming data into an internal normalized format.","CCI-003670":"When transferring information between different security domains, regenerate the data to be consistent with its intended specification.","CCI-003671":"When transferring information between different security domains, sanitize data to minimize delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography encoded data; spillage of sensitive information in accordance with organization-defined policy.","CCI-003672":"Defines the policy when transferring information between different security domains.","CCI-003673":"When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.","CCI-003674":"When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.","CCI-003675":"When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.","CCI-003676":"When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering mechanisms successfully complete execution without errors.","CCI-003677":"When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering actions occur in the correct order and comply with organization-defined policy.","CCI-003678":"When transferring information between different security domains, implement content filtering mechanisms using multiple processes.","CCI-003679":"When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.","CCI-003680":"When transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content.","CCI-003681":"When transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata.","CCI-003682":"When transferring information between different security domains, the process that transfers information between filter pipelines ensures the content associated with the filtering metadata has successfully completed filtering.","CCI-003683":"When transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.","CCI-003684":"Identify and document organization-defined duties of individuals requiring separation.","CCI-003685":"Defines the individuals or roles who authorize access to organization-defined security functions.","CCI-003686":"Defines the individuals or roles who authorize access to organization-defined security-relevant information.","CCI-003687":"Limit the number of unsuccessful biometric logon attempts to an organization-defined number.","CCI-003688":"Defines the number of allowed unsuccessful biometric logon attempts.","CCI-003689":"Allow the use of organization-defined authentication factors that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded.","CCI-003690":"Defines the authentication factors after a number of organization-defined consecutive invalid logon attempts have been executed.","CCI-003691":"Enforce a limit of organization-defined number consecutive invalid logon attempts through use of the alternative factors by a user during a organization-defined time period.","CCI-003692":"Defines the number enforced for logon attempts.","CCI-003693":"Display an explicit message to users indicating that the session will end at an organization-defined time until end of session.","CCI-003694":"Defines the time until end of session, indicating the session will end.","CCI-003695":"Defines the user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.","CCI-003696":"Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in storage.","CCI-003697":"Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in process.","CCI-003698":"Defines privacy attributes, having organization-defined types of privacy attribute values, which are associated with information in transmission.","CCI-003699":"Defines privacy attribute values associated with organization-defined types of privacy attributes for information in storage.","CCI-003700":"Defines privacy attribute values associated with organization-defined types of privacy attributes for information in process.","CCI-003701":"Defines privacy attribute values associated with organization-defined types of privacy attributes for information in transmission.","CCI-003702":"Ensure that the privacy attribute associations are made with the information.","CCI-003703":"Ensure that the privacy attribute associations are restrained with the information.","CCI-003704":"Establish the following permitted organization-defined privacy attributes defined in AC-16a for organization-defined systems.","CCI-003705":"Defines the privacy attributes that are permitted for organization-defined systems.","CCI-003706":"Defines the attribute values or ranges permitted for each of the established privacy attributes.","CCI-003707":"Audit changes to the attributes.","CCI-003708":"Review organization-defined security attributes for applicability on an organization-defined frequency.","CCI-003709":"Review organization-defined privacy attributes for applicability on an organization-defined frequency.","CCI-003710":"Defines the security and privacy attributes to be reviewed for applicability.","CCI-003711":"Defines the frequency of which the security and privacy attributes will be reviewed.","CCI-003712":"Dynamically associate privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies as information is created and combined.","CCI-003713":"Dynamically associate privacy attributes with organization-defined objects in accordance with organization-defined privacy policies as information is created and combined.","CCI-003714":"Defines the privacy policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects.","CCI-003715":"Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated privacy attributes.","CCI-003716":"Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated privacy attributes.","CCI-003717":"Defines the privacy attributes for which the association and integrity to organization-defined subjects and objects is maintained.","CCI-003718":"Maintain the association of organization-defined privacy attributes to organization-defined subjects.","CCI-003719":"Maintain the association of organization-defined privacy attributes to organization-defined objects.","CCI-003720":"Maintain the integrity of organization-defined privacy attributes associated with organization-defined subjects.","CCI-003721":"Maintain the integrity of organization-defined privacy attributes associated with organization-defined objects.","CCI-003722":"Defines the subjects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals).","CCI-003723":"Defines the objects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals).","CCI-003724":"Defines the privacy attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.","CCI-003725":"Provide the capability to associate organization-defined privacy attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).","CCI-003726":"Provide the capability to associate organization-defined privacy attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).","CCI-003727":"Displays privacy attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.","CCI-003728":"Identifies special dissemination, handling, or distribution instructions for identifying privacy attributes on output.","CCI-003729":"Identifies human-readable, standard naming conventions for identifying privacy attributes on output.","CCI-003730":"Defines the privacy policies to be followed by personnel when associating organization-defined privacy attributes with organization-defined subjects and objects.","CCI-003731":"Defines the privacy attributes which are to be associated with organization-defined subjects and objects.","CCI-003732":"Defines the subjects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies.","CCI-003733":"Defines the objects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies.","CCI-003734":"Require personnel to associate organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies.","CCI-003735":"Require personnel to associate organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies.","CCI-003736":"Require personnel to maintain the association of organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies.","CCI-003737":"Require personnel to maintain the association of organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies.","CCI-003738":"Provide a consistent interpretation of privacy attributes transmitted between distributed system components.","CCI-003739":"Defines the techniques and technologies to be implemented when associating security attributes to information.","CCI-003740":"Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating privacy attributes to information.","CCI-003741":"Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating privacy attributes to information.","CCI-003742":"Change privacy attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.","CCI-003743":"Provide authorized individuals the capability to define or change the type of privacy attributes available for association with subjects.","CCI-003744":"Provide authorized individuals the capability to define or change the value of privacy attributes available for association with subjects.","CCI-003745":"Provide authorized individuals the capability to define or change the type of privacy attributes available for association with objects.","CCI-003746":"Provide authorized individuals the capability to define or change the value of privacy attributes available for association with objects.","CCI-003747":"Implement organization-defined mechanisms to authenticate organization-defined remote commands.","CCI-003748":"Defines the mechanisms used to authenticate organization-defined remote commands.","CCI-003749":"Defines the remote commands used for implementing organization-defined mechanisms.","CCI-003750":"Defines the terms and conditions for accessing the system from external systems.","CCI-003751":"Defines the controls asserted to be implemented on external systems allowing individuals to access the system from external systems.","CCI-003752":"Defines the terms and conditions for processing, storing, or transmitting organization-controlled information using external systems.","CCI-003753":"Defines the controls asserted to be implemented on external systems allowing individuals to process, store, or transmit organization-controlled information using external systems.","CCI-003754":"Prohibit the use of organizationally-defined types of external systems.","CCI-003755":"Defines the types of external systems that are prohibited.","CCI-003756":"Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's security policy and security plan.","CCI-003757":"Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's privacy policy and privacy plan.","CCI-003758":"Defines the restrictions for the use of organization-controlled portable storage devices.","CCI-003759":"Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.","CCI-003760":"Defines the privacy attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.","CCI-003761":"Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-003762":"Designate an organization-defined official to manage the development and documentation of the awareness and training policy.","CCI-003763":"Designate an organization-defined official to manage the dissemination of the awareness and training policy.","CCI-003764":"Designate an organization-defined official to manage the development and documentation of the awareness and training procedures.","CCI-003765":"Designate an organization-defined official to manage the dissemination of the awareness and training procedures.","CCI-003766":"Provide basic privacy awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events.","CCI-003767":"Employ organization-defined awareness techniques to increase the security awareness of system users.","CCI-003768":"Employ organization-defined awareness techniques to increase the privacy awareness of system users.","CCI-003769":"Defines the awareness techniques for to increase security and privacy awareness of system uses.","CCI-003770":"Update literacy training and awareness content on an organization-defined frequency.","CCI-003771":"Update literacy training and awareness content following organization-defined event.","CCI-003772":"Defines the frequency for updating literacy training and awareness content.","CCI-003773":"Defines the events following updating literacy training and awareness content.","CCI-003774":"Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.","CCI-003775":"Provide literacy training on recognizing and reporting potential and actual instances of social engineering.","CCI-003776":"Provide literacy training on recognizing and reporting potential and actual instances of social mining.","CCI-003777":"Provide literacy training on recognize suspicious communications and anomalous behavior in organizational systems using organization-defined indicators of malicious code.","CCI-003778":"Defines the indicators of malicious code used to recognize suspicious communications and anomalous behavior in organizational systems.","CCI-003779":"Provide literacy training on the advanced persistent threat.","CCI-003780":"Provide literacy training on the cyber threat environment.","CCI-003781":"Reflect current cyber threat information in system operations.","CCI-003782":"Defines the roles and responsibilities of the personnel providing role-based security and privacy training.","CCI-003783":"Provide role-based privacy training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.","CCI-003784":"Provide role-based privacy training to personnel with organization-defined roles and responsibilities when required by system changes.","CCI-003785":"Update role-based training content on an organization-defined frequency.","CCI-003786":"Defines the frequency of which the role-based training content is updated.","CCI-003787":"Update role-based training content following organization-defined events.","CCI-003788":"Defines the events following updating role-based training content.","CCI-003789":"Incorporate lessons learned from internal or external security incidents or breaches into role-based training.","CCI-003790":"Provide practical exercises in privacy training that reinforce training objectives.","CCI-003791":"Defines the frequency for providing training in the employment and operation of personally identifiable information processing and transparency controls to personnel or roles.","CCI-003792":"Provide organization-defined personnel or roles with initial training in the employment and operation of personally identifiable information processing and transparency controls.","CCI-003793":"Defines the personnel or roles who are to be provided training in the employment and operation of personally identifiable information processing and transparency controls.","CCI-003794":"Document individual privacy training activities, including privacy awareness training and specific system privacy training.","CCI-003795":"Monitor individual information privacy training activities, including privacy awareness training and specific privacy training.","CCI-003796":"Provide feedback on organizational training results to organization-defined personnel on an organization-defined frequency.","CCI-003797":"Defines the frequency of which feedback is provided on organizational training results.","CCI-003798":"Defines the organizational personnel or roles who provide feedback on organizational training results.","CCI-003799":"Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-003800":"Designate an organization-defined official to manage the development and documentation of the audit and accountability policy.","CCI-003801":"Designate an organization-defined official to manage the dissemination of the audit and accountability policy.","CCI-003802":"Designate an organization-defined official to manage the development and documentation of the audit and accountability procedures.","CCI-003803":"Designate an organization-defined official to manage the dissemination of the audit and accountability procedures.","CCI-003804":"Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability policy.","CCI-003805":"Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability procedures.","CCI-003806":"Review and update the current audit and accountability policy following organization-defined events.","CCI-003807":"Defines the events following reviewing and updating the current audit and accountability policy.","CCI-003808":"Review and update the current audit and accountability procedures following organization-defined events.","CCI-003809":"Defines the events following reviewing and updating the current audit and accountability procedures.","CCI-003810":"Review and update the event types selected for logging on an organization-defined frequency.","CCI-003811":"Defines the frequency at which the event types selected for logging will be reviewed and updated.","CCI-003812":"Limit personally identifiable information contained in audit records to organization-defined elements identified in the privacy risk assessment.","CCI-003813":"Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in audit records.","CCI-003814":"Defines the time-period for the alert in the event of an audit process failure.","CCI-003815":"Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements organization-defined alternate audit logging functionality.","CCI-003816":"Defines the alternate audit logging functionality in the event of a failure in primary audit logging capability.","CCI-003817":"Review and analyze the potential impact of the organization-defined inappropriate or unusual activity.","CCI-003818":"Adjust the level of audit review and analysis within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.","CCI-003819":"Adjust the level of audit reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.","CCI-003820":"Defines the automated mechanisms for integrating audit record review, analysis, and reporting processes.","CCI-003821":"Implement the capability to centrally review and analyze audit records from multiple components within the system.","CCI-003822":"Implement an audit reduction capability that supports on-demand audit review and analysis.","CCI-003823":"Implement an audit reduction capability that supports on-demand reporting requirements.","CCI-003824":"Implement an audit reduction capability that supports after-the-fact investigations of incidents.","CCI-003825":"Implement a report generation capability that supports on-demand audit review and analysis.","CCI-003826":"Implement a report generation capability that supports on-demand reporting requirements.","CCI-003827":"Implement a report generation capability that supports after-the-fact investigations of incidents.","CCI-003828":"Implement an audit reduction capability that does not alter original content or time ordering of audit records.","CCI-003829":"Implement a report generation capability that does not alter original content or time ordering of audit records.","CCI-003830":"Implement the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.","CCI-003831":"Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.","CCI-003832":"Defines the personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information.","CCI-003833":"Store audit information on a component running a different operating system than the system component being audited.","CCI-003834":"Implement the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.","CCI-003835":"Provide the capability for auditing the parameters of user query events for data sets containing personally identifiable information.","CCI-003836":"Implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.","CCI-003837":"If an information disclosure is discovered, notify organization-defined personnel or roles.","CCI-003838":"Defines the personnel or roles to be notified if an information disclosure is discovered.","CCI-003839":"If an information disclosure is discovered, take organization-defined additional actions.","CCI-003840":"Defines the additional actions to be taken if an information disclosure is discovered.","CCI-003841":"Monitor open-source information and information sites using organization-defined automated mechanisms.","CCI-003842":"Defines the automated mechanisms for monitoring open-source information.","CCI-003843":"Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.","CCI-003844":"Implement the capability for organization-defined users or roles to select a user session to record; view; hear; and/or log the content of a user session under organization-defined circumstances.","CCI-003845":"Defines users or roles who will provide and implement the capability to record; view; hear; and/or log the content of a user session under organization-defined circumstances.","CCI-003846":"Defines the circumstances to record; view; hear; and/or log the content of a user session.","CCI-003847":"Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.","CCI-003848":"Implement the capability for authorized users to remotely view and hear content related to an established user session in real time.","CCI-003849":"Disseminate an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-003850":"Defines the personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated.","CCI-003851":"Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring policy.","CCI-003852":"Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring procedures.","CCI-003853":"Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring policy.","CCI-003854":"Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring procedures.","CCI-003855":"Review and update the current assessment, authorization, and monitoring policy following organization-defined events.","CCI-003856":"Defines the events following reviewing and updating the current assessment, authorization, and monitoring policy.","CCI-003857":"Review and update the current assessment and authorization procedures following organization-defined events.","CCI-003858":"Defines the events following reviewing and updating the current assessment, authorization, and monitoring procedures.","CCI-003859":"Select the appropriate assessor or assessment team for the type of assessment to be conducted.","CCI-003860":"Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.","CCI-003861":"Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the privacy requirements.","CCI-003862":"Approve and manage the exchange of information between the system and other systems using interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreement; and/or nondisclosure agreements with an organization-defined type of agreement.","CCI-003863":"Document, as part of each exchange agreement, the privacy requirements, controls and responsibilities for each system, and the impact level of the information communicated.","CCI-003864":"Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.","CCI-003865":"Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-3a.","CCI-003866":"Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.","CCI-003867":"Defines the automated mechanisms to ensure the accuracy, currency, and availability of the plan of actions and milestones.","CCI-003868":"Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems.","CCI-003869":"Ensure the authorizing official accepts the use of common controls inherited by the system, before commencing operations.","CCI-003870":"Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems.","CCI-003871":"Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.","CCI-003872":"Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.","CCI-003873":"Implement continuous monitoring in accordance with the organization-level continuous monitoring strategy.","CCI-003874":"Defines the system-level metrics to be monitored.","CCI-003875":"Establish organization-defined frequencies for assessment of control effectiveness.","CCI-003876":"Defines the frequencies for monitoring of control effectiveness.","CCI-003877":"Defines the frequencies for assessment of control effectiveness.","CCI-003878":"Develop ongoing control assessments in accordance with the continuous monitoring strategy.","CCI-003879":"Implement a continuous monitoring program that includes reporting the privacy status to organization-defined personnel or roles on an organization-defined frequency.","CCI-003880":"Defines the frequency with which to report the privacy status to organization-defined personnel or roles.","CCI-003881":"Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes effectiveness monitoring.","CCI-003882":"Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes compliance monitoring.","CCI-003883":"Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes change monitoring.","CCI-003884":"Employ organization-defined actions to validate that policies are established.","CCI-003885":"Employ organization-defined actions to validate that implemented controls are operating in a consistent manner.","CCI-003886":"Defines the actions used to validate policies.","CCI-003887":"Ensure the accuracy, currency, and availability of monitoring results for the system using organization-defined automated mechanisms.","CCI-003888":"Defines the automated mechanisms for ensuring accuracy, currency, and availability of monitoring results.","CCI-003889":"Employ a penetration testing process, on an organization-defined frequency, that includes announced or unannounced attempts to bypass or circumvent controls associated with physical access points to the facility.","CCI-003890":"Defines the frequency the penetration testing process will be employed.","CCI-003891":"Document, for each internal connection, the privacy requirements.","CCI-003892":"Terminate internal system connections after organization-defined conditions.","CCI-003893":"Defines the conditions for terminating internal system connections.","CCI-003894":"Review on an organization-defined frequency the continued need for each internal connection.","CCI-003895":"Defines the frequency for reviewing each internal connection.","CCI-003896":"Perform privacy compliance checks on constituent components prior to the establishment of the internal connection.","CCI-003897":"Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-003898":"Defines the official to manage the development, documentation, and dissemination of the configuration management policy.","CCI-003899":"Designate an organization-defined official to manage the development and documentation of the configuration management policy.","CCI-003900":"Designate an organization-defined official to manage the dissemination of the configuration management policy.","CCI-003901":"Defines the official to manage the development, documentation, and dissemination of the configuration management procedures.","CCI-003902":"Designate an organization-defined official to manage the development and documentation of the configuration management procedures.","CCI-003903":"Designate an organization-defined official to manage the dissemination of the configuration management procedures.","CCI-003904":"Review and update the configuration management policy following organization-defined events.","CCI-003905":"Defines the events for when the policy will be reviewed and updated.","CCI-003906":"Review and update, on an organization-defined frequency, the current configuration management procedures.","CCI-003907":"Review and update the configuration management procedures following organization-defined events.","CCI-003908":"Defines the events for when the procedures will be reviewed and updated.","CCI-003909":"Develop and document, under configuration control, a current baseline configuration of the system.","CCI-003910":"Review and update the baseline configuration of the system when system components are installed or upgraded.","CCI-003911":"Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the baseline configuration of the system.","CCI-003912":"Approve or disapprove configuration-controlled changes to the system, with explicit consideration for privacy impact analyses.","CCI-003913":"Defines the automated mechanisms for documenting proposed changes to the system.","CCI-003914":"Defines the automated mechanisms for notifying approval authorities of proposed changes to the system and request change proposal.","CCI-003915":"Defines the automated mechanisms for highlighting proposed changes to the system that have not been approved or disapproved within an organization-defined time period.","CCI-003916":"Defines the automated mechanisms for prohibiting changes to the system until designated approvals are received.","CCI-003917":"Defines the automated mechanisms for documenting all changes to the system.","CCI-003918":"Defines the automated mechanisms for notifying organization-defined personnel when approved changes to the system are completed.","CCI-003919":"Defines the automated mechanisms to implement changes to the current system baseline.","CCI-003920":"Defines the automated mechanisms to deploy the updated baselines across the installed base.","CCI-003921":"Require an organization-defined privacy representative to be a member of the organization-defined configuration change control element.","CCI-003922":"Defines the security representatives required to be members of the configuration change control element.","CCI-003923":"Defines the privacy representatives required to be members of the configuration change control element.","CCI-003924":"Defines the configuration change control element required for security and privacy representatives.","CCI-003925":"Review changes to the system on an organization-defined frequency or when there are organization-defined circumstances to determine whether unauthorized changes have occurred.","CCI-003926":"Defines the frequency for reviewing changes to the system.","CCI-003927":"Defines the circumstances for determining whether unauthorized changes to the system have occurred.","CCI-003928":"Prevent or restrict changes to the configuration of the system under organization-defined circumstances.","CCI-003929":"Defines the circumstances for preventing or restricting changes to the configuration of the system.","CCI-003930":"Analyze changes to the system to determine potential privacy impacts prior to change implementation.","CCI-003931":"When analyzing changes to the system, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.","CCI-003932":"After system changes, verify that the impacted controls are implemented correctly, meeting the privacy requirements for the system.","CCI-003933":"After system changes, verify that the impacted controls are operating as intended, meeting the privacy requirements for the system.","CCI-003934":"After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system.","CCI-003935":"Define and document physical access restrictions associated with changes to the system.","CCI-003936":"Define and document logical access restrictions associated with changes to the system.","CCI-003937":"Defines the automated mechanisms to enforce access restrictions.","CCI-003938":"Automatically generate audit records of the enforcement actions.","CCI-003939":"Defines the frequency with which to review and reevaluate system privileges.","CCI-003940":"Review and reevaluate system privileges per an organization-defined frequency.","CCI-003941":"Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using organization-defined common secure configurations.","CCI-003942":"Defines the common secure configurations for establishing and documenting configuration settings within the system, that reflect the most restrictive mode consistent with operational requirements.","CCI-003943":"Monitor changes to the configuration settings in accordance with organizational policies.","CCI-003944":"Monitor changes to the configuration settings in accordance with organizational procedures.","CCI-003945":"Control changes to the configuration settings in accordance with organizational policies.","CCI-003946":"Control changes to the configuration settings in accordance with organizational procedures.","CCI-003947":"Defines the automated mechanisms for managing, applying, and verifying configuration settings.","CCI-003948":"Defines the mission essential capabilities for configuring the system.","CCI-003949":"Require that organization-defined user-installed software in a confined physical or virtual machine environment with limited privileges.","CCI-003950":"Defines the user-installed software required for executing in a confined physical or virtual machine environment with limited privileges.","CCI-003951":"Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is obtained from sources with limited or no warranty.","CCI-003952":"Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is obtained from sources with limited or no warranty.","CCI-003953":"Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is without the provision of source code.","CCI-003954":"Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is without the provision of source code.","CCI-003955":"Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code.","CCI-003956":"Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.","CCI-003957":"Identify organization-defined hardware components authorized for system use.","CCI-003958":"Defines the hardware components to be identified for authorized system use.","CCI-003959":"Prohibit the use or connection of unauthorized hardware components.","CCI-003960":"Review and update the list of authorized hardware components on an organization-defined frequency.","CCI-003961":"Defines the frequency the hardware components are reviewed and updated.","CCI-003962":"Develop and document an inventory of system components that accurately reflects the system.","CCI-003963":"Develop and document an inventory of system components that includes all components within the system.","CCI-003964":"Develop and document an inventory of system components that does not include duplicate accounting of components or components assigned to any other system.","CCI-003965":"Develop and document an inventory of system components that is at the level of granularity deemed necessary for tracking.","CCI-003966":"Develop and document an inventory of system components that is at the level of granularity deemed necessary for reporting.","CCI-003967":"Develop and document an inventory of system components that includes organization-defined information deemed necessary to achieve effective system component accountability.","CCI-003968":"Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the inventory of the system components.","CCI-003969":"Defines the automated mechanisms for detecting the presence of unauthorized hardware, software, and firmware components within the system.","CCI-003970":"Defines the automated mechanisms for supporting the tracking of system components by geographic location.","CCI-003971":"Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes.","CCI-003972":"Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management procedures.","CCI-003973":"Develop and document a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle.","CCI-003974":"Develop and document a configuration management plan for the system that establishes a process for managing the configuration of the configuration items.","CCI-003975":"Develop and document a configuration management plan for the system that defines the configuration items for the system.","CCI-003976":"Develop and document a configuration management plan for the system that places the configuration items under configuration management.","CCI-003977":"Develop and document a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles.","CCI-003978":"Defines the personnel or roles for those who review and approve the configuration management plan.","CCI-003979":"Implement a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles.","CCI-003980":"Allow user installation of software only with explicit privileged status.","CCI-003981":"Enforce and monitor compliance with software installation policies using organization-defined automated mechanisms.","CCI-003982":"Identify and document the location of the organization-defined information on which the information is processed and stored.","CCI-003983":"Identify and document the specific system components on which the organization-defined information is processed and stored.","CCI-003984":"Defines the information on which the location and specific system components are processed and stored.","CCI-003985":"Identify and document the users who have access to the system where the information is processed and stored.","CCI-003986":"Identify and document the users who have access to the system components where the information is processed and stored.","CCI-003987":"Document changes to the location (i.e., system or system components) where the information is processed and stored.","CCI-003988":"Use automated tools to identify organization-defined information by information type on organization-defined components to ensure adequate controls are in place to protect organizational information.","CCI-003989":"Defines the information by information type for identifying automated tools.","CCI-003990":"Defines the system components used to ensure controls are in place to protect organizational information and individual privacy.","CCI-003991":"Develop and document a map of system data actions.","CCI-003992":"Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.","CCI-003993":"Defines the software and firmware for preventing installation without verification that the component has been digitally signed.","CCI-003994":"Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-003995":"Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-003996":"Designate an organization-defined official to manage development and documentation of the contingency planning policy.","CCI-003997":"Designate an organization-defined official to manage dissemination of the contingency planning policy.","CCI-003998":"Defines the official designated to manage the development, documentation, and dissemination of the contingency policy.","CCI-003999":"Designate an organization-defined official to manage the development and documentation of the contingency planning procedures.","CCI-004000":"Designate an organization-defined official to manage the dissemination of the contingency procedures.","CCI-004001":"Defines the official designated to manage the development, documentation, and dissemination of the contingency procedures.","CCI-004002":"Review and update the current contingency planning policy following organization-defined events.","CCI-004003":"Defines the events with which to review and update the current contingency planning policy.","CCI-004004":"Review and update the current contingency planning procedures following organization-defined events.","CCI-004005":"Defines the events with which to review and update the current contingency planning procedures.","CCI-004006":"Develop a contingency plan for the system that addresses maintaining essential mission functions despite a system disruption, compromise, or failure.","CCI-004007":"Develop a contingency plan for the system that addresses maintaining essential business functions despite a system disruption, compromise, or failure.","CCI-004008":"Develop a contingency plan for the system that addresses the sharing of contingency information.","CCI-004009":"Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training.","CCI-004010":"Review and update contingency training content on an organization-defined frequency.","CCI-004011":"Defines the frequency the contingency training content will be reviewed and updated.","CCI-004012":"Review and update contingency training content following organization-defined events.","CCI-004013":"Defines the events for which the contingency training content will be reviewed and updated.","CCI-004014":"Defines the automated mechanisms to test the contingency plan.","CCI-004015":"Employ organization-defined mechanisms to organization-defined system or system component to disrupt and adversely affect the system or system component.","CCI-004016":"Defines the mechanisms employed to disrupt and adversely affect the system or system component.","CCI-004017":"Defines the system or system component used to employ organization-defined mechanisms.","CCI-004018":"Establish an alternate storage site, including necessary agreements to permit the retrieval of system backup information.","CCI-004019":"Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.","CCI-004020":"Defines the system components to conduct backups of user level information.","CCI-004021":"Conduct backups of system documentation, including privacy-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.","CCI-004022":"Protect the confidentiality of backup information.","CCI-004023":"Protect integrity of backup information.","CCI-004024":"Protect the availability of backup information.","CCI-004025":"Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined backup information.","CCI-004026":"Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined backup information.","CCI-004027":"Defines the backup information which is protected by cryptographic mechanisms preventing unauthorized disclosure and modification.","CCI-004028":"Provide for the recovery and reconstitution of the system to a known state within an organization-defined time-period consistent with recovery time and recovery point objectives after a disruption, compromise, or failure.","CCI-004029":"Defines the time-period consistent with recovery time and recovery point objectives for the recovery and reconstitution of the system.","CCI-004030":"Protect system components used for recovery and reconstitution.","CCI-004031":"Defines the personnel or roles the organization-level; mission/business process-level; and/or system-level identification and authorization policy is disseminated to.","CCI-004032":"Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination, among organizational entities, and compliance.","CCI-004033":"Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-004034":"Develop and document the procedures to facilitate the implementation of the identification and authorization policy and the associated identification and authentication controls.","CCI-004035":"Designate an organization-defined official to manage development and documentation of the identification and authentication policy.","CCI-004036":"Designate an organization-defined official to manage dissemination of the identification and authentication policy.","CCI-004037":"Designate an organization-defined official to manage development and documentation of the identification and authentication procedures.","CCI-004038":"Designate an organization-defined official to manage dissemination of the identification and authentication procedures.","CCI-004039":"Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication policy.","CCI-004040":"Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication procedures.","CCI-004041":"Review and update the current identification and authentication policy following organization-defined events.","CCI-004042":"Defines the events following reviewing and updating the current identification and authentication policy.","CCI-004043":"Review and update the current identification and authentication procedures following organization-defined events.","CCI-004044":"Defines the events following reviewing and updating the current identification and authentication procedures.","CCI-004045":"Require users to be individually authenticated before granting access to the shared accounts or resources.","CCI-004046":"Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.","CCI-004047":"Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.","CCI-004048":"Defines the strength of mechanism requirements for implementing multi-factor authentication.","CCI-004049":"Defines the dynamic identifier policy for managing individual identifiers dynamically.","CCI-004050":"Generate pairwise pseudonymous identifiers.","CCI-004051":"Maintain the attributes for each uniquely identified individual, device, or service in organization-defined protected central storage.","CCI-004052":"Defines the protected central storage for maintaining the attributes for each uniquely individual, device or service.","CCI-004053":"Manage system authenticators by establishing administrative procedures for lost/compromised or damaged authenticators.","CCI-004054":"Manage system authenticators by implementing administrative procedures for lost/compromised or damaged authenticators.","CCI-004055":"Manage system authenticators by changing default authenticators prior to first use.","CCI-004056":"Defines the events for when to change or refresh authenticators.","CCI-004057":"Defines the frequency for updating commonly used, expected, or compromised passwords, when they are suspected of being compromised directly or indirectly.","CCI-004058":"For password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.","CCI-004059":"For password-based authentication, update the list of passwords on an organization-defined frequency.","CCI-004060":"For password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.","CCI-004061":"For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).","CCI-004062":"For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.","CCI-004063":"For password-based authentication, require immediate selection of a new password upon account recovery.","CCI-004064":"For password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters.","CCI-004065":"For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.","CCI-004066":"For password-based authentication, enforce organization-defined composition and complexity rules.","CCI-004067":"Defines the composition and complexity rules to be enforced.","CCI-004068":"For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.","CCI-004069":"Ensure that the unencrypted static authenticators are not embedded in applications or other forms of static storage.","CCI-004070":"Use organization-defined external organizations to federate credentials.","CCI-004071":"Defines the external organizations used to federate credentials.","CCI-004072":"Defines the binding rules for binding identities and authenticators.","CCI-004073":"Use only General Services Administration-approved and validated products and services for identity, credential, and access management.","CCI-004074":"Require that the issuance of organization-defined types of and/or specific authenticators be conducted in person or by a trusted external party before the organization-defined registration authority with authorization by organization-defined personnel or roles.","CCI-004075":"Defines types of and/or specific authenticators to be conducted in person or by a trusted external party before the organization-defined registration authority.","CCI-004076":"Defines the registration authority who conducts the issuance of organization-defined types of and/or specific authenticators.","CCI-004077":"Defines the personnel or roles who authorize the issuance of organization-defined types of and/or specific authenticators.","CCI-004078":"Employ presentation attack detection mechanisms for biometric-based authentication.","CCI-004079":"Employ organization-defined password managers to generate and manage passwords.","CCI-004080":"Defines the password managers employed to generate and manage passwords.","CCI-004081":"Protect the passwords using organization-defined controls.","CCI-004082":"Defines the controls for protecting the passwords.","CCI-004083":"Accept only external credentials that are NIST compliant.","CCI-004084":"Document and maintain a list of accepted external authenticators.","CCI-004085":"Conform to organization-defined identity management profiles for identity management.","CCI-004086":"Defines the identity management profiles for conforming to the profiles for identity management.","CCI-004087":"Defines the policy for accepting and verifying federated or PKI credentials.","CCI-004088":"Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among individuals.","CCI-004089":"Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among credential service providers.","CCI-004090":"Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among relying parties.","CCI-004091":"Defines the measures to be implemented to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties.","CCI-004092":"Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards.","CCI-004093":"Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable guidelines.","CCI-004094":"Resolve user identities to a unique individual.","CCI-004095":"Collect identity evidence.","CCI-004096":"Validate identity evidence.","CCI-004097":"Verify identity evidence.","CCI-004098":"Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.","CCI-004099":"Require evidence of individual identification be presented to the registration authority.","CCI-004100":"Require that the presented identity evidence be validated through organizational defined methods of validation.","CCI-004101":"Require that the presented identity evidence be verified through organizational defined methods of verification.","CCI-004102":"Defines the methods of validation required for presenting identity evidence.","CCI-004103":"Defines the methods of verification required for presenting identity evidence.","CCI-004104":"Require that the validation of identity evidence be conducted in person before a designated registration authority.","CCI-004105":"Require that the verification of identity evidence be conducted in person before a designated registration authority.","CCI-004106":"Require that a registration code or notice of proofing be delivered through an out-of-band channel to verify the users address (physical or digital) of record.","CCI-004107":"Accept externally-proofed identities at an organization-defined identity assurance level.","CCI-004108":"Defines the identity assurance level by accepting externally-proofed identities.","CCI-004109":"Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.","CCI-004110":"Designate an organization-defined official to manage the incident response policy.","CCI-004111":"Designate an organization-defined official to manage the incident response procedures.","CCI-004112":"Defines the official designated to manage the incident response policy and procedures.","CCI-004113":"Review and update the current incident response policy following organization-defined events.","CCI-004114":"Defines the events for reviewing and updating the current incident response policy.","CCI-004115":"Review and update the current incident response procedures following organization-defined events.","CCI-004116":"Defines the events for reviewing and updating the current incident response procedures.","CCI-004117":"Defines the automated mechanisms to provide an incident response training environment.","CCI-004118":"Provide incident response training on how to identify and respond to a breach, including the organization's process for reporting a breach.","CCI-004119":"Defines the automated mechanisms to test the incident response capability.","CCI-004120":"Use qualitative data from testing to determine the effectiveness of incident response processes.","CCI-004121":"Use quantitative data from testing to determine the effectiveness of incident response processes.","CCI-004122":"Use qualitative data from testing to continuously improve incident response processes.","CCI-004123":"Use quantitative data from testing to continuously improve incident response processes.","CCI-004124":"Use qualitative data from testing to provide incident response measures and metrics that are accurate.","CCI-004125":"Use quantitative data from testing to provide incident response measures and metrics that are accurate.","CCI-004126":"Use qualitative data from testing to provide incident response measures and metrics that are consistent.","CCI-004127":"Use quantitative data from testing to provide incident response measures and metrics that are consistent.","CCI-004128":"Use qualitative data from testing to provide incident response measures and metrics that are in a reproducible format.","CCI-004129":"Use quantitative data from testing to provide incident response measures and metrics that are in a reproducible format.","CCI-004130":"Incorporate lessons learned from ongoing incident handling activities into incident response procedures.","CCI-004131":"Incorporate lessons learned from ongoing incident handling activities into incident response training.","CCI-004132":"Incorporate lessons learned from ongoing incident handling activities into incident response testing.","CCI-004133":"Ensure the rigor of incident handling activities are comparable and predictable across the organization.","CCI-004134":"Ensure the intensity of incident handling activities are comparable and predictable across the organization.","CCI-004135":"Ensure the scope of incident handling activities are comparable and predictable across the organization.","CCI-004136":"Ensure the results of incident handling activities are comparable and predictable across the organization.","CCI-004137":"Defines the automated mechanisms for supporting the incident handling process.","CCI-004138":"Defines the types of dynamic reconfiguration for system components.","CCI-004139":"Defines the classes of incidents to identify actions in response to those incidents.","CCI-004140":"Defines the actions to take in response to organization-defined classes of incidents to ensure continuation of organizational mission and business functions.","CCI-004141":"Coordinate an incident handling capability for insider threats that includes organization-defined entities.","CCI-004142":"Defines the organizational entities for coordinating an incident handling capability for insider threats.","CCI-004143":"Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in an organization-defined time period.","CCI-004144":"Defines the time period for establishing and maintaining an integrated incident response team that can be deployed to any location identified by the organization.","CCI-004145":"Analyze malicious code and/or other residual artifacts remaining in the system after the incident.","CCI-004146":"Analyze anomalous or suspected adversarial behavior in or related to organization-defined environments or resources.","CCI-004147":"Defines the environments or resources for analyzing anomalous or suspected adversarial behavior.","CCI-004148":"Establish and maintain a security operations center.","CCI-004149":"Manage public relations associated with an incident.","CCI-004150":"Employ measures to repair the reputation of the organization.","CCI-004151":"Track incidents using organization-defined automated mechanisms.","CCI-004152":"Collect incident information using organization-defined automated mechanisms.","CCI-004153":"Analyze incident information using organization-defined automated mechanisms.","CCI-004154":"Defines the automated mechanisms to track, collect, and analyze incident information.","CCI-004155":"Defines the automated mechanisms for reporting incidents.","CCI-004156":"Provide incident information to the provider of the product or service.","CCI-004157":"Develop an incident response plan that addresses the sharing of incident information.","CCI-004158":"Defines the frequency organization-defined personnel or roles will review and approve the incident response plan.","CCI-004159":"Develop an incident response plan that explicitly designates responsibility for incident response to organization-defined entities, personnel, or roles.","CCI-004160":"Include a process to determine if notice to individuals or other organizations, including oversight organizations, is needed, in the Incident Response Plan for breaches involving Personally Identifiable Information.","CCI-004161":"Include an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms in the Incident Response Plan for breaches involving Personally Identifiable Information.","CCI-004162":"Include identification of applicable privacy requirements in the Incident Response Plan for breaches involving Personally Identifiable Information.","CCI-004163":"Respond to information spills by assigning organization-defined personnel or roles with responsibility for responding to information spills.","CCI-004164":"Defines the personnel or roles who will respond to information spills.","CCI-004165":"Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-004166":"Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance policy.","CCI-004167":"Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance procedures.","CCI-004168":"Defines the official who will manage the development, documentation, and dissemination of the maintenance policy.","CCI-004169":"Defines the official who will manage the development, documentation, and dissemination of the maintenance procedures.","CCI-004170":"Review and update the current maintenance policy following organization-defined events.","CCI-004171":"Defines the events following reviewing and updating the current maintenance policy.","CCI-004172":"Review and update the current maintenance procedures following organization-defined events.","CCI-004173":"Defines the events following reviewing and updating the current maintenance procedures.","CCI-004174":"Schedule replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-004175":"Document replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-004176":"Review records of replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.","CCI-004177":"Approve all maintenance activities, whether performed on site or remotely.","CCI-004178":"Monitor all maintenance activities, whether performed on site or remotely.","CCI-004179":"Approve all maintenance activities, whether the system or system components are serviced on site or removed to another location.","CCI-004180":"Monitor all maintenance activities, whether the system or system components are serviced on site or removed to another location.","CCI-004181":"Defines the information to be removed from associated media.","CCI-004182":"Schedule maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.","CCI-004183":"Conduct maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.","CCI-004184":"Document maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.","CCI-004185":"Produce up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed.","CCI-004186":"Review previously approved system maintenance tools on an organization-defined frequency.","CCI-004187":"Defines the frequency for reviewing previously approved system maintenance tools.","CCI-004188":"Monitor the use of maintenance tools that execute with increased privilege.","CCI-004189":"Inspect the maintenance tools to ensure the latest software updates and patches are installed.","CCI-004190":"Terminate session when nonlocal maintenance is completed.","CCI-004191":"Terminate network connection when nonlocal maintenance is completed.","CCI-004192":"Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.","CCI-004193":"Defines the cryptographic mechanisms for protecting the integrity and confidentiality of nonlocal maintenance and diagnostic communications.","CCI-004194":"Develop organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.","CCI-004195":"Implement organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.","CCI-004196":"Defines alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.","CCI-004197":"Defines the automated mechanisms for transferring predictive maintenance data to a maintenance system.","CCI-004198":"Restrict or prohibit field maintenance on organization-defined systems or system components to organization-defined trusted maintenance facilities.","CCI-004199":"Defines the systems or system components which restrict or prohibit field maintenance.","CCI-004200":"Defines the trusted maintenance facilities which the systems or system components restrict or prohibit field maintenance.","CCI-004201":"Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-004202":"Designate an organization-defined official to manage the development and documentation of the media protection policy.","CCI-004203":"Designate an organization-defined official to manage the dissemination of the media protection policy.","CCI-004204":"Designate an organization-defined official to manage development and documentation of the media protection procedures.","CCI-004205":"Designate an organization-defined official to manage dissemination of the media protection procedures.","CCI-004206":"Defines the official designated to manage the development, documentation, and dissemination of the media protection policy and procedures.","CCI-004207":"Review and update the current media protection policy following organization-defined events.","CCI-004208":"Defines the events following reviewing and updating the current media policy.","CCI-004209":"Review and update the current media protection procedures following organization-defined events.","CCI-004210":"Defines the events following reviewing and updating the current media procedures.","CCI-004211":"Physically control and securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas.","CCI-004212":"Securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas.","CCI-004213":"Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment.","CCI-004214":"Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved techniques.","CCI-004215":"Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved procedures.","CCI-004216":"Defines the automated mechanisms which restrict access to media storage areas and log access attempts and access granted.","CCI-004217":"Protect organization-defined types of system media during transport outside of controlled areas using organization-defined controls.","CCI-004218":"Control organization-defined types of system media during transport outside of controlled areas using organization-defined controls.","CCI-004219":"Test sanitization equipment in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved.","CCI-004220":"Test sanitization procedures in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved.","CCI-004221":"Establish an organization-defined system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.","CCI-004222":"Defines the system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.","CCI-004223":"Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed.","CCI-004224":"Verify that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information.","CCI-004225":"Identify organization-defined system media requiring downgrading.","CCI-004226":"Defines the system media requiring downgrading.","CCI-004227":"Test downgrading equipment on an organization-defined frequency to ensure that intended downgrading actions are being achieved.","CCI-004228":"Test downgrading procedures on an organization-defined frequency to ensure that intended downgrading actions are being achieved.","CCI-004229":"Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-004230":"Designate an organization-defined official to manage the development and documentation of the physical and environmental protection policy.","CCI-004231":"Designate an organization-defined official to manage the dissemination of the physical and environmental protection policy.","CCI-004232":"Designate an organization-defined official to manage development and documentation of the physical and environmental protection procedures.","CCI-004233":"Designate an organization-defined official to manage dissemination of the physical and environmental protection procedures.","CCI-004234":"Defines the official who will manage the physical and environmental policy.","CCI-004235":"Defines the official who will manage the physical and environmental procedures.","CCI-004236":"Review and update the current physical and environmental protection policy following organization-defined events.","CCI-004237":"Defines the events following reviewing and updating the current physical and environmental protection policy.","CCI-004238":"Review and update the current physical and environmental protection procedures following organization-defined events.","CCI-004239":"Defines the events following reviewing and updating the current physical and environmental protection procedures.","CCI-004240":"Enforce physical access authorizations at organization-defined entry points to the facility where the system resides.","CCI-004241":"Enforce physical access authorizations at organization-defined exit points to the facility where the system resides.","CCI-004242":"Control ingress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards.","CCI-004243":"Control egress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards.","CCI-004244":"Limit access using physical barriers.","CCI-004245":"Employ access control vestibules at organization-defined locations within the facility.","CCI-004246":"Defines the locations within the facility where the access control vestibules are employed.","CCI-004247":"Link individual identity to receipt of output from output devices.","CCI-004248":"Defines the automated mechanisms for recognizing organization-defined classes or types of intrusions and initiating organization-defined response actions.","CCI-004249":"Review video recordings on an organization-defined frequency.","CCI-004250":"Defines the frequency with which to review video recordings.","CCI-004251":"Report anomalies in visitor access records to organization-defined personnel.","CCI-004252":"Defines the personnel who are to report anomalies in visitor access records.","CCI-004253":"Defines the automated mechanisms for maintaining and reviewing visitor access records.","CCI-004254":"Limit personally identifiable information contained in visitor access records to the organization-defined elements identified in the privacy risk assessment.","CCI-004255":"Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in visitor access records.","CCI-004256":"Defines the system or individual system components that provide the capability of shutting off power in emergency situations.","CCI-004257":"Defines the automatic environmental controls for preventing potentially harmful fluctuations to the system.","CCI-004258":"Defines the personnel or roles who employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.","CCI-004259":"Detect the presence of water near the system.","CCI-004260":"Alert organization-defined personnel or roles of the presence of water near the system using organization-defined automated mechanisms.","CCI-004261":"Defines the automated mechanisms for detecting the presence of water and alerting organization-defined personnel or roles.","CCI-004262":"Determine and document the organization-defined alternate work sites allowed for use by employees.","CCI-004263":"Provide a means for employees to communicate with information privacy personnel in case of incidents.","CCI-004264":"Protect system components, associated data communications, and networks in accordance with national Emissions Security policies based on the security category or classification of the information.","CCI-004265":"Protect system components, associated data communications, and networks in accordance with national Emissions Security procedures based on the security category or classification of the information.","CCI-004266":"Employ organization-defined protective measures against electromagnetic pulse damage for organization-defined systems and system components.","CCI-004267":"Defines the protective measure employed against electromagnetic pulse damage for organization-defined systems and system components.","CCI-004268":"Defines the systems and system components in which organization-defined protective measures are employed against electromagnetic pulse damage.","CCI-004269":"Mark organization-defined system hardware components indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.","CCI-004270":"Defines the system hardware components which are marked, indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.","CCI-004271":"Plan the location or site of the facility where the system resides considering physical and environmental hazards.","CCI-004272":"For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy.","CCI-004273":"Develop and document an organization-level; mission/business process-level; and or system-level planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-004274":"Designate an organization-defined official to manage the development and documentation of the planning policy and procedures.","CCI-004275":"Designate an organization-defined official to manage the dissemination of the planning policy and procedures.","CCI-004276":"Review and update the current planning policy following organization-defined events.","CCI-004277":"Review and update the current planning procedures following organization-defined events.","CCI-004278":"Develop security and privacy plans for the system that identify the individuals that fulfill system roles and responsibilities.","CCI-004279":"Develop security and privacy plans for the system that identify the information types processed, stored, and transmitted by the system.","CCI-004280":"Develop security and privacy plans for the system that describe any specific threats to the system that are of concern to the organization.","CCI-004281":"Develop security and privacy plans for the system that provide the results of a privacy risk assessment for the systems processing personally identifiable information.","CCI-004282":"Develop security and privacy plans for the system that include risk determinations for security and privacy architecture and design decisions.","CCI-004283":"Develop security and privacy plans for the system that include security- and privacy-related activities affecting the system that require planning and coordination with organization-defined individuals or groups.","CCI-004284":"Establish the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system.","CCI-004285":"Establish the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system.","CCI-004286":"Provide the rules describing the responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system.","CCI-004287":"Provide the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system.","CCI-004288":"Provide the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system.","CCI-004289":"Defines the frequency individuals are required to read and re-acknowledge the rules of behavior whenever the rules are revised or updated.","CCI-004290":"Include in the rules of behavior, restrictions on use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.","CCI-004291":"Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information privacy.","CCI-004292":"Develop privacy architectures for the system.","CCI-004293":"Develop privacy architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.","CCI-004294":"Develop security architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.","CCI-004295":"Develop privacy architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.","CCI-004296":"Develop privacy architectures for the system that describe how the architectures are integrated into and support the enterprise architecture.","CCI-004297":"Develop privacy architectures for the system that describe any assumptions about, and dependencies on, external systems and services.","CCI-004298":"Reflect planned privacy architecture changes in the privacy plans.","CCI-004299":"Reflect planned privacy architecture changes in the privacy Concept of Operations (CONOPS).","CCI-004300":"Reflect planned privacy architecture changes in the privacy organizational procurements and acquisitions.","CCI-004301":"Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations.","CCI-004302":"Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers.","CCI-004303":"Defines the controls to be allocated to organization-defined locations for the privacy architecture.","CCI-004304":"Defines the controls to be allocated to the organization-defined privacy architectural layers.","CCI-004305":"Defines the locations to which the system allocates organization-defined controls in the privacy architecture.","CCI-004306":"Defines the architectural layers to which the system allocates organization-defined controls in the privacy architecture.","CCI-004307":"Design the privacy architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.","CCI-004308":"Defines the controls that are allocated to the organization-defined locations and architectural layers.","CCI-004309":"Defines the locations and architectural layers that are obtained from different suppliers.","CCI-004310":"Select a control baseline for the system.","CCI-004311":"Tailor the selected control baseline by applying specified tailoring actions.","CCI-004312":"Review and update the organization-wide information security program plan following organization-defined events.","CCI-004313":"Defines the events for reviewing and updating the organization-wide information security program plan.","CCI-004314":"Include the resources needed to implement the information security programs in capital planning and investment requests.","CCI-004315":"Include the resources needed to implement the information privacy programs in capital planning and investment requests.","CCI-004316":"Prepare documentation required for addressing information security programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.","CCI-004317":"Prepare documentation required for addressing information privacy programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.","CCI-004318":"Make available for expenditure, the planned information privacy resources.","CCI-004319":"Implement a process to ensure that plans of action and milestones for the privacy program and the associated organizational systems are maintained.","CCI-004320":"Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed.","CCI-004321":"Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are maintained.","CCI-004322":"Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are developed.","CCI-004323":"Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document the remedial information privacy actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.","CCI-004324":"Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document the remedial information supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.","CCI-004325":"Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems are reported in accordance with established reporting requirements.","CCI-004326":"Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are reported in accordance with established reporting requirements.","CCI-004327":"Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are reported in accordance with established reporting requirements.","CCI-004328":"Develop an inventory of organizational systems.","CCI-004329":"Update, on an organization-defined frequency, an inventory of organizational systems.","CCI-004330":"Defines the frequency with which to update the inventory of organizational systems.","CCI-004331":"Establish an inventory of all systems, applications, and projects that process personally identifiable information.","CCI-004332":"Maintain an inventory of all systems, applications, and projects that process personally identifiable information.","CCI-004333":"Update on an organization-defined frequency, an inventory of all systems, applications, and projects that process personally identifiable information.","CCI-004334":"Defines the frequency of which an inventory of all systems, applications, and projects that process personally identifiable information will be updated.","CCI-004335":"Develop the results of information privacy measures of performance.","CCI-004336":"Monitor the results of information privacy measures of performance.","CCI-004337":"Report on the results of information privacy measures of performance.","CCI-004338":"Develop an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.","CCI-004339":"Maintain an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.","CCI-004340":"Maintain an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.","CCI-004341":"Offload organization-defined non-essential functions or services to other systems, system components, or an external provider.","CCI-004342":"Defines the non-essential functions or services to be offloaded to other systems, system components, or an external provider.","CCI-004343":"Address information privacy issues in the development and documentation of a critical infrastructure and key resources protection plan.","CCI-004344":"Address information privacy issues in the updating of a critical infrastructure and key resources protection plan.","CCI-004345":"Develop a comprehensive strategy to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information.","CCI-004346":"Manage the security state of organizational systems and the environments in which those systems operate through authorization processes.","CCI-004347":"Manage the privacy state of organizational systems and the environments in which those systems operate through authorization processes.","CCI-004348":"Define organizational mission and business processes with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.","CCI-004349":"Determine personally identifiable information processing needs arising from the defined mission and business processes.","CCI-004350":"Review and revise the mission and business processes on an organization-defined frequency.","CCI-004351":"Defines the frequency at which the mission and business processes are reviewed and revised.","CCI-004352":"Establish a privacy workforce development and improvement program.","CCI-004353":"Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are developed.","CCI-004354":"Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are maintained.","CCI-004355":"Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are developed.","CCI-004356":"Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are maintained.","CCI-004357":"Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems are developed.","CCI-004358":"Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational information systems are maintained.","CCI-004359":"Implement a process for ensuring that organizational plans for conducting privacy testing associated with organizational systems continue to be executed.","CCI-004360":"Implement a process for ensuring that organizational plans for conducting privacy training associated with organizational systems continue to be executed.","CCI-004361":"Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems continue to be executed.","CCI-004362":"Establish and institutionalize contact with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel.","CCI-004363":"Establish and institutionalize contact with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies.","CCI-004364":"Establish and institutionalize contact with selected groups and associations within the privacy community to share current privacy information including threats, vulnerabilities, and incidents.","CCI-004365":"Employ automated means to maximize the effectiveness of sharing threat intelligence information.","CCI-004366":"Establish policy to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.","CCI-004367":"Establish procedures to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.","CCI-004368":"Review and update the policy for Controlled Unclassified Information on an organization-defined frequency.","CCI-004369":"Defines the frequency in which the policy for Controlled Unclassified information is reviewed and updated.","CCI-004370":"Review and update the procedures for Controlled Unclassified Information on an organization-defined frequency.","CCI-004371":"Defines the frequency in which the procedures for Controlled Unclassified information is reviewed and updated.","CCI-004372":"Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program.","CCI-004373":"Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program.","CCI-004374":"Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program.","CCI-004375":"Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program.","CCI-004376":"Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and provides an overview of the requirements for the privacy program.","CCI-004377":"Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and provides an overview of the requirements for the privacy program.","CCI-004378":"Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements.","CCI-004379":"Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements.","CCI-004380":"Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities.","CCI-004381":"Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities.","CCI-004382":"Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program.","CCI-004383":"Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program.","CCI-004384":"Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy.","CCI-004385":"Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy.","CCI-004386":"Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.","CCI-004387":"Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.","CCI-004388":"Update the plan on an organization-defined frequency.","CCI-004389":"Update the plan to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.","CCI-004390":"Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to coordinate applicable privacy requirements.","CCI-004391":"Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to develop applicable privacy requirements.","CCI-004392":"Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to implement applicable privacy requirements.","CCI-004393":"Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to manage privacy risks through the organization-wide privacy program.","CCI-004394":"Maintain a central resource webpage on the organization's principle public website that serves as a central source of information about the organization's privacy plan.","CCI-004395":"Ensure that the public has access to information about organizational privacy activities.","CCI-004396":"Ensure that the public can communicate with its Senior Agency Official for Privacy.","CCI-004397":"Ensure that organizational privacy practices and reports are publicly available.","CCI-004398":"Employ publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.","CCI-004399":"Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are written in plain language.","CCI-004400":"Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are organized in a way that is easy to understand and navigate.","CCI-004401":"Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that provide information needed by the public to make an informed about whether and how to interact with the organization.","CCI-004402":"Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are updated whenever the organization makes a substantive change to the practices it describes.","CCI-004403":"Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that includes a time/date stamp to inform the public of the date of the most recent changes.","CCI-004404":"Develop an accurate accounting of disclosures of personally identifiable information.","CCI-004405":"Maintain an accurate accounting of disclosures of personally identifiable information.","CCI-004406":"Develop an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record.","CCI-004407":"Maintain an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record.","CCI-004408":"Develop an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made.","CCI-004409":"Maintain an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made.","CCI-004410":"Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.","CCI-004411":"Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.","CCI-004412":"Develop and document organization-wide policies for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle.","CCI-004413":"Develop and document organization-wide procedures for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle.","CCI-004414":"Develop and document organization-wide policies for correcting or deleting inaccurate or outdated personally identifiable information.","CCI-004415":"Develop and document organization-wide procedures for correcting or deleting inaccurate or outdated personally identifiable information.","CCI-004416":"Develop and document organization-wide policies for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.","CCI-004417":"Develop and document organization-wide procedures for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.","CCI-004418":"Develop and document organization-wide policies for appeals of adverse decisions on correction or deletion requests.","CCI-004419":"Develop and document organization-wide procedures for appeals of adverse decisions on correction or deletion requests.","CCI-004420":"Establish a Data Governance Body consisting of organization-defined roles with organization-defined responsibilities.","CCI-004421":"Defines the roles that are established by the Data Governance Body.","CCI-004422":"Defines the responsibilities the Data Governance Body establishes.","CCI-004423":"Establish a Data Integrity Board to review proposals to conduct or participate in a matching program.","CCI-004424":"Establish a Data Integrity Board to conduct an annual review of all matching programs in which the agency has participated.","CCI-004425":"Develop and document policies that address the use of personally identifiable information for internal testing, training, and research.","CCI-004426":"Develop and document procedures that address the use of personally identifiable information for internal testing, training, and research.","CCI-004427":"Implement policies that address the use of personally identifiable information for internal testing, training, and research.","CCI-004428":"Implement procedures that address the use of personally identifiable information for internal testing, training, and research.","CCI-004429":"Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes.","CCI-004430":"Authorize the use of personally identifiable information when such information is required for internal testing, training, and research.","CCI-004431":"Review and update policies on an organization-defined frequency.","CCI-004432":"Defines the frequency of which the policies should be reviewed and updated.","CCI-004433":"Review and update procedures on an organization-defined frequency.","CCI-004434":"Defines the frequency of which the procedures should be reviewed and updated.","CCI-004435":"Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational security practices.","CCI-004436":"Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational privacy practices.","CCI-004437":"Implement mechanisms that are easy to use.","CCI-004438":"Implement mechanisms that are readily available by the public.","CCI-004439":"Implement all information necessary for successfully filing complaints.","CCI-004440":"Implement tracking mechanisms to ensure all complaints received are reviewed and appropriately addressed within an organization-defined time period.","CCI-004441":"Defines the time period of which the tracking mechanisms to ensure all complaints received are reviewed and addressed.","CCI-004442":"Implement acknowledgement of receipt of complaints, concerns, or questions from individuals within an organization-defined time period.","CCI-004443":"Defines the time period for acknowledging the receipt of complaints, concerns, or questions from individuals.","CCI-004444":"Implement response to complaints, concerns, or questions from individuals within an organization-defined time period.","CCI-004445":"Defines the time period for response to complaints, concerns, or questions from individuals.","CCI-004446":"Develop organization-defined privacy reports.","CCI-004447":"Defines the privacy reports that are to be developed.","CCI-004448":"Disseminate privacy reports to organization-defined oversight bodies to demonstrate accountability with statutory, regulatory, and policy privacy program mandates.","CCI-004449":"Develop privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program progress and compliance.","CCI-004450":"Disseminate privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program compliance.","CCI-004451":"Defines the officials responsible for monitoring privacy program compliance.","CCI-004452":"Review and update privacy reports on an organization-defined frequency.","CCI-004453":"Defines the frequency of which the privacy reports are reviewed and updated.","CCI-004454":"Identify and document assumptions affecting risk assessments, risk response, and risk monitoring.","CCI-004455":"Identify and document constraints affecting risk assessments, risk response, and risk monitoring.","CCI-004456":"Identify and document priorities and trade-offs considered by the organization for managing risk.","CCI-004457":"Identify and document the organizational risk tolerance.","CCI-004458":"Distribute the results of risk framing activities to organization-defined personnel.","CCI-004459":"Defines the personnel to distribute the results of risk framing activities.","CCI-004460":"Review and update risk framing considerations on an organization-defined frequency.","CCI-004461":"Defines the frequency for reviewing and updating risk framing considerations.","CCI-004462":"Appoint a Senior Accountable Official for Risk Management to align organizational information security management processes with strategic, operational, and budgetary planning processes.","CCI-004463":"Appoint a Senior Accountable Official for Risk Management to align organizational information privacy management processes with strategic, operational, and budgetary planning processes.","CCI-004464":"Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective.","CCI-004465":"Establish a Risk Executive (function) to ensure management of risk is consistent across the organization.","CCI-004466":"Develop an organization-wide strategy for managing supply chain risks associated with the development of systems, system components, and system services.","CCI-004467":"Develop an organization-wide strategy for managing supply chain risks associated with the acquisition of systems, system components, and system services.","CCI-004468":"Develop an organization-wide strategy for managing supply chain risks associated with the maintenance of systems, system components, and system services.","CCI-004469":"Develop an organization-wide strategy for managing supply chain risks associated with the disposal of systems, system components, and system services.","CCI-004470":"Implement the supply chain risk management strategy consistently across the organization.","CCI-004471":"Review and update the supply chain risk management strategy on an organization-defined frequency or as required, to address organizational changes.","CCI-004472":"Defines the frequency of which the supply chain risk management strategy will be reviewed and updated.","CCI-004473":"Develop an organization-wide continuous monitoring strategy establishing organization-defined metrics to be monitored.","CCI-004474":"Implement continuous monitoring programs that include establishing organization-wide metrics to be monitored.","CCI-004475":"Defines the metrics for developing and implementing continuous monitoring programs.","CCI-004476":"Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for monitoring.","CCI-004477":"Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for assessment of control effectiveness.","CCI-004478":"Defines the frequencies for developing and implementing continuous monitoring programs for monitoring.","CCI-004479":"Implement continuous monitoring programs that include establishing organization-wide frequencies for monitoring.","CCI-004480":"Implement continuous monitoring programs that include establishing organization-wide frequencies for assessment of control effectiveness.","CCI-004481":"Defines the frequencies for developing and implementing continuous monitoring programs for assessment of control effectiveness.","CCI-004482":"Develop an organization-wide continuous monitoring strategy for ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy.","CCI-004483":"Implement continuous monitoring programs that include ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy.","CCI-004484":"Develop an organization-wide continuous monitoring strategy for correlation and analysis of information generated by control assessments and monitoring.","CCI-004485":"Implement continuous monitoring programs that include correlation and analysis of information generated by control assessments and monitoring.","CCI-004486":"Develop an organization-wide continuous monitoring strategy for response actions to address results of the analysis of control assessment and monitoring information.","CCI-004487":"Implement continuous monitoring programs that include response actions to address results of the analysis of control assessment and monitoring information.","CCI-004488":"Develop an organization-wide continuous monitoring strategy for reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.","CCI-004489":"Develop an organization-wide continuous monitoring strategy for reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.","CCI-004490":"Implement continuous monitoring programs that include reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.","CCI-004491":"Implement continuous monitoring programs that include reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.","CCI-004492":"Defines the personnel or roles for whom to report the security status of organizational systems.","CCI-004493":"Defines the personnel or roles for whom to report the privacy status of organizational systems.","CCI-004494":"Defines the frequency of reporting the security status of organizational systems to organization-defined personnel or roles.","CCI-004495":"Defines the frequency of reporting the privacy status of organizational systems to organization-defined personnel or roles.","CCI-004496":"Analyze organization-defined systems or system components supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.","CCI-004497":"Defines the systems or system components that are used to analyze mission essential services or functions.","CCI-004498":"Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-004499":"Designate an organization-defined official to manage the development and documentation of the personnel security policy.","CCI-004500":"Designate an organization-defined official to manage the dissemination of the personnel security policy.","CCI-004501":"Defines the official who will manage the personnel security policy.","CCI-004502":"Designate an organization-defined official to manage development and documentation of the personnel security procedures.","CCI-004503":"Designate an organization-defined official to manage the dissemination of the personnel security procedures.","CCI-004504":"Defines the official who will manage the personnel security procedures.","CCI-004505":"Review and update the current personnel security policy following organization-defined events.","CCI-004506":"Defines the events following reviewing and updating the current personnel security policy.","CCI-004507":"Review and update the current personnel security procedures following organization-defined events.","CCI-004508":"Defines the events following reviewing and updating the current personnel security procedures.","CCI-004509":"Verify that individuals accessing a system processing, storing, or transmitting organization-defined information types meet organization-defined citizenship requirements.","CCI-004510":"Defines the information types that meet the organization-defined citizenship requirement.","CCI-004511":"Defines the citizenship requirements for individuals accessing a system, storing, or transmitting organization-defined information types.","CCI-004512":"Defines the automated mechanisms for notifying organization-defined personnel or roles of individual termination actions; and/or disable access to system resources.","CCI-004513":"Verify that individuals requiring access to organizational information sign appropriate access agreements prior to being granted access.","CCI-004514":"Verify that individuals requiring access to organizational systems sign appropriate access agreements prior to being granted access.","CCI-004515":"Verify that individuals requiring access to organizational information re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.","CCI-004516":"Verify that individuals requiring access to organizational systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.","CCI-004517":"Defines the frequency for individuals requiring access to organizational information to re-sign access agreements.","CCI-004518":"Defines the frequency for individuals requiring access to organizational systems to re-sign access agreements.","CCI-004519":"Require external providers to comply with personnel security policies established by the organization.","CCI-004520":"Require external providers to comply with personnel security procedures established by the organization.","CCI-004521":"Employ a formal sanctions process for individuals failing to comply with established information security policies.","CCI-004522":"Employ a formal sanctions process for individuals failing to comply with established information security procedures.","CCI-004523":"Incorporate security roles and responsibilities into organizational position descriptions.","CCI-004524":"Incorporate privacy roles and responsibilities into organizational position descriptions.","CCI-004525":"Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-004526":"Disseminate organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy to organization-defined personnel or roles.","CCI-004527":"Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy is to be disseminated.","CCI-004528":"Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.","CCI-004529":"Develop and document procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls.","CCI-004530":"Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency policy.","CCI-004531":"Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency procedures.","CCI-004532":"Defines the official designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures.","CCI-004533":"Review and update the current personally identifiable information processing and transparency policy on an organization-defined frequency.","CCI-004534":"Review and update the current personally identifiable information processing and transparency policy following organization-defined events.","CCI-004535":"Defines the events following reviewing and updating the current personally identifiable processing and transparency policy.","CCI-004536":"Review and update the current personally identifiable information processing and transparency procedures on an organization-defined frequency.","CCI-004537":"Review and update the current personally identifiable information processing and transparency procedures following organization-defined events.","CCI-004538":"Defines the events following reviewing and updating the current personally identifiable processing and transparency procedures.","CCI-004539":"Determine and document the organization-defined authority that permits the organization-defined processing of personally identifiable information.","CCI-004540":"Defines the authority who will permit the organization-defined processing of personally identifiable information.","CCI-004541":"Defines the processing of the personally identifiable information.","CCI-004542":"Restrict the organization-defined processing of personally identifiable information to only that which is authorized.","CCI-004543":"Defines the processing of the personally identifiable information to only that which is authorized.","CCI-004544":"Attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information.","CCI-004545":"Defines the authorized processing which will attach data tags to organization-defined elements of personally identifiable information.","CCI-004546":"Defines the elements of personally identifiable information containing organization-defined authorized processing.","CCI-004547":"Manage enforcement of the authorized processing of personally identifiable information using organization-defined automated mechanisms.","CCI-004548":"Defines the automated mechanisms for managing enforcement of the authorized processing of personally identifiable information.","CCI-004549":"Identify and document the organization-defined purpose(s) for processing personally identifiable information.","CCI-004550":"Defines the purpose(s) of identifying and documenting personally identifiable information.","CCI-004551":"Describe the purpose(s) in the public privacy notices and policies of the organization.","CCI-004552":"Restrict the organization-defined processing of personally identifiable information to only that which is compatible with the identified purpose(s).","CCI-004553":"Defines the processing of personally identifiable information to only that which is compatible with the identified purpose(s).","CCI-004554":"Monitor changes in processing personally identifiable information.","CCI-004555":"Implement organization-defined mechanisms to ensure that any changes are made in accordance with organization-defined requirements.","CCI-004556":"Defines the mechanisms for ensuring any changes are made in accordance with organization-defined requirements.","CCI-004557":"Defines the requirements for implementing organization-defined mechanisms.","CCI-004558":"Attach data tags containing organization-defined processing purposes to organization-defined elements of personally identifiable information.","CCI-004559":"Defines the elements of personally identifiable information containing organization-defined processing purposes.","CCI-004560":"Track processing purposes of personally identifiable information using organization-defined automated mechanisms.","CCI-004561":"Implement organization-defined tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making.","CCI-004562":"Defines the tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making.","CCI-004563":"Provide organization-defined mechanisms to allow individuals to tailor processing permissions to selected elements of personally identifiable information.","CCI-004564":"Defines the mechanisms for allowing individuals to tailor processing permissions to selected elements of personally identifiable information.","CCI-004565":"Present organization-defined consent mechanisms to individuals at an organization-defined frequency and in conjunction with organization-defined personally identifiable information processing.","CCI-004566":"Defines the frequency for presenting organization-defined consent mechanisms to individuals.","CCI-004567":"Defines the consent mechanisms needed by individuals on an organization-defined frequency, with organization-defined personally identifiable information processing.","CCI-004568":"Defines the personally identifiable information processing needed for presenting organization-defined consent mechanisms to individuals.","CCI-004569":"Implement organization-defined tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information.","CCI-004570":"Defines the tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information.","CCI-004571":"Provide notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization, and subsequently at an organization-defined frequency.","CCI-004572":"Defines the frequency for providing notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization.","CCI-004573":"Provide notice to individuals about the processing of personally identifiable information is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language.","CCI-004574":"Provide notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information.","CCI-004575":"Provide notice to individuals about the processing of personally identifiable information that identifies the purposes for which personally identifiable information is to be processes.","CCI-004576":"Provide notice to individuals about the processing of personally identifiable information that includes organization-defined information.","CCI-004577":"Defines the information that includes providing notice to individuals about the processing of personally identifiable information.","CCI-004578":"Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action or organization-defined frequency.","CCI-004579":"Defines the frequency for presenting notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action.","CCI-004580":"Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.","CCI-004581":"For systems that process information that will be maintained in a Privacy Act system of records: draft system of records notices in accordance with OMB guidance.","CCI-004582":"For systems that process information that will be maintained in a Privacy Act system of records: submit new and significantly modified system of records notices to the OMB and appropriate committees for advance review.","CCI-004583":"For systems that process information that will be maintained in a Privacy Act system of records: publish system of records notices in the Federal Register.","CCI-004584":"For systems that process information that will be maintained in a Privacy Act system of records: keep system of records notices accurate, up-to-date, and scoped in accordance with policy.","CCI-004585":"Review all routine uses published in the system of records notice at an organization-defined frequency to ensure continued accuracy.","CCI-004586":"Defines the frequency for reviewing all routine uses in published in the system of records notice.","CCI-004587":"Review all routine uses published in the system of records notice at an organization-defined frequency to ensure that routine uses continue to be compatible with the purpose for which the information was collected.","CCI-004588":"Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they remain appropriate and necessary with law.","CCI-004589":"Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they have been promulgated as regulations.","CCI-004590":"Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure that they are accurately described in the system of records notice.","CCI-004591":"Defines the frequency for reviewing all Privacy Act exemptions claimed for the system of records.","CCI-004592":"Apply organization-defined processing conditions for specific categories of personally identifiable information.","CCI-004593":"Defines the processing conditions for applying specific categories of personally identifiable information.","CCI-004594":"When a system processes Social Security numbers: eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier.","CCI-004595":"When a system processes Social Security numbers: do not deny any individuals any right, benefit, or privilege provided by law because of such individuals' refusal to disclose his or her Social Security number.","CCI-004596":"When a system processes Social Security numbers: inform any individual who is asked to disclose his or Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.","CCI-004597":"Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statue or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.","CCI-004598":"When a system or organization processes information for the purpose of conducting a matching program: obtain approval from the Data Integrity Board to conduct the matching program.","CCI-004599":"When a system or organization processes information for the purpose of conducting a matching program: develop and enter into a computer matching agreement.","CCI-004600":"When a system or organization processes information for the purpose of conducting a matching program: publish a matching notice in the Federal Register.","CCI-004601":"When a system or organization processes information for the purpose of conducting a matching program: independently verify the information produced by the matching program before taking adverse action against an individual, if required.","CCI-004602":"When a system or organization processes information for the purpose of conducting a matching program: provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.","CCI-004603":"Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-004604":"Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines, to organization-defined personnel or roles.","CCI-004605":"Designate an organization-defined official to manage the development and documentation of the risk assessment policy.","CCI-004606":"Designate an organization-defined official to manage the dissemination of the risk assessment policy.","CCI-004607":"Designate an organization-defined official to manage development and documentation of the risk assessment procedures.","CCI-004608":"Designate an organization-defined official to manage dissemination of the risk assessment procedures.","CCI-004609":"Defines the official designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures.","CCI-004610":"Review and update the current risk assessment policy following organization-defined events.","CCI-004611":"Defines the events following reviewing and updating the current risk assessment policy.","CCI-004612":"Review and update the current risk assessment procedures following organization-defined events.","CCI-004613":"Defines the events following reviewing and updating the current risk assessment procedures.","CCI-004614":"Categorize the system and information it processes.","CCI-004615":"Categorize the system and information it stores.","CCI-004616":"Categorize the system and information it transmits.","CCI-004617":"Conduct a impact-level categorization of organizational systems to obtain additional granularity on system impact levels.","CCI-004618":"Conduct a risk assessment, including identifying threats to the system.","CCI-004619":"Conduct a risk assessment, including identifying vulnerabilities in the system.","CCI-004620":"Conduct a risk assessment, including determining the likelihood and impact of adverse effects on individuals arising from the processing of personally-identifiable information.","CCI-004621":"Integrate risk assessment results from the organization.","CCI-004622":"Integrate risk management decisions from the organization.","CCI-004623":"Integrate mission or business process perspectives with system-level risk assessments.","CCI-004624":"Assess supply chain risks associated with organization-defined systems, system components, and system services.","CCI-004625":"Defines the systems, system-components, and system services for assessing supply chain risks.","CCI-004626":"Update the supply chain risk assessment on an organization-defined frequency when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.","CCI-004627":"Defines the frequency for updating the supply chain assessment.","CCI-004628":"Use all-source intelligence to assist in the analysis of risk.","CCI-004629":"Determine the current cyber threat environment on an ongoing basis using organization-defined means.","CCI-004630":"Defines the means for determining the current threat environment.","CCI-004631":"Employ organization-defined advanced automation and analytics capabilities to predict and identify risks to organization-defined systems or system components.","CCI-004632":"Defines the advanced automation and analytics capabilities for predicting and identifying risks to organization-defined systems or system components.","CCI-004633":"Defines the systems or system components for employing advanced automation and analytics capabilities.","CCI-004634":"Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: formatting checklists and test procedures.","CCI-004635":"Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: measuring vulnerability impact.","CCI-004636":"Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.","CCI-004637":"Defines the automated mechanisms for comparing the results of multiple vulnerability scans.","CCI-004638":"Defines the system in which will be identified for determining if a vulnerability has been exploited.","CCI-004639":"Defines the time period for reviewing historic audit logs to determine if a vulnerability identified has been exploited.","CCI-004640":"Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.","CCI-004641":"Respond to findings from security assessments.","CCI-004642":"Respond to findings from privacy assessments.","CCI-004643":"Respond to findings from monitoring.","CCI-004644":"Respond to findings from audits in accordance with organizational risk tolerance.","CCI-004645":"Conduct privacy impact assessments for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information.","CCI-004646":"Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that will be processes using information technology.","CCI-004647":"Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more persons, other than agencies, instrumentalities, or employees of the Federal Government.","CCI-004648":"Identify critical system components and functions by performing a criticality analysis for organization-defined systems, system components, or system services at organization-defined decision points in the system development life cycle.","CCI-004649":"Defines the system, system components, or system services to perform a criticality analysis for identifying critical system components and functions.","CCI-004650":"Defines the decision points in the system development life cycle at which organization-defined system, system components, or system services to perform a criticality analysis for identifying critical system components and functions.","CCI-004651":"Establish and maintain a cyber threat hunting capability to search for indicators of compromise in organizational systems.","CCI-004652":"Establish and maintain a cyber threat hunting capability to detect, track, and disrupt threats that evade existing controls.","CCI-004653":"Employ the threat hunting capability on an organization-defined frequency.","CCI-004654":"Defines the frequency for employing the threat hunting capability.","CCI-004655":"Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that is consistent with applicable laws, Executive Orders, directives, regulations, polices, standards, and guidelines.","CCI-004656":"Designate an organization-defined official to manage development and documentation of the system and services acquisition policy.","CCI-004657":"Designate an organization-defined official to manage dissemination of the system and services acquisition policy.","CCI-004658":"Defines the official designated to manage development and documentation of the system and services acquisition policy.","CCI-004659":"Designate an organization-defined official to manage the development and documentation of the system and services acquisition procedures.","CCI-004660":"Designate an organization-defined official to manage the dissemination of the system and services acquisition procedures.","CCI-004661":"Defines the official designated to manage the system and services acquisition procedures.","CCI-004662":"Review and update the current system and services acquisition policy following organization-defined events.","CCI-004663":"Defines the events following reviewing and updating the current system and services acquisition policy.","CCI-004664":"Review and update the current system and services acquisition procedures following organization-defined events.","CCI-004665":"Defines the events following reviewing and updating the current system and services acquisition procedures.","CCI-004666":"Determine the high-level information privacy requirements for the system or system service in mission and business process planning.","CCI-004667":"Establish a discrete line item for information privacy in organizational programming documentation.","CCI-004668":"Establish a discrete line item for information privacy in organizational budgeting documentation.","CCI-004669":"Acquire the system using an organization-defined system development life cycle that incorporates information security considerations.","CCI-004670":"Acquire the system using an organization-defined system development life cycle that incorporates information privacy considerations.","CCI-004671":"Develop the system using an organization-defined system development life cycle that incorporates information security considerations.","CCI-004672":"Develop the system using an organization-defined system development life cycle that incorporates information privacy considerations.","CCI-004673":"Manage the system using an organization-defined system development life cycle that incorporates information privacy considerations.","CCI-004674":"Defines a system development life cycle that is used to develop the system.","CCI-004675":"Defines a system development life cycle that is used to acquire the system.","CCI-004676":"Define and document information system privacy roles and responsibilities throughout the system development life cycle.","CCI-004677":"Identify individuals having information system privacy roles and responsibilities.","CCI-004678":"Integrate the organizational information privacy risk management process into system development life cycle activities.","CCI-004679":"Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service.","CCI-004680":"Approve the use of live data in preproduction environments for the system, system component, or system service.","CCI-004681":"Document the use of live data in preproduction environments for the system, system component, or system service.","CCI-004682":"Control the use of live data in preproduction environments for the system, system component, or system service.","CCI-004683":"Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments.","CCI-004684":"Plan for a technology refresh schedule to support the system throughout the system development life cycle.","CCI-004685":"Implement technology refresh schedule to support the system throughout the system development life cycle.","CCI-004686":"Defines the organization-defined contract language for including the requirements, descriptions, and criteria in the acquisition contract for the system, system component, or system service.","CCI-004687":"Include the privacy functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004688":"Include the privacy assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004689":"Include the controls needed to satisfy security requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004690":"Include the controls needed to satisfy privacy requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004691":"Include the privacy documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004692":"Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004693":"Include the requirements for protecting privacy documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004694":"Include the allocation of responsibility or identification of parties responsible for information security, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004695":"Include the allocation of responsibility or identification of parties responsible for information privacy, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004696":"Include the allocation of responsibility or identification of parties responsible for supply chain risk management, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.","CCI-004697":"Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined systems engineering methods.","CCI-004698":"Defines the systems engineering methods for demonstrating the use of a system development life cycle process.","CCI-004699":"Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined system security engineering methods and/or privacy engineering methods.","CCI-004700":"Defines the system security engineering methods and/or privacy engineering methods for demonstrating the use of a system development life cycle process.","CCI-004701":"Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes.","CCI-004702":"Defines the software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes for demonstrating the use of a system development life cycle process.","CCI-004703":"Include organization-defined Privacy Act requirements in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.","CCI-004704":"Defines the Privacy Act requirements to include in the acquisition contract.","CCI-004705":"Include organizational data ownership requirements in the acquisition contract.","CCI-004706":"Require all data to be removed from the contractor's system and returned to the organization within an organization-defined time frame.","CCI-004707":"Defines the time frame for returning the data removed from the contractor's system.","CCI-004708":"Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of privacy functions and mechanisms.","CCI-004709":"Obtain or develop user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms and how to effectively use those functions and mechanisms.","CCI-004710":"Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to protect individual privacy.","CCI-004711":"Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the privacy of individuals.","CCI-004712":"Defines the systems security and privacy engineering principles applied to the specification of the system and system components.","CCI-004713":"Defines the systems security engineering principles applied to the design of the system and system components.","CCI-004714":"Defines the systems security engineering principles applied to the development of the system and system components.","CCI-004715":"Defines the systems security engineering principles applied to the implementation of the system and system components.","CCI-004716":"Defines the systems security engineering principles applied to the modification of the system and system components.","CCI-004717":"Implement the security design principle of clear abstractions.","CCI-004718":"Implement the security design principle of least common mechanism in organization-defined systems or system components.","CCI-004719":"Defines the systems or system components which will implement the security design principle of least common mechanism.","CCI-004720":"Implement the security design principles of modularity and layering in organization-defined systems or system components.","CCI-004721":"Defines the systems or system components which will implement the security design principles of modularity and layering.","CCI-004722":"Implement the security design principle of partially ordered dependencies in organization-defined systems or system components.","CCI-004723":"Defines the systems or system components which will implement the security design principle of partially ordered dependencies.","CCI-004724":"Implement the security design principle of efficiently mediated access in organization-defined systems or system components.","CCI-004725":"Defines the systems or system components which will implement the security design principle of efficiently mediated access.","CCI-004726":"Implement the security design principle of minimized sharing in organization-defined systems or system components.","CCI-004727":"Defines the systems or system components which will implement the security design principle of minimized sharing.","CCI-004728":"Implement the security design principle of reduced complexity in organization-defined systems or system components.","CCI-004729":"Defines the systems or system components which will implement the security design principle of reduced complexity.","CCI-004730":"Implement the security design principle of secure evolvability in organization-defined systems or system components.","CCI-004731":"Defines the systems or system components which will implement the security design principle of secure evolvability.","CCI-004732":"Implement the security design principle of trusted components in organization-defined systems or system components.","CCI-004733":"Defines the systems or system components which will implement the security design principle of trusted components.","CCI-004734":"Implement the security design principle of hierarchical trust in organization-defined systems or system components.","CCI-004735":"Defines the systems or system components which will implement the security design principle of hierarchical trust.","CCI-004736":"Implement the security design principle of inverse modification threshold in organization-defined systems or system components.","CCI-004737":"Defines the systems or system components which will implement the security design principle of inverse modification threshold.","CCI-004738":"Implement the security design principle of hierarchical protection in organization-defined systems or system components.","CCI-004739":"Defines the systems or system components which will implement the security design principle of hierarchical protection.","CCI-004740":"Implement the security design principle of minimized security elements in organization-defined systems or system components.","CCI-004741":"Defines the systems or system components which will implement the security design principle of minimized security elements.","CCI-004742":"Implement the security design principle of least privilege in organization-defined systems or system components.","CCI-004743":"Defines the systems or system components which will implement the security design principle of least privilege.","CCI-004744":"Implement the security design principle of predicate permission in organization-defined systems or system components.","CCI-004745":"Defines the systems or system components which will implement the security design principle of predicate permission.","CCI-004746":"Implement the security design principle of self-reliant trustworthiness in organization-defined systems or system components.","CCI-004747":"Defines the systems or system components which will implement the security design principle of self-reliant trustworthiness.","CCI-004748":"Implement the security design principle of secure distributed composition in organization-defined systems or system components.","CCI-004749":"Defines the systems or system components which will implement the security design principle of secure distributed composition.","CCI-004750":"Implement the security design principle of trusted communication channels in organization-defined systems or system components.","CCI-004751":"Defines the systems or system components which will implement the security design principle of trusted communication channels.","CCI-004752":"Implement the security design principle of continuous protection in organization-defined systems or system components.","CCI-004753":"Defines the systems or system components which will implement the security design principle of continuous protection.","CCI-004754":"Implement the security design principle of secure metadata management in organization-defined systems or system components.","CCI-004755":"Defines the systems or system components which will implement the security design principle of secure metadata management.","CCI-004756":"Implement the security design principle of self-analysis in organization-defined systems or system components.","CCI-004757":"Defines the systems or system components which will implement the security design principle of self-analysis.","CCI-004758":"Implement the security design principle of accountability and traceability in organization-defined systems or system components.","CCI-004759":"Defines the systems or system components which will implement the security design principle of accountability and traceability.","CCI-004760":"Implement the security design principle of secure defaults in organization-defined systems or system components.","CCI-004761":"Defines the systems or system components which will implement the security design principle of secure defaults.","CCI-004762":"Implement the security design principle of secure failure and recovery in organization-defined systems or system components.","CCI-004763":"Defines the systems or system components which will implement the security design principle of secure failure and recovery.","CCI-004764":"Implement the security design principle of economic security in organization-defined systems or system components.","CCI-004765":"Defines the systems or system components which will implement the security design principle of economic security.","CCI-004766":"Implement the security design principle of performance security in organization-defined systems or system components.","CCI-004767":"Defines the systems or system components which will implement the security design principle of performance security.","CCI-004768":"Implement the security design principle of human factored security in organization-defined systems or system components.","CCI-004769":"Defines the systems or system components which will implement the security design principle of human factored security.","CCI-004770":"Implement the security design principle of acceptable security in organization-defined systems or system components.","CCI-004771":"Defines the systems or system components which will implement the security design principle of acceptable security.","CCI-004772":"Implement the security design principle of repeatable and documented procedures in organization-defined systems or system components.","CCI-004773":"Defines the systems or system components which will implement the security design principle of repeatable and documented procedures.","CCI-004774":"Implement the security design principle of procedural rigor in organization-defined systems or system components.","CCI-004775":"Defines the systems or system components which will implement the security design principle of procedural rigor.","CCI-004776":"Implement the security design principle of secure system modification in organization-defined systems or system components.","CCI-004777":"Defines the systems or system components which will implement the security design principle of secure system modification.","CCI-004778":"Implement the security design principle of sufficient documentation in organization-defined systems or system components.","CCI-004779":"Defines the systems or system components which will implement the security design principle of sufficient documentation.","CCI-004780":"Implement the privacy principle of minimization using organization-defined processes.","CCI-004781":"Defines the processes for implementing the privacy principle of minimization.","CCI-004782":"Require that providers of external system services comply with organizational privacy requirements.","CCI-004783":"Require that providers of external system services employ organization-defined controls.","CCI-004784":"Defines the controls for complying with organizational security and privacy requirements.","CCI-004785":"Define and document organizational oversight with regard to external system services.","CCI-004786":"Define and document user roles and responsibilities with regard to external system services.","CCI-004787":"Establish trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.","CCI-004788":"Document trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.","CCI-004789":"Maintain trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.","CCI-004790":"Defines privacy requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.","CCI-004791":"Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.","CCI-004792":"Provide the capability to check the integrity of organizational information while it resides in the external system.","CCI-004793":"Restrict the geographic location of information processing and data storage to facilities located within the legal jurisdictional boundary of the United States.","CCI-004794":"Require the developer of the system, system component, or system service to document the potential privacy impacts of approved changes to the system, component, or service.","CCI-004795":"Require organization-defined security and privacy representatives to be included in the organization-defined configuration change management and control process.","CCI-004796":"Defines the security and privacy representatives to be included the organization-defined configuration change management and control process.","CCI-004797":"Defines the configuration change management and control process required for the organization-defined security and privacy representatives.","CCI-004798":"Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing privacy control assessment.","CCI-004799":"Require the developer of the system, system component, or system service to implement a plan for ongoing privacy control assessment.","CCI-004800":"Defines the frequency that the unit, integration, system, and/or regression testing/evaluation is performed at an organization-defined depth and coverage.","CCI-004801":"Use the following contextual information.","CCI-004802":"Defines the information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.","CCI-004803":"Employ the following tools and methods.","CCI-004804":"Defines the tools and methods to be employed.","CCI-004805":"Conduct the modeling and analyses as the following level of rigor.","CCI-004806":"Defines the breadth and depth of modeling and analyses the level of rigor will be conducted.","CCI-004807":"Produces evidence that meets the following acceptance criteria.","CCI-004808":"Defines the acceptance criteria that meets the requirement for producing evidence.","CCI-004809":"Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer privacy assessment plan.","CCI-004810":"Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during privacy testing and evaluation.","CCI-004811":"Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer privacy assessment plan and the evidence produced during privacy testing and evaluation.","CCI-004812":"Require the developer of the system, system component, or system service to perform penetration testing at an organization-defined breadth and depth of testing.","CCI-004813":"Require the developer of the system, system component, or system service to perform penetration testing under organization-defined constraints.","CCI-004814":"Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws.","CCI-004815":"Require the developer of the system, system component, or system service to employ interactive application security testing tools to document the results.","CCI-004816":"Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses privacy requirements.","CCI-004817":"Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined privacy requirements.","CCI-004818":"Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined privacy requirements.","CCI-004819":"Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined privacy requirements.","CCI-004820":"Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements.","CCI-004821":"Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements.","CCI-004822":"Defines the privacy requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations.","CCI-004823":"Require the developer of the system, system component, or system service to select a privacy tracking tool for use during the development process.","CCI-004824":"Require the developer of the system, system component, or system service to employ a privacy tracking tool for use during the development process.","CCI-004825":"Require the developer of the system, system component, or system service to perform a criticality analysis at the organization-defined decision points in the system development life cycle.","CCI-004826":"Require the developer of the system, system component, or system service to perform a criticality analysis at an organization-defined breadth/depth of criticality analysis.","CCI-004827":"Defines the frequency for performing an automated vulnerability analysis using organization-defined tools.","CCI-004828":"Defines the frequency for determining the exploitation potential for discovered vulnerabilities.","CCI-004829":"Defines the frequency for determining potential risk mitigations for delivered vulnerabilities.","CCI-004830":"Defines the frequency for delivering the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles.","CCI-004831":"Require the developer of the system, system component, or system service to implement an incident response plan.","CCI-004832":"Require the developer of the system, system component, or system service to test an incident response plan.","CCI-004833":"Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final privacy review.","CCI-004834":"Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.","CCI-004835":"Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms.","CCI-004836":"Defines the training the developer of the system, system component, or information system service is required to provide on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms.","CCI-004837":"Require the developer of the system, system component, or system service to produce a privacy architecture.","CCI-004838":"Require the developer of the system, system component, or system service to produce a privacy architecture that is consistent with and supportive of the organization's privacy architecture which is established within and is an integrated part of the organization's enterprise architecture.","CCI-004839":"Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the required privacy functionality.","CCI-004840":"Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the allocation of privacy controls among physical and logical components.","CCI-004841":"Require the developer of the system, system component, or system service to produce a privacy architecture that expresses how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.","CCI-004842":"Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational privacy policy to be enforced.","CCI-004843":"Defines the elements of organizational privacy policy to be described in the formal policy model for enforcement on the system, system component, or system service.","CCI-004844":"Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational privacy policy when implemented.","CCI-004845":"Design organization-defined critical systems or system components with coordinated behavior to implement organization-defined capabilities, by system or component.","CCI-004846":"Defines the critical systems or system components for implementing organization-defined capabilities, by system or component.","CCI-004847":"Defines the capabilities, by system or component, for designing organization-defined critical systems or system components.","CCI-004848":"Use different designs for organization-defined critical systems or system components to satisfy a common set of requirements or to provide equivalent functionality.","CCI-004849":"Defines the critical systems or system components for satisfying a common set of requirements or to provide equivalent functionality.","CCI-004850":"Employ design; modification; augmentation; and/or reconfiguration on organization-defined systems or system components supporting mission essential services or functions to increase the trustworthiness in those systems or components.","CCI-004851":"Defines the systems or system components for supporting mission essential services or functions.","CCI-004852":"Develop and document an organization-level; mission/business process-level; and/or system-level system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-004853":"Develop and document an organization-level; mission/business process-level; and/or system-level a system and communications protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-004854":"Develop and document system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.","CCI-004855":"Designate an organization-defined official to manage the development and documentation of the system and communications protection policy.","CCI-004856":"Designate an organization-defined official to manage the development and documentation of the system and communications protection procedures.","CCI-004857":"Designate an organization-defined official to manage the dissemination of the system and communications protection policy.","CCI-004858":"Designate an organization-defined official to manage the dissemination of the system and communications protection procedures.","CCI-004859":"Defines the official to manage the development, documentation, and dissemination of the system and communications protection policy.","CCI-004860":"Defines the official to manage the development, documentation, and dissemination of the system and communications protection procedures.","CCI-004861":"Review and update the current system and communications protection policy following organization-defined events.","CCI-004862":"Defines the events following reviewing and updating the current system and communications protection policy.","CCI-004863":"Review and update the current system and communications protection procedures following organization-defined events.","CCI-004864":"Defines the events following reviewing and updating the current system and communications protection procedures.","CCI-004865":"Store state information from applications and software separately.","CCI-004866":"Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.","CCI-004867":"Defines the controls by type of denial-of-service event by employing the controls to achieve the denial-of-service objective.","CCI-004868":"Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational privacy architecture.","CCI-004869":"Prevent unauthorized exchange of control plane traffic with external networks.","CCI-004870":"Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks.","CCI-004871":"Filter unauthorized control plane traffic from external networks.","CCI-004872":"Defines the systems that will deny network communications traffic by default and allow network communications traffic by exception.","CCI-004873":"Defines the safeguards to prevent split tunneling for remote devices connecting to organizational systems.","CCI-004874":"Conduct exfiltration tests at an organization-defined frequency.","CCI-004875":"Defines the frequency to conduct exfiltration tests.","CCI-004876":"For systems that process personally identifiable information, apply organization-defined processing rules to data elements of personally identifiable information.","CCI-004877":"Defines processing rules to be applied to data elements of personally identifiable information.","CCI-004878":"For systems that process personally identifiable information, monitor for permitted processing at the external boundary of the system and at key internal boundaries within the system.","CCI-004879":"For systems that process personally identifiable information, document each processing exception.","CCI-004880":"For systems that process personally identifiable information, review and remove exceptions that are no longer supported.","CCI-004881":"Prohibit the direct connection of organization-defined unclassified national security system to an external network without the use of organization-defined boundary protection device.","CCI-004882":"Defines the unclassified national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device.","CCI-004883":"Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified national security system to an external system.","CCI-004884":"Prohibit the direct connection of a classified national security system to an external network without the use of organization-defined boundary protection device.","CCI-004885":"Defines the boundary protection device that prohibits the direct connection of a classified national security system to an external system.","CCI-004886":"Prohibit the direct connection of organization-defined unclassified non-national security system to an external network without the use of organization-defined boundary protection device.","CCI-004887":"Defines the unclassified non-national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device.","CCI-004888":"Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified non-national security system to an external system.","CCI-004889":"Prohibit the direct connection of organization-defined system to a public network.","CCI-004890":"Defines the system that prohibits the direct connection to a public network.","CCI-004891":"Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.","CCI-004892":"Defines the critical system components to implement physically or logically separate subnetworks.","CCI-004893":"Implement organization-defined protection distribution system to prevent unauthorized disclosure of information, and/or detect changes to information during transmission.","CCI-004894":"Defines the protected distribution system for preventing unauthorized disclosure of information, and/or detect changes to information during transmission.","CCI-004895":"Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication.","CCI-004896":"Initiates the trusted communications path for communications between the organization-defined security functions of the system and the user.","CCI-004897":"Defines the security functions to be initiated between the system and the user for trusted communications path for communications.","CCI-004898":"Defines requirements for certificates that are issued for producing, controlling, and distributing asymmetric cryptographic keys.","CCI-004899":"Maintain physical control of cryptographic keys when store information is encrypted by external service providers.","CCI-004900":"Determine the organization-defined cryptographic uses.","CCI-004901":"Associate organization-defined privacy attributes with information exchanged between systems.","CCI-004902":"Associate organization-defined privacy attributes with information exchanged between system components.","CCI-004903":"Defines the privacy attributes to associate with the information being exchanged between systems and between system components.","CCI-004904":"Verify the integrity of transmitted privacy attributes.","CCI-004905":"Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.","CCI-004906":"Implement organization-defined mechanisms or techniques to bind security attributes to transmitted information.","CCI-004907":"Implement organization-defined mechanisms or techniques to bind privacy attributes to transmitted information.","CCI-004908":"Defines the mechanisms or techniques for binding security and privacy attributes to transmitted information.","CCI-004909":"Include only approved trust anchors in trust stores or certificate stores managed by the organization.","CCI-004910":"Provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.","CCI-004911":"Defines the safeguards for providing protected storage for cryptographic keys.","CCI-004912":"Partition privileged functions into separate physical domains.","CCI-004913":"Takes organization-defined actions in response to identified faults, errors, or compromises.","CCI-004914":"Defines actions to take in response to identified faults, errors, or compromises.","CCI-004915":"Synchronize the organization-defined duplicate systems or system components.","CCI-004916":"Defines the duplicate systems or system components to be synchronized.","CCI-004917":"Defines sensors to facilitate an individual's awareness that personally identifiable information is being collected.","CCI-004918":"Defines measures to facility an individual's awareness that personally identifiable information is being collected.","CCI-004919":"Employ organization-defined measures to facilitate an individual's awareness that personally identifiable information is being collected by organization-defined sensors.","CCI-004920":"Defines sensors that are configured to minimize the collection of information about individuals that is not needed.","CCI-004921":"Employ organization-defined sensors that are configured to minimize the collection of information about individuals that is not needed.","CCI-004922":"Synchronize system clocks within and between systems or system components.","CCI-004923":"Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.","CCI-004924":"Defines the frequency for comparing the internal system clocks with organization-defined authoritative time source.","CCI-004925":"Defines the time source used for comparing the internal system clocks.","CCI-004926":"Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period.","CCI-004927":"Defines the time period for synchronizing the internal system clocks to the authoritative time source.","CCI-004928":"Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source.","CCI-004929":"Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable.","CCI-004930":"Implement a policy enforcement mechanism physically or logically between the physical and/or network interfaces for the connecting security domains.","CCI-004931":"Establish organization-defined alternate communications paths for system operations organizational command and control.","CCI-004932":"Relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances.","CCI-004933":"Defines the sensors and monitoring capabilities to be relocated to organization-defined locations.","CCI-004934":"Defines the locations of which the organization-defined sensors and monitoring capabilities will be relocated.","CCI-004935":"Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are relocated.","CCI-004936":"Dynamically relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances.","CCI-004937":"Defines the sensors and monitoring capabilities to be dynamically relocated to organization-defined locations.","CCI-004938":"Defines the locations of which the organization-defined sensors and monitoring capabilities will be dynamically relocated.","CCI-004939":"Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are dynamically relocated.","CCI-004940":"Implement hardware-enforced separation and policy enforcement mechanisms between organization-defined security domains.","CCI-004941":"Defines the security domains for implementing hardware-enforced separation and policy enforcement mechanisms.","CCI-004942":"Implement software-enforced separation and policy enforcement mechanisms between organization-defined security domains.","CCI-004943":"Defines the security domains for implementing software-enforced separation and policy enforcement mechanisms.","CCI-004944":"Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.","CCI-004945":"Designate an organization-defined official to manage the development and documentation of the system and information integrity policy.","CCI-004946":"Designate an organization-defined official to manage the dissemination of the system and information integrity policy.","CCI-004947":"Designate an organization-defined official to manage the development and documentation of the system and information integrity procedures.","CCI-004948":"Designate an organization-defined official to manage the dissemination of the system and information integrity procedures.","CCI-004949":"Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity policy.","CCI-004950":"Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity procedures.","CCI-004951":"Review and update the current system and information integrity policy following organization-defined events.","CCI-004952":"Defines the events following reviewing and updating the current system and information integrity policy.","CCI-004953":"Review and update the current system and information integrity procedures following organization-defined events.","CCI-004954":"Defines the events following reviewing and updating the current system and information integrity procedures.","CCI-004955":"Determine if system components have applicable security-related software updates installed using organization-defined mechanisms on an organization-defined frequency.","CCI-004956":"Determine if system components have applicable security-related firmware updates installed using organization-defined mechanisms on an organization-defined frequency.","CCI-004957":"Defines a frequency for installing security-relevant software updates using organization-defined automated mechanisms.","CCI-004958":"Defines a frequency for installing security-relevant firmware updates using organization-defined automated mechanisms.","CCI-004959":"Defines the automated mechanisms for determining if system components have applicable security-related software updates installed.","CCI-004960":"Defines the automated mechanisms for determining if system components have applicable security-related firmware updates installed.","CCI-004961":"Employ automated patch management tools to facilitate flaw remediation to the organization-defined system components.","CCI-004962":"Defines the system components on which patch management tools to facilitate flaw remediation are employed.","CCI-004963":"Implement signature based and/or non-signature based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.","CCI-004964":"Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy.","CCI-004965":"Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management procedures.","CCI-004966":"Configure malicious code protection mechanisms to send alerts to organization-defined personnel in response to malicious code detection.","CCI-004967":"Analyze detected events and anomalies.","CCI-004968":"Employ automated mechanisms to support near real-time analysis of events.","CCI-004969":"Employ automated mechanisms to integrate intrusion detection mechanisms into access control mechanisms.","CCI-004970":"Employ automated mechanisms to integrate intrusion detection mechanisms into flow control mechanisms.","CCI-004971":"Determine criteria for unusual or unauthorized activities or conditions for inbound communications traffic.","CCI-004972":"Determine criteria for unusual or unauthorized activities or conditions for outbound communications traffic.","CCI-004973":"Defines the unusual or unauthorized activities or conditions that will be monitored for inbound communications traffic.","CCI-004974":"Defines the unusual or unauthorized activities or conditions that will be monitored for outbound communications traffic.","CCI-004975":"Test intrusion monitoring mechanisms at an organization-defined frequency.","CCI-004976":"Defines the frequency for testing intrusion monitoring mechanisms.","CCI-004977":"Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring mechanisms.","CCI-004978":"Defines the system monitoring mechanisms that will have visibility into organization-defined encrypted communications traffic.","CCI-004979":"Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring mechanisms.","CCI-004980":"Defines the personnel or roles to receive alerts when indications of inappropriate or unusual activities with security or privacy occur.","CCI-004981":"Correlate information from monitoring mechanisms employed throughout the system.","CCI-004982":"Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.","CCI-004983":"Defines the automated mechanisms for broadcasting security alert and advisory information.","CCI-004984":"Defines the privacy functions that require verification of correct operation.","CCI-004985":"Verify correct operation of organization-defined privacy functions.","CCI-004986":"Defines the frequency at which it will verify correct operation of organization-defined privacy functions.","CCI-004987":"Defines the system transitional states when the system will verify correct operation of organization-defined privacy functions.","CCI-004988":"Perform verification of the correct operation of organization-defined privacy functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.","CCI-004989":"Alert organization-defined personnel or roles of failed privacy verification tests.","CCI-004990":"Defines the personnel or roles to be notified when privacy verification tests fail.","CCI-004991":"Defines alternative action(s) to be taken when anomalies in the operation of organization-defined privacy functions are discovered.","CCI-004992":"Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined privacy functions are discovered.","CCI-004993":"Implement automated mechanisms to support the management of distributed privacy function testing.","CCI-004994":"Report the results of privacy function verification to organization-defined personnel or roles.","CCI-004995":"Defines the personnel or roles that are to receive reports on the results of privacy function verification.","CCI-004996":"Take organization-defined actions when unauthorized changes to the software, firmware, and information are detected.","CCI-004997":"Defines the actions to be taken when unauthorized changes to the software, firmware, and information are detected.","CCI-004998":"Implement organization-defined controls for application self-protection at runtime.","CCI-004999":"Defines the controls to be implemented for runtime application self-protection.","CCI-005000":"Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy.","CCI-005001":"Update spam protection mechanisms when new releases are available in accordance with organizational configuration management procedures.","CCI-005002":"Defines the frequency for updating spam protection mechanisms.","CCI-005003":"Prevent untrusted data injections.","CCI-005004":"Limit personally identifiable information being processed in the information life cycle to the organization-defined elements of personally identifiable information.","CCI-005005":"Defines the elements of personally identifiable information being processed in the information life cycle.","CCI-005006":"Use organization-defined techniques to minimize the use of personally identifiable information for research, testing, or training, in accordance with the privacy risk assessment.","CCI-005007":"Defines the techniques for minimizing the use of personally identifiable information for research, testing, or training.","CCI-005008":"Use organization-defined techniques to dispose of, destroy, or erase information following the retention period.","CCI-005009":"Defines the percentage of the mean time to failure used to manually initiate transfer between active and standby system components.","CCI-005010":"Defines the action to be taken when system failures are detected.","CCI-005011":"Refresh organization-defined information on an organization-defined frequency, or generate organization-defined information on demand.","CCI-005012":"Defines the information to be refreshed on an organization-defined frequency.","CCI-005013":"Defines the frequency at which to refresh organization-defined information.","CCI-005014":"Defines the information to be generated on demand.","CCI-005015":"Delete information when no longer needed.","CCI-005016":"Refresh connections to the system on demand.","CCI-005017":"Terminate connections after completion of a request, or a period of non-use.","CCI-005018":"Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle, on an organization-defined frequency.","CCI-005019":"Defines the frequency for checking the accuracy, relevance, timeliness, and completeness of personally identifiable information.","CCI-005020":"Correct or delete inaccurate or outdated personally identifiable information.","CCI-005021":"Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using organization-defined mechanisms.","CCI-005022":"Defines the automated mechanisms for identifying inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified personally identifiable information.","CCI-005023":"Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.","CCI-005024":"Collect personally identifiable information directly from the individual.","CCI-005025":"Correct or delete personally identifiable information upon request by individuals or their designated representatives.","CCI-005026":"Notify organization-defined recipients of personally identifiable information that the personally identifiable information has been corrected or deleted.","CCI-005027":"Defines the recipients of personally identifiable information who are to be notified when the personally identifiable information is corrected or deleted.","CCI-005028":"Notify individuals that the personally identifiable information has been corrected or deleted.","CCI-005029":"Remove the following elements of personally identifiable information from datasets.","CCI-005030":"Defines the elements of personally identifiable information to be removed from datasets.","CCI-005031":"Evaluate organization-defined frequency for effectiveness of de-identification.","CCI-005032":"Defines the frequency for evaluating for effectiveness of de-identification.","CCI-005033":"De-identify the dataset upon collection by not collecting personally identifiable information.","CCI-005034":"Prohibit archiving personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.","CCI-005035":"Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.","CCI-005036":"Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.","CCI-005037":"Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.","CCI-005038":"Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.","CCI-005039":"Perform de-identification using validated algorithms and software that is validated to implement the algorithms.","CCI-005040":"Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.","CCI-005041":"Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization.","CCI-005042":"Defines the systems or system components used to determine if organizational data has been exfiltrated or improperly removed from the organization.","CCI-005043":"Refresh organization-defined information at organization-defined frequencies or generate the information on demand and delete the information when no longer needed.","CCI-005044":"Defines the information to be refreshed at organization-defined frequencies or generate the information on demand and delete the information when no longer needed.","CCI-005045":"Defines the frequencies for refreshing organization-defined information.","CCI-005046":"Identify the following alternate sources of information for organization-defined essential functions and services.","CCI-005047":"Defines the alternative information sources for identifying organization-defined essential functions and services.","CCI-005048":"Use an alternate information source for the execution of essential functions or services on organization-defined systems or system components when the primary source of information is corrupted or unavailable.","CCI-005049":"Defines the systems or system components used as an alternate information source for the execution of essential functions or services when the primary source of information is corrupted or unavailable.","CCI-005050":"Based on organization-defined circumstances, fragment the following information.","CCI-005051":"Defines the information for fragmentation.","CCI-005052":"Defines the circumstances for fragmenting organization-defined information.","CCI-005053":"Based on organization-defined circumstances, distribute the fragmented information across the following systems or system components.","CCI-005054":"Defines the systems or system components used to distribute fragmented information.","CCI-005055":"Defines the circumstances for distributing fragmented information across organization-defined systems or system components.","CCI-005056":"Disseminate an organization-level, mission/business process-level, and/or system-level supply chain risk management policy to organization-defined personnel or roles.","CCI-005057":"Develop and document an organization-level, mission/business process-level, and/or system-level supply chain risk management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.","CCI-005058":"Develop and document organization-level, mission/business process-level, and/or system-level supply chain risk management policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.","CCI-005059":"Develop and document procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls.","CCI-005060":"Designate an organization-defined official to manage the development and documentation of the supply chain risk management policy.","CCI-005061":"Designate an organization-defined official to manage the development and documentation of the supply chain risk management procedures.","CCI-005062":"Designate an organization-defined official to manage the dissemination of the supply chain risk management policy.","CCI-005063":"Designate an organization-defined official to manage the dissemination of the supply chain risk management procedures.","CCI-005064":"Review and update the current supply chain risk management policy on an organization-defined frequency.","CCI-005065":"Defines the frequency for reviewing and updating the current supply chain risk management policy.","CCI-005066":"Review and update the current supply chain risk management policy following organization-defined events.","CCI-005067":"Defines the events following reviewing and updating the current supply chain risk management policy.","CCI-005068":"Review and update the current supply chain risk management procedures on an organization-defined frequency.","CCI-005069":"Defines the frequency for reviewing and updating the current supply chain risk management procedures.","CCI-005070":"Review and update the current supply chain risk management procedures following organization-defined events.","CCI-005071":"Defines the events following reviewing and updating the current supply chain risk management procedures.","CCI-005072":"Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components, or system services.","CCI-005073":"Defines the systems, system components, or system services that a plan for managing supply chain risks are developed.","CCI-005074":"Review and update the supply chain risk management plan on an organization-defined frequency, or as required, to address threat, organizational or environmental changes.","CCI-005075":"Defines the frequency for reviewing and updating the supply chain risk management plan.","CCI-005076":"Protect the supply chain risk management plan from unauthorized disclosure and modification.","CCI-005077":"Establish a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities to lead and support the following SCRM activities.","CCI-005078":"Defines the supply chain risk management activities that will be led by a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities.","CCI-005079":"Defines the personnel, roles, and responsibilities who lead and support organization-defined supply chain risk management activities.","CCI-005080":"Establish a process of processes to identify and address weaknesses or deficiencies in the supply chain elements of organization-defined system or system components in coordination with organization-defined supply chain personnel.","CCI-005081":"Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.","CCI-005082":"Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.","CCI-005083":"Establish a process of processes to identify and address weaknesses or deficiencies in the processes of organization-defined system or system components in coordination with organization-defined supply chain personnel.","CCI-005084":"Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.","CCI-005085":"Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.","CCI-005086":"Employ the following controls to protect against supply chain risks to the system, system component, or system service.","CCI-005087":"Limit the harm or consequences from supply chain-related events.","CCI-005088":"Defines the supply chain controls employed for protecting against supply chain risks to the system, system component, or system service.","CCI-005089":"Document the selected and implemented supply chain processes and controls in security and privacy plans, supply chain risk management plan, or organization-defined document.","CCI-005090":"Defines the document which contains supply chain processes and controls.","CCI-005091":"Employ a diverse set of sources for the following system components and services.","CCI-005092":"Defines the system or system components and services which employ a diverse set of sources.","CCI-005093":"Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain.","CCI-005094":"Defines the controls to be employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.","CCI-005095":"Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.","CCI-005096":"Document valid provenance of the following systems, system components, and associated data.","CCI-005097":"Monitor valid provenance of the following systems, system components, and associated data.","CCI-005098":"Maintain valid provenance of the following systems, system components, and associated data.","CCI-005099":"Defines the systems, system components, and associated data for documenting, monitoring, and maintaining valid provenance.","CCI-005100":"Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components.","CCI-005101":"Defines the supply chain elements, processes, and personnel associated with organization-defined systems and critical system components for establishing and maintaining unique identification.","CCI-005102":"Establish and maintain unique identification of the following systems and critical components for tracking through the supply chain.","CCI-005103":"Defines the systems and critical system components for tracking through the supply chain.","CCI-005104":"Employ the following controls to validate that the system or system component received is genuine.","CCI-005105":"Employ the following controls to validate that the system or system component received has not been altered.","CCI-005106":"Defines the controls for validating that the system or system component received is genuine.","CCI-005107":"Defines the controls for validating that the system or system component received has not been altered.","CCI-005108":"Employ organization-defined controls to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services.","CCI-005109":"Defines the controls for ensuring the integrity of the system and system components.","CCI-005110":"Conduct organization-defined analysis to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services.","CCI-005111":"Defines the analysis for ensuring the integrity of the system and system components.","CCI-005112":"Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks.","CCI-005113":"Defines the acquisition strategies, contract tools, and procurement methods for protecting against, identifying, and mitigating supply chain risks.","CCI-005114":"Employ the following controls to ensure an adequate supply of organization-defined critical system components.","CCI-005115":"Defines the controls for ensuring an adequate supply of organization-defined critical system components.","CCI-005116":"Defines the critical system components that the organization-defined controls ensure an adequate supply of.","CCI-005117":"Access the system, system component, or system service prior to selection, acceptance, modification, or update.","CCI-005118":"Access and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide on an organization-defined frequency.","CCI-005119":"Defines the frequency for assessing and reviewing the supply chain risks.","CCI-005120":"Employ organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing of the following supply chain elements, processes, and actors associated with the system, system component, or system service.","CCI-005121":"Defines the supply chain elements, processes, and actors for employing organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing.","CCI-005122":"Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service.","CCI-005123":"Defines the Operations Security (OPSEC) controls that protect supply chain-related information for the system, system component, or system service.","CCI-005124":"Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the notification of supply chain compromises, results of assessments or audits, and/or organization-defined information.","CCI-005125":"Defines the information for establishing agreements and procedures with entities involved in the supply chain for the system, system component, or system service.","CCI-005126":"Implement a tamper protection program for the system, system component, or system service.","CCI-005127":"Employ anti-tamper technologies, tool, and techniques throughout the system development life cycle.","CCI-005128":"Inspect the following systems or system components at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.","CCI-005129":"Defines the frequency for inspecting systems or system components.","CCI-005130":"Defines the indications of need for inspection for detecting tampering.","CCI-005131":"Defines the system or system components which will be inspected at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.","CCI-005132":"Develop and document anti-counterfeit policy that include the means to detect and prevent counterfeit components from entering the system.","CCI-005133":"Develop and document anti-counterfeit procedures that include the means to detect and prevent counterfeit components from entering the system.","CCI-005134":"Report counterfeit system components to source of counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles.","CCI-005135":"Defines the external reporting organizations who report counterfeit system components.","CCI-005136":"Defines the personnel or roles who report counterfeit system components.","CCI-005137":"Train organization-defined personnel or roles to detect counterfeit system components including hardware, software, and firmware.","CCI-005138":"Defines the personnel or roles who are trained to detect counterfeit system components (including hardware, software, and firmware).","CCI-005139":"Maintain configuration control over the following system components awaiting service or repair.","CCI-005140":"Maintain configuration control over serviced or repaired components awaiting return to service.","CCI-005141":"Defines the system components awaiting service or repair.","CCI-005142":"Scan for counterfeit system components on an organization-defined frequency.","CCI-005143":"Defines the frequency for which the counterfeit system components are scanned.","CCI-005144":"Dispose of organization-defined data, documentation, tools, or system components using the following techniques and methods.","CCI-005145":"Defines the data, documentation, tools, or system components which are to be disposed of using organization-defined techniques and methods.","CCI-005146":"Defines the techniques or methods used to dispose of organization-defined data, documentation, tools, or system components.","CCI-005147":"Provide basic privacy literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users.","CCI-005149":"Implement organization-defined measures to disassociate individuals from audit information transmitted across organizational boundaries.","CCI-005150":"Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services."} \ No newline at end of file diff --git a/libs/hdf-converters/src/mappings/U_CCI_List.nist.json b/libs/hdf-converters/src/mappings/U_CCI_List.nist.json new file mode 100644 index 0000000000..19c77d8f3d --- /dev/null +++ b/libs/hdf-converters/src/mappings/U_CCI_List.nist.json @@ -0,0 +1 @@ +{"CCI-000001":"AC-1 a 1","CCI-000002":"AC-1 a 1 (a)","CCI-000003":"AC-1 c 1","CCI-000004":"AC-1 a 2","CCI-000005":"AC-1 a 2","CCI-000006":"AC-1 c 2","CCI-000007":"AC-2 a","CCI-000008":"AC-2 c","CCI-000009":"AC-2 c","CCI-000010":"AC-2 e","CCI-000011":"AC-2 f","CCI-000012":"AC-2 j","CCI-000013":"AC-2 g","CCI-000014":"AC-2 i","CCI-000015":"AC-2 (1)","CCI-000016":"AC-2 (2)","CCI-000017":"AC-2 (3) (d)","CCI-000018":"AC-2 (4)","CCI-000019":"AC-2 (5)","CCI-000020":"AC-2 (6)","CCI-000021":"AC-3 (2)","CCI-000022":"AC-3 (3) (a)","CCI-000023":"PM-1 a","CCI-000024":"AC-3 (5)","CCI-000025":"AC-4 (1)","CCI-000026":"AC-4 (2)","CCI-000027":"AC-4 (3)","CCI-000028":"AC-4 (4)","CCI-000029":"AC-4 (5)","CCI-000030":"AC-4 (6)","CCI-000031":"AC-4 (7)","CCI-000032":"AC-4 (8) (a)","CCI-000033":"AC-4 (9)","CCI-000034":"AC-4 (10)","CCI-000035":"AC-4 (11)","CCI-000036":"AC-5 a","CCI-000037":"AC-5 c","CCI-000038":"AC-6 (1)","CCI-000039":"AC-6 (2)","CCI-000040":"AC-6 (2)","CCI-000041":"AC-6 (3)","CCI-000042":"AC-6 (3)","CCI-000043":"AC-7 a","CCI-000044":"AC-7 a","CCI-000045":"AC-7 b","CCI-000046":"AC-7 b","CCI-000047":"AC-7 b","CCI-000048":"AC-8 a","CCI-000049":"AC-8 a","CCI-000050":"AC-8 b","CCI-000051":"AC-8 a","CCI-000052":"AC-9","CCI-000053":"AC-9 (1)","CCI-000054":"AC-10","CCI-000055":"AC-10","CCI-000056":"AC-11 b","CCI-000057":"AC-11 a","CCI-000058":"AC-11 a","CCI-000059":"AC-11 a","CCI-000060":"AC-11 (1)","CCI-000061":"AC-14 a","CCI-000062":"AC-14 (1)","CCI-000063":"AC-17 a","CCI-000064":"AC-17 b","CCI-000065":"AC-17 b","CCI-000066":"AC-17 e","CCI-000067":"AC-17 (1)","CCI-000068":"AC-17 (2)","CCI-000069":"AC-17 (3)","CCI-000070":"AC-17 (4) (a)","CCI-000071":"AC-17 (5)","CCI-000072":"AC-17 (6)","CCI-000073":"PM-1 a 1","CCI-000074":"PM-1 a 4","CCI-000075":"PM-1 b","CCI-000076":"PM-1 b","CCI-000077":"PM-1 c","CCI-000078":"PM-2","CCI-000079":"AC-17 (7)","CCI-000080":"PM-3 a","CCI-000081":"PM-3 b","CCI-000082":"AC-19 a","CCI-000083":"AC-19 a","CCI-000084":"AC-19 b","CCI-000085":"AC-19 c","CCI-000086":"AC-19 d","CCI-000087":"AC-19 e","CCI-000088":"AC-19 f","CCI-000089":"AC-19 g","CCI-000090":"AC-19 (1)","CCI-000091":"AC-19 (2)","CCI-000092":"AC-19 (3)","CCI-000093":"AC-20 a 1","CCI-000094":"AC-20 b","CCI-000095":"AC-20 (1) (a)","CCI-000096":"AC-20 (1) (b)","CCI-000097":"AC-20 (2)","CCI-000098":"AC-21 a","CCI-000099":"AC-21 (1)","CCI-000100":"AT-1 a 1 (a)","CCI-000101":"AT-1 a 1 (a)","CCI-000102":"AT-1 c 1","CCI-000103":"AT-1 a 2","CCI-000104":"AT-1 a 2","CCI-000105":"AT-1 c 2","CCI-000106":"AT-2 a 1","CCI-000107":"AT-2 (1)","CCI-000108":"AT-3 a 1","CCI-000109":"AT-3 a 2","CCI-000110":"AT-3 c","CCI-000111":"AT-3 c","CCI-000112":"AT-2 a 2","CCI-000113":"AT-4 a","CCI-000114":"AT-4 a","CCI-000115":"AT-5","CCI-000116":"AT-5","CCI-000117":"AU-1 a 1 (a)","CCI-000118":"AU-1 a","CCI-000119":"AU-1 c 1","CCI-000120":"AU-1 a 2","CCI-000121":"AU-1 b","CCI-000122":"AU-1 c 2","CCI-000123":"AU-2 a","CCI-000124":"AU-2 b","CCI-000125":"AU-2 d","CCI-000126":"AU-2 c","CCI-000127":"AU-2 (3)","CCI-000128":"AU-2 (4)","CCI-000129":"AU-2 a","CCI-000130":"AU-3 a","CCI-000131":"AU-3 b","CCI-000132":"AU-3 c","CCI-000133":"AU-3 d","CCI-000134":"AU-3 e","CCI-000135":"AU-3 (1)","CCI-000136":"AU-3 (2)","CCI-000137":"AU-4","CCI-000138":"AU-4","CCI-000139":"AU-5 a","CCI-000140":"AU-5 b","CCI-000141":"PM-3 c","CCI-000142":"PM-4 a 1","CCI-000143":"AU-5 (1)","CCI-000144":"AU-5 (2)","CCI-000145":"AU-5 (3)","CCI-000146":"AU-5 (1)","CCI-000147":"AU-5 (2)","CCI-000148":"AU-6 a","CCI-000149":"AU-6 b","CCI-000150":"AU-6 b","CCI-000151":"AU-6 a","CCI-000152":"AU-6 (1)","CCI-000153":"AU-6 (3)","CCI-000154":"AU-6 (4)","CCI-000155":"AU-6 (5)","CCI-000156":"AU-7","CCI-000157":"AU-7","CCI-000158":"AU-7 (1)","CCI-000159":"AU-8 a","CCI-000160":"AU-8 (1)","CCI-000161":"AU-8 (1) (a)","CCI-000162":"AU-9 a","CCI-000163":"AU-9 a","CCI-000164":"AU-9 a","CCI-000165":"AU-9 (1)","CCI-000166":"AU-10","CCI-000167":"AU-11","CCI-000168":"AU-11","CCI-000169":"AU-12 a","CCI-000170":"PM-4 a 2","CCI-000171":"AU-12 b","CCI-000172":"AU-12 c","CCI-000173":"AU-12 (1)","CCI-000174":"AU-12 (1)","CCI-000175":"IA-5 a","CCI-000176":"IA-5 b","CCI-000177":"IA-5 d","CCI-000178":"IA-5 e","CCI-000179":"IA-5 f","CCI-000180":"IA-5 f","CCI-000181":"IA-5 f","CCI-000182":"IA-5 f","CCI-000183":"IA-5 g","CCI-000184":"IA-5 h","CCI-000185":"IA-5 (2) (b) (1)","CCI-000186":"IA-5 (2) (a) (1)","CCI-000187":"IA-5 (2) (a) (2)","CCI-000188":"IA-5 (3)","CCI-000189":"IA-5 (4)","CCI-000190":"IA-5 (5)","CCI-000191":"IA-5 (1) (a)","CCI-000192":"IA-5 (1) (a)","CCI-000193":"IA-5 (1) (a)","CCI-000194":"IA-5 (1) (a)","CCI-000195":"IA-5 (1) (b)","CCI-000196":"IA-5 (1) (c)","CCI-000197":"IA-5 (1) (c)","CCI-000198":"IA-5 (1) (d)","CCI-000199":"IA-5 (1) (d)","CCI-000200":"IA-5 (1) (e)","CCI-000201":"IA-5 (6)","CCI-000202":"IA-5 (7)","CCI-000203":"IA-5 (7)","CCI-000204":"IA-5 (8)","CCI-000205":"IA-5 (1) (a)","CCI-000206":"IA-6","CCI-000207":"PM-5","CCI-000208":"AC-2 (5) (b)","CCI-000209":"PM-6","CCI-000210":"PM-6","CCI-000211":"PM-6","CCI-000212":"PM-7","CCI-000213":"AC-3","CCI-000214":"AC-3 (4) (b)","CCI-000215":"AC-3 (4) (c)","CCI-000216":"PM-8","CCI-000217":"AC-2 (3)","CCI-000218":"AC-4 (12)","CCI-000219":"AC-4 (13)","CCI-000221":"AC-4 (16)","CCI-000223":"AC-4 (17) (b)","CCI-000224":"AC-4 (17) (c)","CCI-000225":"AC-6","CCI-000226":"AC-6 (4)","CCI-000227":"PM-9 a 1","CCI-000228":"PM-9 b","CCI-000229":"PM-10 a","CCI-000230":"PM-10 a","CCI-000231":"PM-10 a","CCI-000232":"AC-14 b","CCI-000233":"PM-10 b","CCI-000234":"PM-10 c","CCI-000235":"PM-11 a","CCI-000236":"PM-11 b","CCI-000237":"AC-2 f","CCI-000238":"CA-1 c 1","CCI-000239":"CA-1 a 1 (a)","CCI-000240":"CA-1 a 1 (a)","CCI-000241":"CA-1 c 1","CCI-000242":"CA-1 a 2","CCI-000243":"CA-1 a 2","CCI-000244":"CA-1 c 2","CCI-000245":"CA-2 a","CCI-000246":"CA-2 b 1","CCI-000247":"CA-2 b 2","CCI-000248":"CA-2 b 3","CCI-000249":"CA-2 a","CCI-000250":"CA-2 a","CCI-000251":"CA-2 d","CCI-000252":"CA-2 d","CCI-000253":"CA-2 e","CCI-000254":"CA-2 f","CCI-000255":"CA-2 (1)","CCI-000256":"CA-2 (2)","CCI-000257":"CA-3 a","CCI-000258":"CA-3 b","CCI-000259":"CA-3 b","CCI-000260":"CA-3 b","CCI-000261":"CA-3 c","CCI-000262":"CA-3 (1)","CCI-000263":"CA-3 (2)","CCI-000264":"CA-5 a","CCI-000265":"CA-5 b","CCI-000266":"CA-5 b","CCI-000267":"CA-5 (1)","CCI-000268":"CA-5 (1)","CCI-000269":"CA-5 (1)","CCI-000270":"CA-6 a","CCI-000271":"CA-6 c 2","CCI-000272":"CA-6 e","CCI-000273":"CA-6 e","CCI-000274":"CA-7","CCI-000275":"CA-7 a","CCI-000276":"CA-7 a","CCI-000277":"CA-7 b","CCI-000278":"CA-7 b","CCI-000279":"CA-7 c","CCI-000280":"CA-7 g","CCI-000281":"CA-7 g","CCI-000282":"CA-7 (1)","CCI-000283":"CA-7 (2)","CCI-000284":"CA-7 (2)","CCI-000285":"CA-7 (2)","CCI-000286":"CM-1 c 1","CCI-000287":"CM-1 a 1 (a)","CCI-000288":"CM-1 a","CCI-000289":"CM-1 c 1","CCI-000290":"CM-1 a 2","CCI-000291":"CM-1 b","CCI-000292":"CM-1 a 2","CCI-000293":"CM-2","CCI-000294":"CM-2","CCI-000295":"CM-2 a","CCI-000296":"CM-2 b 1","CCI-000297":"CM-2 b 2","CCI-000298":"CM-2 (1) (c)","CCI-000299":"CM-2 (1) (c)","CCI-000300":"CM-2 (2)","CCI-000301":"CM-2 (2)","CCI-000302":"CM-2 (2)","CCI-000303":"CM-2 (2)","CCI-000304":"CM-2 (3)","CCI-000305":"CM-2 (4) (a)","CCI-000306":"CM-2 (4) (a)","CCI-000307":"CM-2 (4) (b)","CCI-000308":"CM-2 (5) (a)","CCI-000309":"CM-2 (5) (a)","CCI-000310":"CM-2 (5) (b)","CCI-000311":"CM-2 (6)","CCI-000312":"CM-2 (6)","CCI-000313":"CM-3 a","CCI-000314":"CM-3 b","CCI-000315":"CM-3 c","CCI-000316":"CM-3 e","CCI-000317":"CM-3 d","CCI-000318":"CM-3 f","CCI-000319":"CM-3 g","CCI-000320":"CM-3 g","CCI-000321":"CM-3 g","CCI-000322":"CM-3 (1) (a)","CCI-000323":"CM-3 (1) (b)","CCI-000324":"CM-3 (1) (c)","CCI-000325":"CM-3 (1) (d)","CCI-000326":"CM-3 (1) (e)","CCI-000327":"CM-3 (2)","CCI-000328":"CM-3 (2)","CCI-000329":"CM-3 (2)","CCI-000330":"CM-3 (3)","CCI-000331":"CM-3 (3)","CCI-000332":"CM-3 (4)","CCI-000333":"CM-4","CCI-000334":"CM-4 (1)","CCI-000335":"CM-4 (2)","CCI-000336":"CM-4 (2)","CCI-000337":"CM-4 (2)","CCI-000338":"CM-5","CCI-000339":"CM-5","CCI-000340":"CM-5","CCI-000341":"CM-5","CCI-000342":"CM-5","CCI-000343":"CM-5","CCI-000344":"CM-5","CCI-000345":"CM-5","CCI-000346":"CM-5 (1)","CCI-000347":"CM-5 (1)","CCI-000348":"CM-5 (2)","CCI-000349":"CM-5 (2)","CCI-000350":"CM-5 (2)","CCI-000351":"CM-5 (3)","CCI-000352":"CM-5 (3)","CCI-000353":"CM-5 (4)","CCI-000354":"CM-5 (4)","CCI-000355":"CM-5 (5) (a)","CCI-000356":"CM-5 (5) (a)","CCI-000357":"CM-5 (5) (a)","CCI-000358":"CM-5 (5) (a)","CCI-000359":"CM-5 (5) (b)","CCI-000360":"CM-5 (5) (b)","CCI-000361":"CM-5 (5) (b)","CCI-000362":"CM-5 (5) (b)","CCI-000363":"CM-6 a","CCI-000364":"CM-6 a","CCI-000365":"CM-6 a","CCI-000366":"CM-6 b","CCI-000367":"CM-6 c","CCI-000368":"CM-6 c","CCI-000369":"CM-6 c","CCI-000370":"CM-6 (1)","CCI-000371":"CM-6 (1)","CCI-000372":"CM-6 (1)","CCI-000373":"CM-6 (2)","CCI-000374":"CM-6 (2)","CCI-000375":"CM-6 (3)","CCI-000376":"CM-6 (3)","CCI-000377":"CM-6 (3)","CCI-000378":"CM-6 (3)","CCI-000379":"CM-6 (4)","CCI-000380":"CM-7 b","CCI-000381":"CM-7 a","CCI-000382":"CM-7 b","CCI-000383":"CM-7 (1)","CCI-000384":"CM-7 (1) (a)","CCI-000385":"CM-7 (1)","CCI-000386":"CM-7 (2)","CCI-000387":"CM-7 (3)","CCI-000388":"CM-7 (3)","CCI-000389":"CM-8 a 1","CCI-000390":"CM-8 a 1","CCI-000391":"CM-8 a","CCI-000392":"CM-8 a 2","CCI-000393":"CM-8 a 2","CCI-000394":"CM-8 b","CCI-000395":"CM-8 a 3","CCI-000396":"CM-8 a 3","CCI-000397":"CM-8 c","CCI-000398":"CM-8 a 5","CCI-000399":"CM-8 a 4","CCI-000400":"CM-8 a 4","CCI-000401":"CM-8 d","CCI-000402":"CM-8 e","CCI-000403":"CM-8 e","CCI-000404":"CM-8 e","CCI-000405":"CM-8 e","CCI-000406":"CM-8 e","CCI-000407":"CM-8 e","CCI-000408":"CM-8 (1)","CCI-000409":"CM-8 (1)","CCI-000410":"CM-8 (1)","CCI-000411":"CM-8 (2)","CCI-000412":"CM-8 (2)","CCI-000413":"CM-8 (2)","CCI-000414":"CM-8 (2)","CCI-000415":"CM-8 (3) (a)","CCI-000416":"CM-8 (3) (a)","CCI-000417":"CM-8 (3) (b)","CCI-000418":"CM-8 (4)","CCI-000419":"CM-8 (5)","CCI-000420":"CM-8 (6)","CCI-000421":"CM-9 a","CCI-000422":"CM-9 a","CCI-000423":"CM-9 a","CCI-000424":"CM-9 c","CCI-000425":"CM-9 c","CCI-000426":"CM-9 c","CCI-000427":"CM-9 b","CCI-000428":"CM-9 b","CCI-000429":"CM-9 b","CCI-000430":"CM-9 c","CCI-000431":"CM-9 c","CCI-000432":"CM-9 c","CCI-000433":"CM-9 c","CCI-000434":"CM-9 c","CCI-000435":"CM-9 c","CCI-000436":"CM-9 (1)","CCI-000437":"CP-1 c 1","CCI-000438":"CP-1 a 1 (a)","CCI-000439":"CP-1 a 1 (a)","CCI-000440":"CP-1 c 1","CCI-000441":"CP-1 a 2","CCI-000443":"CP-2 a 1","CCI-000444":"CP-2 a 1","CCI-000445":"CP-2 a 1","CCI-000446":"CP-2 a 2","CCI-000447":"CP-2 a 2","CCI-000448":"CP-2 a 2","CCI-000449":"CP-2 a 3","CCI-000450":"CP-2 a 4","CCI-000451":"CP-2 a 4","CCI-000452":"CP-2 a 4","CCI-000453":"CP-2 a 4","CCI-000454":"CP-2 a 4","CCI-000455":"CP-2 a 4","CCI-000456":"CP-2 a 5","CCI-000457":"CP-2 a 7","CCI-000458":"CP-2 b","CCI-000459":"CP-2 b","CCI-000460":"CP-2 c","CCI-000461":"CP-2 d","CCI-000462":"CP-2 d","CCI-000463":"CP-2 e","CCI-000464":"CP-2 e","CCI-000465":"CP-2 e","CCI-000466":"CP-2 e","CCI-000468":"CP-2 f","CCI-000469":"CP-2 (1)","CCI-000470":"CP-2 (2)","CCI-000471":"CP-2 (2)","CCI-000472":"CP-2 (2)","CCI-000473":"CP-2 (3)","CCI-000474":"CP-2 (3)","CCI-000475":"CP-2 (3)","CCI-000476":"CP-2 (3)","CCI-000477":"CP-2 (4)","CCI-000478":"CP-2 (4)","CCI-000479":"CP-2 (4)","CCI-000480":"CP-2 (4)","CCI-000481":"CP-2 (5)","CCI-000482":"CP-2 (5)","CCI-000483":"CP-2 (6)","CCI-000484":"CP-2 (6)","CCI-000485":"CP-3 a 3","CCI-000486":"CP-3 a 1","CCI-000487":"CP-3 a 3","CCI-000488":"CP-3 (1)","CCI-000489":"CP-3 (2)","CCI-000490":"CP-4 a","CCI-000491":"CP-4","CCI-000492":"CP-4 a","CCI-000493":"CP-4","CCI-000494":"CP-4 a","CCI-000495":"CP-4 a","CCI-000496":"CP-4 b","CCI-000497":"CP-4 c","CCI-000498":"CP-4 (1)","CCI-000499":"CP-4 (1)","CCI-000500":"CP-4 (2) (a)","CCI-000501":"CP-4 (2)","CCI-000502":"CP-4 (3)","CCI-000503":"CP-4 (3)","CCI-000504":"CP-4 (4)","CCI-000505":"CP-6 a","CCI-000506":"CP-6","CCI-000507":"CP-6 (1)","CCI-000508":"CP-6 (2)","CCI-000509":"CP-6 (3)","CCI-000510":"CP-7 a","CCI-000511":"CP-7","CCI-000512":"CP-7 a","CCI-000513":"CP-7 a","CCI-000514":"CP-7 a","CCI-000515":"CP-7 b","CCI-000516":"CP-7 (1)","CCI-000517":"CP-7 (2)","CCI-000518":"CP-7 (3)","CCI-000519":"CP-7 (4)","CCI-000520":"CP-7 (4)","CCI-000521":"CP-7 c","CCI-000522":"CP-8","CCI-000523":"CP-8","CCI-000524":"CP-8","CCI-000525":"CP-8","CCI-000526":"CP-8 (1) (a)","CCI-000527":"CP-8 (1) (a)","CCI-000528":"CP-8 (1) (b)","CCI-000529":"CP-8 (1) (b)","CCI-000530":"CP-8 (2)","CCI-000531":"CP-8 (3)","CCI-000532":"CP-8 (4) (a)","CCI-000533":"CP-8 (4) (a)","CCI-000534":"CP-9 (a)","CCI-000535":"CP-9 (a)","CCI-000536":"CP-9 (b)","CCI-000537":"CP-9 (b)","CCI-000538":"CP-9 (c)","CCI-000539":"CP-9 (c)","CCI-000540":"CP-9 (d)","CCI-000541":"CP-9 (1)","CCI-000542":"CP-9 (1)","CCI-000543":"CP-9 (2)","CCI-000544":"CP-9 (3)","CCI-000545":"CP-9 (3)","CCI-000546":"CP-9 (3)","CCI-000547":"CP-9 (5)","CCI-000548":"CP-9 (5)","CCI-000549":"CP-9 (6)","CCI-000550":"CP-10","CCI-000551":"CP-10","CCI-000552":"CP-10","CCI-000553":"CP-10 (2)","CCI-000554":"CP-10 (3)","CCI-000555":"CP-10 (3)","CCI-000556":"CP-10 (4)","CCI-000557":"CP-10 (4)","CCI-000558":"SI-13 (5)","CCI-000559":"SI-13 (5)","CCI-000560":"CP-10 (6)","CCI-000561":"CP-10 (6)","CCI-000562":"CP-10 (6)","CCI-000563":"PL-1 a 1 (a)","CCI-000564":"PL-1 a 1 (a)","CCI-000565":"PL-1 a","CCI-000566":"PL-1 a 2","CCI-000567":"PL-1 a 2","CCI-000568":"PL-1 c 2","CCI-000570":"PL-2 a","CCI-000571":"PL-2 a 15","CCI-000572":"PL-2 c","CCI-000573":"PL-2 c","CCI-000574":"PL-2 d","CCI-000576":"PL-2 (1) (a)","CCI-000577":"PL-7 b","CCI-000578":"PL-7 b","CCI-000580":"PL-2 (2) (a)","CCI-000581":"PL-2 (2) (a)","CCI-000582":"PL-2 (2) (a)","CCI-000583":"PL-2 (2) (b)","CCI-000584":"PL-2 (2) (b)","CCI-000585":"PL-2 (2) (c)","CCI-000586":"PL-2 (2) (d)","CCI-000587":"PL-2 (2) (d)","CCI-000588":"PL-2 (2) (d)","CCI-000589":"PL-2 (2) (d)","CCI-000590":"PL-2 (2) (e)","CCI-000591":"PL-2 (2) (e)","CCI-000592":"PL-4 a","CCI-000593":"PL-4 b","CCI-000594":"PL-4 (1) (a)","CCI-000595":"PL-4 (1) (b)","CCI-000596":"PL-4 (1)","CCI-000597":"PL-5","CCI-000598":"PL-6","CCI-000599":"PL-6","CCI-000600":"PL-6","CCI-000601":"SA-1 c 1","CCI-000602":"SA-1 a 1 (a)","CCI-000603":"SA-1 a 1","CCI-000604":"SA-1 c 1","CCI-000605":"SA-1 a 2","CCI-000606":"SA-1 a 2","CCI-000607":"SA-1 c 2","CCI-000608":"SA-2 a","CCI-000609":"SA-2 a","CCI-000610":"SA-2 b","CCI-000611":"SA-2 b","CCI-000612":"SA-2 b","CCI-000613":"SA-2 c","CCI-000614":"SA-2 c","CCI-000615":"SA-3 a","CCI-000616":"SA-3 b","CCI-000617":"SA-3 b","CCI-000618":"SA-3 c","CCI-000619":"SA-4 a","CCI-000620":"SA-4 b","CCI-000621":"SA-4 c","CCI-000623":"SA-4 (1)","CCI-000624":"SA-4 (2)","CCI-000625":"SA-4 (2)","CCI-000626":"SA-4 (3)","CCI-000627":"SA-4 (3)","CCI-000628":"SA-4 (3)","CCI-000629":"SA-4 (4)","CCI-000630":"SA-4 (5)","CCI-000631":"SA-4 (6) (a)","CCI-000632":"SA-4 (6) (a)","CCI-000633":"SA-4 (6) (b)","CCI-000634":"SA-4 (7) (a)","CCI-000635":"SA-4 (7) (b)","CCI-000636":"SA-5 a","CCI-000637":"SA-5 a","CCI-000638":"SA-5 a","CCI-000639":"SA-5 b","CCI-000640":"SA-5 b","CCI-000641":"SA-5 b","CCI-000642":"SA-5 c","CCI-000643":"SA-5 (1)","CCI-000644":"SA-5 (1)","CCI-000645":"SA-5 (2)","CCI-000646":"SA-5 (2)","CCI-000647":"SA-5 (3)","CCI-000648":"SA-5 (3)","CCI-000650":"SA-5 (4)","CCI-000651":"SA-5 (4)","CCI-000653":"SA-5 (5)","CCI-000654":"SA-5 (5)","CCI-000655":"SA-6 a","CCI-000656":"SA-6 b","CCI-000657":"SA-6 c","CCI-000658":"SA-6 c","CCI-000659":"SA-6 (1) (a)","CCI-000660":"SA-6 (1) (a)","CCI-000661":"SA-6 (1) (b)","CCI-000662":"SA-6 (1) (b)","CCI-000663":"SA-7","CCI-000664":"SA-8","CCI-000665":"SA-8","CCI-000666":"SA-8","CCI-000667":"SA-8","CCI-000668":"SA-8","CCI-000669":"SA-9","CCI-000670":"SA-9 a","CCI-000671":"SA-9 b","CCI-000672":"SA-9 b","CCI-000673":"SA-9 b","CCI-000674":"SA-9 b","CCI-000675":"SA-9 c","CCI-000676":"SA-9 (1) (a)","CCI-000677":"SA-9 (1) (a)","CCI-000678":"SA-9 (1) (b)","CCI-000679":"SA-9 (1) (b)","CCI-000680":"SA-9 (1) (b)","CCI-000681":"SA-9 (1) (b)","CCI-000682":"SA-10 (a)","CCI-000683":"SA-10 (a)","CCI-000684":"SA-10 (a)","CCI-000685":"SA-10 (a)","CCI-000686":"SA-10 (a)","CCI-000687":"SA-10 (a)","CCI-000688":"SA-10 (a)","CCI-000689":"SA-10 (a)","CCI-000690":"SA-10 (b)","CCI-000691":"SA-10 (b)","CCI-000692":"SA-10 c","CCI-000693":"SA-10 (c)","CCI-000694":"SA-10 d","CCI-000695":"SA-10 (d)","CCI-000696":"SA-10 (e)","CCI-000697":"SA-10 (e)","CCI-000698":"SA-10 (1)","CCI-000699":"SA-10 (1)","CCI-000700":"SA-10 (2)","CCI-000701":"SA-10 (2)","CCI-000702":"SA-11 (a)","CCI-000703":"SA-11 (a)","CCI-000704":"SA-11 (a)","CCI-000705":"SA-11 (a)","CCI-000706":"SA-11 (b)","CCI-000707":"SA-11 (b)","CCI-000708":"SA-11 (c)","CCI-000709":"SA-11 (c)","CCI-000710":"SA-11 (c)","CCI-000711":"SA-11 (c)","CCI-000712":"SA-11 (1)","CCI-000713":"SA-11 (1)","CCI-000714":"SA-11 (2)","CCI-000715":"SA-11 (2)","CCI-000716":"SA-11 (2)","CCI-000717":"SA-11 (2)","CCI-000718":"SA-11 (2)","CCI-000719":"SA-11 (2)","CCI-000720":"SA-11 (3)","CCI-000721":"SA-11 (3)","CCI-000722":"SA-12","CCI-000723":"SA-12","CCI-000724":"SA-12 (1)","CCI-000725":"SA-12 (2)","CCI-000726":"SA-12 (2)","CCI-000727":"SA-12 (2)","CCI-000728":"SA-12 (2)","CCI-000729":"SA-12 (3)","CCI-000730":"SA-12 (3)","CCI-000731":"SA-12 (3)","CCI-000732":"SA-12 (3)","CCI-000733":"SA-12 (3)","CCI-000734":"SA-12 (3)","CCI-000735":"SA-12 (4)","CCI-000736":"SA-12 (4)","CCI-000737":"SA-12 (4)","CCI-000738":"SA-12 (4)","CCI-000739":"SA-12 (5)","CCI-000740":"SA-12 (5)","CCI-000741":"SA-12 (5)","CCI-000742":"SA-12 (6)","CCI-000743":"SA-12 (6)","CCI-000744":"SA-12 (6)","CCI-000745":"SA-12 (7)","CCI-000746":"SA-12 (7)","CCI-000747":"SA-12 (7)","CCI-000748":"SA-13","CCI-000749":"SA-13","CCI-000750":"SA-14","CCI-000751":"SA-14 a","CCI-000752":"SA-14 b","CCI-000753":"SA-14 (1) (a)","CCI-000754":"SA-14 (1) (b)","CCI-000755":"SA-14 (1) (b)","CCI-000756":"IA-1 a 1","CCI-000757":"IA-1 a 1 (a)","CCI-000758":"IA-1 c 1","CCI-000759":"IA-1 c 1","CCI-000760":"IA-1 a 2","CCI-000761":"IA-1 a 2","CCI-000762":"IA-1 c 2","CCI-000763":"IA-1 c 2","CCI-000764":"IA-2","CCI-000765":"IA-2 (1)","CCI-000766":"IA-2 (2)","CCI-000767":"IA-2 (3)","CCI-000768":"IA-2 (4)","CCI-000769":"IA-2 (5) (a)","CCI-000770":"IA-2 (5)","CCI-000771":"IA-2 (6)","CCI-000772":"IA-2 (7)","CCI-000773":"IA-2 (8)","CCI-000774":"IA-2 (8)","CCI-000775":"IA-2 (9)","CCI-000776":"IA-2 (9)","CCI-000777":"IA-3","CCI-000778":"IA-3","CCI-000779":"IA-3 (1)","CCI-000780":"IA-3 (1)","CCI-000781":"IA-3 (2)","CCI-000782":"IA-3 (3)","CCI-000783":"IA-3 (3) (b)","CCI-000784":"IA-4 a","CCI-000785":"IA-4 a","CCI-000786":"IA-4 b","CCI-000787":"IA-4 b","CCI-000788":"IA-4 c","CCI-000789":"IA-4 c","CCI-000790":"IA-4 d","CCI-000791":"IA-4 d","CCI-000792":"IA-4 d","CCI-000793":"IA-4 d","CCI-000794":"IA-4 e","CCI-000795":"IA-4 e","CCI-000796":"IA-4 (1)","CCI-000797":"IA-4 (2)","CCI-000798":"IA-4 (2)","CCI-000799":"IA-4 (3)","CCI-000800":"IA-4 (4)","CCI-000801":"IA-4 (4)","CCI-000802":"IA-4 (5)","CCI-000803":"IA-7","CCI-000804":"IA-8","CCI-000805":"IR-1 a 1 (a)","CCI-000806":"IR-1 a 1 (a)","CCI-000807":"IR-1 c 1","CCI-000808":"IR-1 c 1","CCI-000809":"IR-1 a 2","CCI-000810":"IR-1 a 2","CCI-000811":"IR-1 c 2","CCI-000812":"IR-1 c 2","CCI-000813":"IR-2 a 1","CCI-000814":"IR-2 a 3","CCI-000815":"IR-2 c","CCI-000816":"IR-2 (1)","CCI-000817":"IR-2 (2)","CCI-000818":"IR-3","CCI-000819":"IR-3","CCI-000820":"IR-3","CCI-000821":"IR-3 (1)","CCI-000822":"IR-4 a","CCI-000823":"IR-4 b","CCI-000824":"IR-4 c","CCI-000825":"IR-4 (1)","CCI-000826":"IR-4 (2)","CCI-000827":"IR-4 (3)","CCI-000828":"IR-4 (3)","CCI-000829":"IR-4 (4)","CCI-000830":"IR-4 (5)","CCI-000831":"IR-4 (5)","CCI-000832":"IR-5","CCI-000833":"IR-5 (1)","CCI-000834":"IR-6 a","CCI-000835":"IR-6 a","CCI-000836":"IR-6 b","CCI-000837":"IR-6 (1)","CCI-000838":"IR-6 (2)","CCI-000839":"IR-7","CCI-000840":"IR-7 (1)","CCI-000841":"IR-7 (2) (a)","CCI-000842":"IR-7 (2) (b)","CCI-000843":"IR-8 a","CCI-000844":"IR-8 a 9","CCI-000845":"IR-8 b","CCI-000846":"IR-8 b","CCI-000847":"IR-8 c","CCI-000848":"IR-8 c","CCI-000849":"IR-8 c","CCI-000850":"IR-8 d","CCI-000851":"MA-1 c 1","CCI-000852":"MA-1 a 1 (a)","CCI-000853":"MA-1 a 1","CCI-000854":"MA-1 c 1","CCI-000855":"MA-1 a 2","CCI-000856":"MA-1 a 2","CCI-000857":"MA-1 c 2","CCI-000858":"MA-2 a","CCI-000859":"MA-2 b","CCI-000860":"MA-2 c","CCI-000861":"MA-2 d","CCI-000862":"MA-2 e","CCI-000863":"MA-2 (1) (a)(b)(c)(d)(e)","CCI-000864":"MA-2 (2)","CCI-000865":"MA-3 a","CCI-000866":"MA-3 a","CCI-000867":"MA-3 a","CCI-000868":"MA-3","CCI-000869":"MA-3 (1)","CCI-000870":"MA-3 (2)","CCI-000871":"MA-3 (3)","CCI-000872":"MA-3 (4)","CCI-000873":"MA-4 a","CCI-000874":"MA-4 a","CCI-000875":"MA-4 a","CCI-000876":"MA-4 b","CCI-000877":"MA-4 c","CCI-000878":"MA-4 d","CCI-000879":"MA-4 e","CCI-000880":"MA-4 (1)","CCI-000881":"MA-4 (2)","CCI-000882":"MA-4 (3) (a)","CCI-000883":"MA-4 (3) (b)","CCI-000884":"MA-4 (4) (a)","CCI-000885":"MA-4 (5) (a)","CCI-000886":"MA-4 (5) (b)","CCI-000887":"MA-4 (5) (a)","CCI-000888":"MA-4 (6)","CCI-000889":"MA-4 (7)","CCI-000890":"MA-5 a","CCI-000891":"MA-5 a","CCI-000892":"MA-5 b","CCI-000893":"MA-5 (1) (a)","CCI-000894":"MA-5 (1) (a) (1)","CCI-000895":"MA-5 (1) (a) (2)","CCI-000896":"MA-5 (1) (c)","CCI-000897":"MA-5 (2)","CCI-000898":"MA-5 (3)","CCI-000899":"MA-5 (4) (a)","CCI-000900":"MA-5 (4) (b)","CCI-000901":"MA-6","CCI-000902":"MA-6","CCI-000903":"MA-6","CCI-000904":"PE-1 a 1 (a)","CCI-000905":"PE-1 a 1","CCI-000906":"PE-1 c 1","CCI-000907":"PE-1 c 1","CCI-000908":"PE-1 a 2","CCI-000909":"PE-1 a 2","CCI-000910":"PE-1 c 2","CCI-000911":"PE-1 c 2","CCI-000912":"PE-2 a","CCI-000913":"PE-2 b","CCI-000914":"PE-2 c","CCI-000915":"PE-2 c","CCI-000916":"PE-2 (1)","CCI-000917":"PE-2 (2)","CCI-000918":"PE-2 (3)","CCI-000919":"PE-3 a","CCI-000920":"PE-3 a 1","CCI-000921":"PE-3 a 2","CCI-000922":"PE-3 d","CCI-000923":"PE-3 e","CCI-000924":"PE-3 f","CCI-000925":"PE-3 f","CCI-000926":"PE-3 g","CCI-000927":"PE-3 g","CCI-000928":"PE-3 (1)","CCI-000929":"PE-3 (2)","CCI-000930":"PE-3 (3)","CCI-000931":"PE-3 (4)","CCI-000932":"PE-3 (4)","CCI-000933":"PE-3 (5)","CCI-000934":"PE-3 (6)","CCI-000935":"PE-3 (6)","CCI-000936":"PE-4","CCI-000937":"PE-5","CCI-000938":"PE-6 a","CCI-000939":"PE-6 b","CCI-000940":"PE-6 b","CCI-000941":"PE-6 c","CCI-000942":"PE-6 (1)","CCI-000943":"PE-6 (2)","CCI-000944":"PE-7","CCI-000945":"PE-7 (1)","CCI-000946":"PE-7 (2)","CCI-000947":"PE-8 a","CCI-000948":"PE-8 b","CCI-000949":"PE-8 b","CCI-000950":"PE-8 (1)","CCI-000951":"PE-8 (2)","CCI-000952":"PE-9","CCI-000953":"PE-9 (1)","CCI-000954":"PE-9 (2)","CCI-000955":"PE-9 (2)","CCI-000956":"PE-10 a","CCI-000957":"PE-10 b","CCI-000958":"PE-10 b","CCI-000959":"PE-10 c","CCI-000960":"PE-11","CCI-000961":"PE-11 (1)","CCI-000962":"PE-11 (2)","CCI-000963":"PE-12","CCI-000964":"PE-12 (1)","CCI-000965":"PE-13","CCI-000966":"PE-13 (1)","CCI-000967":"PE-13 (2)","CCI-000968":"PE-13 (2) (b)","CCI-000969":"PE-13 (4)","CCI-000970":"PE-13 (4)","CCI-000971":"PE-14 a","CCI-000972":"PE-14 a","CCI-000973":"PE-14 b","CCI-000974":"PE-14 b","CCI-000975":"PE-14 (1)","CCI-000976":"PE-14 (2)","CCI-000977":"PE-15","CCI-000978":"PE-15","CCI-000979":"PE-15","CCI-000980":"PE-15 (1)","CCI-000981":"PE-16 a","CCI-000982":"PE-16","CCI-000983":"PE-16 a","CCI-000984":"PE-16 b","CCI-000985":"PE-17 b","CCI-000986":"PE-17 a","CCI-000987":"PE-17 c","CCI-000988":"PE-17 d","CCI-000989":"PE-18","CCI-000990":"PE-18","CCI-000991":"PE-18","CCI-000992":"PE-18 (1)","CCI-000993":"PE-19","CCI-000994":"PE-19 (1)","CCI-000995":"MP-1 a 1 (a)","CCI-000996":"MP-1 a 1","CCI-000997":"MP-1 c 1","CCI-000998":"MP-1 c 1","CCI-000999":"MP-1 a 2","CCI-001000":"MP-1 a 2","CCI-001001":"MP-1 c 2","CCI-001002":"MP-1 c 2","CCI-001003":"MP-2","CCI-001004":"MP-2","CCI-001005":"MP-2","CCI-001006":"MP-2","CCI-001007":"MP-4 (2)","CCI-001008":"MP-4 (2)","CCI-001009":"MP-2 (2)","CCI-001010":"MP-3 a","CCI-001011":"MP-3 b","CCI-001012":"MP-3 b","CCI-001013":"MP-3 b","CCI-001014":"MP-4 a","CCI-001015":"MP-4 a","CCI-001016":"MP-4 a","CCI-001017":"MP-4 a","CCI-001018":"MP-4 b","CCI-001019":"MP-4 (1)","CCI-001020":"MP-5 a","CCI-001021":"MP-5 a","CCI-001022":"MP-5 a","CCI-001023":"MP-5 b","CCI-001024":"MP-5 d","CCI-001025":"MP-5 c","CCI-001026":"MP-5 (3)","CCI-001027":"MP-5 (4)","CCI-001028":"MP-6 a","CCI-001029":"MP-6 (1)","CCI-001030":"MP-6 (2)","CCI-001031":"MP-6 (2)","CCI-001032":"MP-6 (3)","CCI-001033":"MP-6 (3)","CCI-001034":"MP-6 (4)","CCI-001035":"MP-6 (5)","CCI-001036":"MP-6 (6)","CCI-001037":"RA-1 a 1 (a)","CCI-001038":"RA-1 a 1 (a)","CCI-001039":"RA-1 c 1","CCI-001040":"RA-1 c 1","CCI-001041":"RA-1 a 2","CCI-001042":"RA-1 a 2","CCI-001043":"RA-1 c 2","CCI-001044":"RA-1 c 2","CCI-001045":"RA-2 a","CCI-001046":"RA-2 b","CCI-001047":"RA-2 c","CCI-001048":"RA-3 a 2","CCI-001049":"RA-3 c","CCI-001050":"RA-3 d","CCI-001051":"RA-3 d","CCI-001052":"RA-3 f","CCI-001053":"RA-3 f","CCI-001054":"RA-5 a","CCI-001055":"RA-5 a","CCI-001056":"RA-5 a","CCI-001057":"RA-5 b 1","CCI-001058":"RA-5 c","CCI-001059":"RA-5 d","CCI-001060":"RA-5 d","CCI-001061":"RA-5 e","CCI-001062":"RA-5 (1)","CCI-001063":"RA-5 (2)","CCI-001064":"RA-5 (2)","CCI-001065":"RA-5 (3)","CCI-001066":"RA-5 (4)","CCI-001067":"RA-5 (5)","CCI-001068":"RA-5 (6)","CCI-001069":"RA-5 (7)","CCI-001070":"RA-5 (7)","CCI-001071":"RA-5 (8)","CCI-001072":"RA-5 (9) (a)","CCI-001073":"RA-5 (9) (b)","CCI-001074":"SC-1 a 1","CCI-001075":"SC-1 a 1","CCI-001076":"SC-1 c 1","CCI-001077":"SC-1 c 1","CCI-001078":"SC-1 a 2","CCI-001079":"SC-1 a 2","CCI-001080":"SC-1 c 2","CCI-001081":"SC-1 c 2","CCI-001082":"SC-2","CCI-001083":"SC-2 (1)","CCI-001084":"SC-3","CCI-001085":"SC-3 (1)","CCI-001086":"SC-3 (2)","CCI-001087":"SC-3 (3)","CCI-001088":"SC-3 (4)","CCI-001089":"SC-3 (5)","CCI-001090":"SC-4","CCI-001091":"SC-4 (1)","CCI-001092":"SC-5","CCI-001093":"SC-5 a","CCI-001094":"SC-5 (1)","CCI-001095":"SC-5 (2)","CCI-001096":"SC-6","CCI-001097":"SC-7 a","CCI-001098":"SC-7 c","CCI-001099":"SC-7 (1)","CCI-001100":"SC-7 (2)","CCI-001101":"SC-7 (3)","CCI-001102":"SC-7 (4) (a)","CCI-001103":"SC-7 (4) (b)","CCI-001104":"SC-7 (4) (c)","CCI-001105":"SC-7 (4) (d)","CCI-001106":"SC-7 (4) (e)","CCI-001107":"SC-7 (4) (e)","CCI-001108":"SC-7 (4) (e)","CCI-001109":"SC-7 (5)","CCI-001110":"SC-7 (6)","CCI-001111":"SC-7 (7)","CCI-001112":"SC-7 (8)","CCI-001113":"SC-7 (8)","CCI-001114":"SC-7 (8)","CCI-001115":"SC-7 (9)","CCI-001116":"SC-7 (10) (a)","CCI-001117":"SC-7 (11)","CCI-001118":"SC-7 (12)","CCI-001119":"SC-7 (13)","CCI-001120":"SC-7 (13)","CCI-001121":"SC-7 (14)","CCI-001122":"SC-7 (14)","CCI-001123":"SC-7 (15)","CCI-001124":"SC-7 (16)","CCI-001125":"SC-7 (17)","CCI-001126":"SC-7 (18)","CCI-001127":"SC-8","CCI-001128":"SC-8 (1)","CCI-001129":"SC-8 (2)","CCI-001130":"SC-9","CCI-001131":"SC-9 (1)","CCI-001132":"SC-9 (2)","CCI-001133":"SC-10","CCI-001134":"SC-10","CCI-001135":"SC-11 a","CCI-001136":"SC-11","CCI-001137":"SC-12","CCI-001138":"SC-12","CCI-001139":"SC-12 (1)","CCI-001140":"SC-12 (2)","CCI-001141":"SC-12 (3)","CCI-001142":"SC-12 (4)","CCI-001143":"SC-12 (5)","CCI-001144":"SC-13","CCI-001145":"SC-13 (1)","CCI-001146":"SC-13 (2)","CCI-001147":"SC-13 (3)","CCI-001148":"SC-13 (4)","CCI-001149":"SC-14","CCI-001150":"SC-15 a","CCI-001151":"SC-15 a","CCI-001152":"SC-15 b","CCI-001153":"SC-15 (1)","CCI-001154":"SC-15 (2)","CCI-001155":"SC-15 (3)","CCI-001156":"SC-15 (3)","CCI-001157":"SC-16","CCI-001158":"SC-16 (1)","CCI-001159":"SC-17 a","CCI-001160":"SC-18 a","CCI-001161":"SC-18 b","CCI-001162":"SC-18 b","CCI-001163":"SC-18 b","CCI-001164":"SC-18 b","CCI-001165":"SC-18 b","CCI-001166":"SC-18 (1)","CCI-001167":"SC-18 (2)","CCI-001168":"SC-18 (2)","CCI-001169":"SC-18 (3)","CCI-001170":"SC-18 (4)","CCI-001171":"SC-18 (4)","CCI-001172":"SC-18 (4)","CCI-001173":"SC-19 a","CCI-001174":"SC-19 a","CCI-001175":"SC-19 b","CCI-001176":"SC-19 b","CCI-001177":"SC-19 b","CCI-001178":"SC-20 a","CCI-001179":"SC-20 b","CCI-001180":"SC-21","CCI-001181":"SC-21 (1)","CCI-001182":"SC-22","CCI-001183":"SC-22","CCI-001184":"SC-23","CCI-001185":"SC-23 (1)","CCI-001186":"SC-23 (2)","CCI-001187":"SC-23 (3)","CCI-001188":"SC-23 (3)","CCI-001189":"SC-23 (3)","CCI-001190":"SC-24","CCI-001191":"SC-24","CCI-001192":"SC-24","CCI-001193":"SC-24","CCI-001194":"SC-25","CCI-001195":"SC-26","CCI-001196":"SC-35","CCI-001197":"SC-27","CCI-001198":"SC-27","CCI-001199":"SC-28","CCI-001200":"SC-28 (1)","CCI-001201":"SC-29","CCI-001202":"SC-30","CCI-001203":"SC-29 (1)","CCI-001204":"SC-29 (1)","CCI-001205":"SC-30 (2)","CCI-001206":"SC-31","CCI-001207":"SC-31 (1)","CCI-001208":"SC-32","CCI-001209":"SC-33","CCI-001210":"SC-34 a","CCI-001211":"SC-34 b","CCI-001212":"SC-34","CCI-001213":"SC-34 b","CCI-001214":"SC-34 (1)","CCI-001215":"SC-34 (1)","CCI-001216":"SC-34 (2)","CCI-001217":"SI-1 a 1 (a)","CCI-001218":"SI-1 a 1","CCI-001219":"SI-1 c 1","CCI-001220":"SI-1 a 2","CCI-001221":"SI-1 a 2","CCI-001222":"SI-1 c 2","CCI-001223":"SI-1 c 1","CCI-001224":"SI-1 c 2","CCI-001225":"SI-2 a","CCI-001226":"SI-2 a","CCI-001227":"SI-2 a","CCI-001228":"SI-2 b","CCI-001229":"SI-2 b","CCI-001230":"SI-2 d","CCI-001231":"SI-2 (1)","CCI-001232":"SI-2 (1)","CCI-001233":"SI-2 (2)","CCI-001234":"SI-2 (2)","CCI-001235":"SI-2 (3) (a)","CCI-001236":"SI-2 (3) (b)","CCI-001237":"SI-2 (4)","CCI-001238":"SI-2 (4)","CCI-001239":"SI-3 a","CCI-001240":"SI-3 b","CCI-001241":"SI-3 c 1","CCI-001242":"SI-3 c 1","CCI-001243":"SI-3 c 2","CCI-001244":"SI-3 c 2","CCI-001245":"SI-3 d","CCI-001246":"SI-3 (1)","CCI-001247":"SI-3 (2)","CCI-001248":"SI-3 (3)","CCI-001249":"SI-3 (4)","CCI-001250":"SI-3 (5)","CCI-001251":"SI-3 (6) (a)","CCI-001252":"SI-4 a","CCI-001253":"SI-4 a 1","CCI-001254":"SI-4 b","CCI-001255":"SI-4 c 1","CCI-001256":"SI-4 c 2","CCI-001257":"SI-4 e","CCI-001258":"SI-4 f","CCI-001259":"SI-4 (1)","CCI-001260":"SI-4 (2)","CCI-001261":"SI-4 (3)","CCI-001262":"SI-4 (4)","CCI-001263":"SI-4 (5)","CCI-001264":"SI-4 (5)","CCI-001265":"SI-4 (6)","CCI-001266":"SI-4 (7) (a)","CCI-001267":"SI-4 (7) (a)","CCI-001268":"SI-4 (7) (b)","CCI-001269":"SI-4 (8)","CCI-001270":"SI-4 (9)","CCI-001271":"SI-4 (9)","CCI-001272":"SI-4 (10)","CCI-001273":"SI-4 (11)","CCI-001274":"SI-4 (12)","CCI-001275":"SI-4 (12)","CCI-001276":"SI-4 (13) (a)","CCI-001277":"SI-4 (13) (b)","CCI-001278":"SI-4 (13) (c)","CCI-001279":"SI-4 (13) (c)","CCI-001280":"SI-4 (13) (c)","CCI-001281":"SI-4 (14)","CCI-001282":"SI-4 (15)","CCI-001283":"SI-4 (16)","CCI-001284":"SI-4 (17)","CCI-001285":"SI-5 a","CCI-001286":"SI-5 b","CCI-001287":"SI-5 c","CCI-001288":"SI-5 c","CCI-001289":"SI-5 d","CCI-001290":"SI-5 (1)","CCI-001291":"SI-6","CCI-001292":"SI-6","CCI-001293":"SI-6","CCI-001294":"SI-6 c","CCI-001295":"SI-6 (2)","CCI-001296":"SI-6 (3)","CCI-001297":"SI-7","CCI-001298":"SI-7 (1)","CCI-001299":"SI-7 (1)","CCI-001300":"SI-7 (2)","CCI-001301":"SI-7 (3)","CCI-001302":"SI-7 (4)","CCI-001303":"SI-7 (4)","CCI-001304":"SI-7 (4)","CCI-001305":"SI-8 a","CCI-001306":"SI-8 b","CCI-001307":"SI-8 (1)","CCI-001308":"SI-8 (2)","CCI-001309":"SI-9","CCI-001310":"SI-10","CCI-001311":"SI-11 a","CCI-001312":"SI-11 a","CCI-001313":"SI-11 b","CCI-001314":"SI-11 b","CCI-001315":"SI-12","CCI-001316":"SI-13 a","CCI-001317":"SI-13 a","CCI-001318":"SI-13 b","CCI-001319":"SI-13 (1)","CCI-001320":"SI-13 (1)","CCI-001321":"SI-7 (16)","CCI-001322":"SI-7 (16)","CCI-001323":"SI-13 (3)","CCI-001324":"SI-13 (3)","CCI-001325":"SI-13 (3)","CCI-001326":"SI-13 (4) (a)","CCI-001327":"SI-13 (4) (a)","CCI-001328":"SI-13 (4) (b)","CCI-001329":"SI-13 (4) (b)","CCI-001330":"AC-19 (4) (a)","CCI-001331":"AC-19 (4) (b) (1)","CCI-001332":"AC-19 (4) (b) (2)","CCI-001333":"AC-19 (4) (b) (3)","CCI-001334":"AC-19 (4) (b) (4)","CCI-001335":"AC-19 (4) (b) (4)","CCI-001336":"AT-4 b","CCI-001337":"AT-4 b","CCI-001338":"AU-10 (1)","CCI-001339":"AU-10 (2)","CCI-001340":"AU-10 (3)","CCI-001341":"AU-10 (4) (a)","CCI-001342":"AU-10 (5)","CCI-001343":"AU-5 (4)","CCI-001344":"AU-6 (7)","CCI-001345":"AU-6 (8)","CCI-001346":"AU-6 (8)","CCI-001347":"AU-6 (9)","CCI-001348":"AU-9 (2)","CCI-001349":"AU-9 (2)","CCI-001350":"AU-9 (3)","CCI-001351":"AU-9 (4)","CCI-001352":"AU-9 (4) (b)","CCI-001353":"AU-12 (2)","CCI-001354":"AC-2 h","CCI-001355":"AC-2 h","CCI-001356":"AC-2 (5) (c)","CCI-001357":"AC-2 (5) (d)","CCI-001358":"AC-2 (7) (a)","CCI-001359":"AC-2 (7) (b)","CCI-001360":"AC-2 (7) (b)","CCI-001361":"AC-2 (2)","CCI-001362":"AC-3 (4)","CCI-001363":"AC-3 (4) (a)","CCI-001365":"AC-2 (2)","CCI-001366":"AC-3 (6)","CCI-001367":"AC-3 (6)","CCI-001368":"AC-4","CCI-001371":"AC-4 (14)","CCI-001372":"AC-4 (14)","CCI-001373":"AC-4 (15)","CCI-001374":"AC-4 (15)","CCI-001376":"AC-4 (17) (a)","CCI-001377":"AC-4 (17) (a)","CCI-001380":"AC-5 b","CCI-001382":"AC-7 (2)","CCI-001383":"AC-7 (2)","CCI-001384":"AC-8 c 1","CCI-001385":"AC-8 c 2","CCI-001386":"AC-8 c 2","CCI-001387":"AC-8 c 2","CCI-001388":"AC-8 c 3","CCI-001389":"AC-9 (2)","CCI-001390":"AC-9 (2)","CCI-001391":"AC-9 (2)","CCI-001392":"AC-9 (2)","CCI-001393":"AC-9 (3)","CCI-001394":"AC-9 (3)","CCI-001395":"AC-9 (3)","CCI-001396":"AC-16","CCI-001397":"AC-16","CCI-001398":"AC-16","CCI-001399":"AC-16","CCI-001400":"AC-16","CCI-001401":"AC-16","CCI-001402":"AC-17 c","CCI-001403":"AC-2 (4)","CCI-001404":"AC-2 (4)","CCI-001405":"AC-2 (4)","CCI-001406":"AC-2 (5)","CCI-001407":"AC-2 (7) (a)","CCI-001408":"AC-3 (2)","CCI-001409":"AC-3 (3)","CCI-001410":"AC-3 (3)","CCI-001411":"AC-3 (5)","CCI-001412":"AC-3 (6)","CCI-001413":"AC-3 (6)","CCI-001414":"AC-4","CCI-001415":"AC-4 (5)","CCI-001416":"AC-4 (7)","CCI-001417":"AC-4 (8) (a)","CCI-001418":"AC-4 (9)","CCI-001419":"AC-6 (2)","CCI-001420":"AC-6 (3)","CCI-001421":"AC-6 (5)","CCI-001422":"AC-6 (6)","CCI-001423":"AC-7 a","CCI-001424":"AC-16 (1)","CCI-001425":"AC-16 (2)","CCI-001426":"AC-16 (3)","CCI-001427":"AC-16 (4)","CCI-001428":"AC-16 (5)","CCI-001429":"AC-16 (5)","CCI-001430":"AC-16 (5)","CCI-001431":"AC-17 (5)","CCI-001432":"AC-17 (5)","CCI-001433":"AC-17 (7)","CCI-001434":"AC-17 (7)","CCI-001435":"AC-17 (8)","CCI-001436":"AC-17 (8)","CCI-001437":"AC-17 (4)","CCI-001438":"AC-18 a","CCI-001439":"AC-18 a","CCI-001440":"AC-18 b","CCI-001441":"AC-18 b","CCI-001442":"AC-18 d","CCI-001443":"AC-18 (1)","CCI-001444":"AC-18 (1)","CCI-001445":"AC-18 (2)","CCI-001446":"AC-18 (2)","CCI-001447":"AC-18 (2)","CCI-001448":"AC-18 (2)","CCI-001449":"AC-18 (3)","CCI-001450":"AC-18 (4)","CCI-001451":"AC-18 (5)","CCI-001452":"AC-7 a","CCI-001453":"AC-17 (2)","CCI-001454":"AC-17 (7)","CCI-001455":"AC-17 (8)","CCI-001456":"AC-19 f","CCI-001457":"AC-19 g","CCI-001458":"AC-19 (4) (b) (4)","CCI-001459":"AU-12 a","CCI-001460":"AU-13 a","CCI-001461":"AU-13 a","CCI-001462":"AU-14 (2)","CCI-001463":"AU-14 b","CCI-001464":"AU-14 (1)","CCI-001465":"AC-20 b","CCI-001466":"AC-20 b","CCI-001467":"AC-20 (1) (a)","CCI-001468":"AC-20 (1) (a)","CCI-001469":"AC-20 (1) (a)","CCI-001470":"AC-21 a","CCI-001471":"AC-21 b","CCI-001472":"AC-21 b","CCI-001473":"AC-22 a","CCI-001474":"AC-22 b","CCI-001475":"AC-22 c","CCI-001476":"AC-22 d","CCI-001477":"AC-22 d","CCI-001478":"AC-22 d","CCI-001479":"AT-2 c","CCI-001480":"AT-2","CCI-001481":"AT-3 (1)","CCI-001482":"AT-3 (1)","CCI-001483":"AT-3 (1)","CCI-001484":"AU-2 c","CCI-001485":"AU-2 c","CCI-001486":"AU-2 (3)","CCI-001487":"AU-3 f","CCI-001488":"AU-3 (1)","CCI-001489":"AU-3 (2)","CCI-001490":"AU-5 b","CCI-001491":"AU-6 (6)","CCI-001492":"AU-8 (1) (a)","CCI-001493":"AU-9 a","CCI-001494":"AU-9 a","CCI-001495":"AU-9 a","CCI-001496":"AU-9 (3)","CCI-001497":"CM-2 b 1","CCI-001498":"CM-3 (1) (c)","CCI-001499":"CM-5 (6)","CCI-001500":"CM-5 (7)","CCI-001501":"CM-5 (7)","CCI-001502":"CM-6 d","CCI-001503":"CM-6 d","CCI-001504":"PS-1 a 1 (a)","CCI-001505":"PS-1 a 1","CCI-001506":"PS-1 c 1","CCI-001507":"PS-1 c 1","CCI-001508":"PS-1 c 2","CCI-001509":"PS-1 a 2","CCI-001510":"PS-1 a 2","CCI-001511":"PS-1 c 2","CCI-001512":"PS-2 a","CCI-001513":"PS-2 b","CCI-001514":"PS-2 c","CCI-001515":"PS-2 c","CCI-001516":"PS-3 a","CCI-001517":"PS-3 b","CCI-001518":"PS-3 b","CCI-001519":"PS-3 b","CCI-001520":"PS-3 (1)","CCI-001521":"PS-3 (2)","CCI-001522":"PS-4 a","CCI-001523":"PS-4 c","CCI-001524":"PS-4 d","CCI-001525":"PS-4 e","CCI-001526":"PS-4 e","CCI-001527":"PS-5 a","CCI-001528":"PS-5 b","CCI-001529":"PS-5 b","CCI-001530":"PS-5 b","CCI-001531":"PS-6 c 1","CCI-001532":"PS-6 b","CCI-001533":"PS-6 b","CCI-001534":"PS-6 (1) (a)","CCI-001535":"PS-6 (1) (b)","CCI-001536":"PS-6 (2) (a)","CCI-001537":"PS-6 (2) (b)","CCI-001538":"PS-6 (2) (c)","CCI-001539":"PS-7 a","CCI-001540":"PS-7 c","CCI-001541":"PS-7 e","CCI-001542":"PS-8 a","CCI-001543":"PM-1 a","CCI-001544":"IA-5 c","CCI-001545":"AC-1 c 1","CCI-001546":"AC-1 c 2","CCI-001547":"AC-2 j","CCI-001548":"AC-4","CCI-001549":"AC-4","CCI-001550":"AC-4","CCI-001551":"AC-4","CCI-001552":"AC-4 (3)","CCI-001553":"AC-4 (10)","CCI-001554":"AC-4 (11)","CCI-001555":"AC-4 (17) (a)","CCI-001556":"AC-4 (17) (a)","CCI-001557":"AC-4 (17) c","CCI-001558":"AC-6 (1) (a)","CCI-001559":"AC-16 (2)","CCI-001560":"AC-16 (4)","CCI-001561":"AC-17 (3)","CCI-001562":"AC-17 (5)","CCI-001563":"AC-18 (2)","CCI-001564":"AT-1 c 1","CCI-001565":"AT-1 c 2","CCI-001566":"AT-3 (2)","CCI-001567":"AT-3 (2)","CCI-001568":"AT-3 (2)","CCI-001569":"AU-1 c 1","CCI-001570":"AU-1 c 2","CCI-001571":"AU-2 a","CCI-001572":"AU-5 a","CCI-001573":"AU-5 (3)","CCI-001574":"AU-5 (3)","CCI-001575":"AU-9 (2)","CCI-001576":"AU-12 (1)","CCI-001577":"AU-12 (1)","CCI-001578":"CA-1 c 2","CCI-001579":"CA-2 (2)","CCI-001580":"CA-3 b","CCI-001581":"CA-7 g","CCI-001582":"CA-2 (2)","CCI-001583":"CA-2 (2)","CCI-001584":"CM-1 c 2","CCI-001585":"CM-2 b 2","CCI-001586":"CM-3 g","CCI-001587":"CM-4 (1)","CCI-001588":"CM-6 a","CCI-001589":"CM-6 (3)","CCI-001590":"CM-7 (2)","CCI-001591":"CM-7 (2)","CCI-001592":"CM-7 (2)","CCI-001593":"CM-7 (2)","CCI-001594":"CM-7 (2)","CCI-001595":"CM-7 (2)","CCI-001596":"CP-1 c 2","CCI-001597":"CP-1 a 2","CCI-001598":"CP-1 c 2","CCI-001599":"CP-2 (5)","CCI-001600":"CP-2 (5)","CCI-001601":"CP-2 (6)","CCI-001602":"CP-2 (6)","CCI-001603":"CP-6 (1)","CCI-001604":"CP-6 (3)","CCI-001605":"CP-7 (1)","CCI-001606":"CP-7 (2)","CCI-001607":"CP-8 (2)","CCI-001608":"CP-8 (3)","CCI-001609":"CP-9 (6)","CCI-001610":"IA-5 f","CCI-001611":"IA-5 (1) (a)","CCI-001612":"IA-5 (1) (a)","CCI-001613":"IA-5 (1) (a)","CCI-001614":"IA-5 (1) (a)","CCI-001615":"IA-5 (1) (b)","CCI-001616":"IA-5 (1) (d)","CCI-001617":"IA-5 (1) (d)","CCI-001618":"IA-5 (1) (e)","CCI-001619":"IA-5 (1) (a)","CCI-001620":"IA-5 (3)","CCI-001621":"IA-5 (8)","CCI-001622":"IR-2","CCI-001623":"IR-2","CCI-001624":"IR-3","CCI-001625":"IR-4 c","CCI-001626":"IR-5 (1)","CCI-001627":"IR-5 (1)","CCI-001628":"MA-1 c 2","CCI-001629":"MA-2 (2)","CCI-001630":"MA-4 (1)","CCI-001631":"MA-4 (3) (b)","CCI-001632":"MA-4 (4) (b) (1)","CCI-001633":"MP-3 a","CCI-001634":"PE-2 (3)","CCI-001635":"PE-2 d","CCI-001636":"PL-1 c 1","CCI-001637":"PL-1 c 1","CCI-001638":"PL-1 c 2","CCI-001639":"PL-4 a","CCI-001640":"PM-8","CCI-001641":"RA-5 a","CCI-001642":"RA-3 c","CCI-001643":"RA-5 a","CCI-001644":"RA-5 (3)","CCI-001645":"RA-5 (5)","CCI-001646":"SA-1 c 2","CCI-001647":"SA-4 (7) (b)","CCI-001648":"SA-5 (5)","CCI-001649":"SA-7","CCI-001650":"SA-10 (b)","CCI-001651":"SA-10 (b)","CCI-001652":"SA-10 (b)","CCI-001653":"SA-10 (b)","CCI-001654":"SA-10 (b)","CCI-001655":"SA-10 (b)","CCI-001656":"SC-3","CCI-001657":"SC-7 a","CCI-001658":"SC-7 a","CCI-001659":"SC-7 (2)","CCI-001660":"SC-7 (14)","CCI-001661":"SC-11 b","CCI-001662":"SC-18 (1)","CCI-001663":"SC-20 b","CCI-001664":"SC-23 (3)","CCI-001665":"SC-24","CCI-001666":"SC-28 (1)","CCI-001667":"SI-2 (3)","CCI-001668":"SI-3 a","CCI-001669":"SI-3 (6) (a)","CCI-001670":"SI-4 (7) (b)","CCI-001671":"SI-4 (11)","CCI-001672":"SI-4 (14)","CCI-001673":"SI-4 (14)","CCI-001674":"SI-6","CCI-001675":"SI-6 (3)","CCI-001676":"SI-6","CCI-001677":"SI-8 a","CCI-001678":"SI-12","CCI-001679":"SI-13 b","CCI-001680":"PM-1 a 2","CCI-001681":"CA-2 (2)","CCI-001682":"AC-2 (2)","CCI-001683":"AC-2 (4)","CCI-001684":"AC-2 (4)","CCI-001685":"AC-2 (4)","CCI-001686":"AC-2 (4)","CCI-001687":"SC-18 (2)","CCI-001688":"SC-18 (2)","CCI-001689":"SI-13 (4) (b)","CCI-001690":"SA-5 (1)","CCI-001691":"SA-5 (1)","CCI-001692":"SA-5 (4)","CCI-001693":"AC-3 (4)","CCI-001694":"AC-3 (4)","CCI-001695":"SC-18 (3)","CCI-001726":"CM-10 a","CCI-001727":"CM-10 a","CCI-001728":"CM-10 a","CCI-001729":"CM-10 a","CCI-001730":"CM-10 b","CCI-001731":"CM-10 b","CCI-001732":"CM-10 c","CCI-001733":"CM-10 c","CCI-001734":"CM-10 (1)","CCI-001735":"CM-10 (1)","CCI-001736":"CM-2 (3)","CCI-001737":"CM-2 (7) (a)","CCI-001738":"CM-2 (7) (a)","CCI-001739":"CM-2 (7) (a)","CCI-001740":"CM-3 b","CCI-001741":"CM-3 c","CCI-001742":"CM-3 (1) (b)","CCI-001743":"CM-3 (5)","CCI-001744":"CM-3 (5)","CCI-001745":"CM-3 (6)","CCI-001746":"CM-3 (6)","CCI-001747":"CM-5 (3)","CCI-001748":"CM-5 (3)","CCI-001749":"CM-5 (3)","CCI-001750":"CM-5 (3)","CCI-001751":"CM-5 (4)","CCI-001752":"CM-5 (4)","CCI-001753":"CM-5 (5) (a)","CCI-001754":"CM-5 (5) (a)","CCI-001755":"CM-6 c","CCI-001756":"CM-6 c","CCI-001757":"CM-6 (2)","CCI-001758":"CM-6 (2)","CCI-001759":"CM-6 (2)","CCI-001760":"CM-7 (1) (a)","CCI-001761":"CM-7 (1) (b)","CCI-001762":"CM-7 (1) (b)","CCI-001763":"CM-7 (2)","CCI-001764":"CM-7 (2)","CCI-001765":"CM-7 (4) (a)","CCI-001766":"CM-7 (4) (a)","CCI-001767":"CM-7 (4) (b)","CCI-001768":"CM-7 (4) (c)","CCI-001769":"CM-7 (4) (c)","CCI-001770":"CM-7 (4) (c)","CCI-001771":"CM-7 (4) (c)","CCI-001772":"CM-7 (5) (a)","CCI-001773":"CM-7 (5) (a)","CCI-001774":"CM-7 (5) (b)","CCI-001775":"CM-7 (5) (c)","CCI-001776":"CM-7 (5) (c)","CCI-001777":"CM-7 (5) (c)","CCI-001778":"CM-7 (5) (c)","CCI-001779":"CM-8 b","CCI-001780":"CM-8 b","CCI-001781":"CM-8 b","CCI-001782":"CM-8 b","CCI-001783":"CM-8 (3) (b)","CCI-001784":"CM-8 (3) (b)","CCI-001785":"CM-8 (7)","CCI-001786":"CM-8 (8)","CCI-001787":"CM-8 (9) (a)","CCI-001788":"CM-8 (9) (a)","CCI-001789":"CM-8 (9) (b)","CCI-001790":"CM-9 b","CCI-001791":"CM-9 b","CCI-001792":"CM-9 b","CCI-001793":"CM-9 b","CCI-001794":"CM-9 b","CCI-001795":"CM-9 b","CCI-001796":"CM-9 c","CCI-001797":"CM-9 c","CCI-001798":"CM-9 c","CCI-001799":"CM-9 e","CCI-001800":"CM-9 d","CCI-001801":"CM-9 e","CCI-001802":"CM-10 b","CCI-001803":"CM-10 b","CCI-001804":"CM-11 a","CCI-001805":"CM-11 a","CCI-001806":"CM-11 b","CCI-001807":"CM-11 b","CCI-001808":"CM-11 c","CCI-001809":"CM-11 c","CCI-001810":"CM-11 (1)","CCI-001811":"CM-11 (1)","CCI-001812":"CM-11 (2)","CCI-001813":"CM-5 (1) (a)","CCI-001814":"CM-5 (1)","CCI-001815":"CM-2 (7) (b)","CCI-001816":"CM-2 (7) (b)","CCI-001817":"CM-4 (1)","CCI-001818":"CM-4 (1)","CCI-001819":"CM-3 d","CCI-001820":"CM-1 a 1","CCI-001821":"CM-1 a 1 (a)","CCI-001822":"CM-1 a 1 (a)","CCI-001823":"CM-1 a 2","CCI-001824":"CM-1 a 2","CCI-001825":"CM-1 a 2","CCI-001826":"CM-5 (2)","CCI-001827":"CM-5 (5) (b)","CCI-001828":"CM-5 (5) (b)","CCI-001829":"CM-5 (5) (b)","CCI-001830":"CM-5 (5) (b)","CCI-001831":"AU-1 a 1","CCI-001832":"AU-1 a 1 (a)","CCI-001833":"AU-1 a 2","CCI-001834":"AU-1 a 2","CCI-001835":"AU-1 b 1","CCI-001836":"AU-1 b 1","CCI-001837":"AU-1 b 1","CCI-001838":"AU-1 b 1","CCI-001839":"AU-1 b 2","CCI-001840":"AU-1 b 2","CCI-001841":"AU-1 b 2","CCI-001842":"AU-1 b 2","CCI-001843":"AU-2 (3)","CCI-001844":"AU-3 (2)","CCI-001845":"AU-3 (2)","CCI-001846":"AU-3 (2)","CCI-001847":"AU-3 (2)","CCI-001848":"AU-4","CCI-001849":"AU-4","CCI-001850":"AU-4 (1)","CCI-001851":"AU-4 (1)","CCI-001852":"AU-5 (1)","CCI-001853":"AU-5 (1)","CCI-001854":"AU-5 (1)","CCI-001855":"AU-5 (1)","CCI-001856":"AU-5 (2)","CCI-001857":"AU-5 (2)","CCI-001858":"AU-5 (2)","CCI-001859":"AU-5 (3)","CCI-001860":"AU-5 (4)","CCI-001861":"AU-5 (4)","CCI-001862":"AU-6 a","CCI-001863":"AU-6 b","CCI-001864":"AU-6 (1)","CCI-001865":"AU-6 (1)","CCI-001866":"AU-6 (5)","CCI-001867":"AU-6 (5)","CCI-001868":"AU-6 (7)","CCI-001869":"AU-6 (7)","CCI-001870":"AU-6 (8)","CCI-001871":"AU-6 (9)","CCI-001872":"AU-6 (10)","CCI-001873":"AU-6 (10)","CCI-001874":"AU-6 (10)","CCI-001875":"AU-7 a","CCI-001876":"AU-7 a","CCI-001877":"AU-7 a","CCI-001878":"AU-7 a","CCI-001879":"AU-7 a","CCI-001880":"AU-7 a","CCI-001881":"AU-7 b","CCI-001882":"AU-7 b","CCI-001883":"AU-7 (1)","CCI-001884":"AU-7 (2)","CCI-001885":"AU-7 (2)","CCI-001886":"AU-7 (2)","CCI-001887":"AU-7 (2)","CCI-001888":"AU-8 b","CCI-001889":"AU-8 b","CCI-001890":"AU-8 b","CCI-001891":"AU-8 (1) (a)","CCI-001892":"AU-8 (1) (b)","CCI-001893":"AU-8 (2)","CCI-001894":"AU-9 (4)","CCI-001895":"AU-9 (5)","CCI-001896":"AU-9 (5)","CCI-001897":"AU-9 (6)","CCI-001898":"AU-9 (6)","CCI-001899":"AU-10","CCI-001900":"AU-10 (1) (a)","CCI-001901":"AU-10 (1) (a)","CCI-001902":"AU-10 (1) (b)","CCI-001903":"AU-10 (2) (a)","CCI-001904":"AU-10 (2) (a)","CCI-001905":"AU-10 (2) (b)","CCI-001906":"AU-10 (2) (b)","CCI-001907":"AU-10 (4) (a)","CCI-001908":"AU-10 (4) (b)","CCI-001909":"AU-10 (4) (b)","CCI-001910":"AU-12 b","CCI-001911":"AU-12 (3)","CCI-001912":"AU-12 (3)","CCI-001913":"AU-12 (3)","CCI-001914":"AU-12 (3)","CCI-001915":"AU-13 a","CCI-001916":"AU-13 (1)","CCI-001917":"AU-13 (2)","CCI-001918":"AU-13 (2)","CCI-001919":"AU-14 a","CCI-001920":"AU-14 (3)","CCI-001921":"AU-15","CCI-001922":"AU-15","CCI-001923":"AU-16","CCI-001924":"AU-16","CCI-001925":"AU-16","CCI-001926":"AU-16 (1)","CCI-001927":"AU-16 (2)","CCI-001928":"AU-16 (2)","CCI-001929":"AU-16 (2)","CCI-001930":"AU-1 a 1","CCI-001931":"AU-1 a 2","CCI-001932":"IA-1 a 1","CCI-001933":"IA-1 a 1","CCI-001934":"IA-1 a 2","CCI-001935":"IA-2 (6)","CCI-001936":"IA-2 (6)","CCI-001937":"IA-2 (6)","CCI-001938":"IA-2 (7)","CCI-001939":"IA-2 (7)","CCI-001940":"IA-2 (7)","CCI-001941":"IA-2 (8)","CCI-001942":"IA-2 (9)","CCI-001943":"IA-2 (10)","CCI-001944":"IA-2 (10)","CCI-001945":"IA-2 (10)","CCI-001946":"IA-2 (10)","CCI-001947":"IA-2 (11)","CCI-001948":"IA-2 (11)","CCI-001949":"IA-2 (11)","CCI-001950":"IA-2 (11)","CCI-001951":"IA-2 (11)","CCI-001952":"IA-2 (11)","CCI-001953":"IA-2 (12)","CCI-001954":"IA-2 (12)","CCI-001955":"IA-2 (13)","CCI-001956":"IA-2 (13)","CCI-001957":"IA-2 (13)","CCI-001958":"IA-3","CCI-001959":"IA-3 (1)","CCI-001960":"IA-3 (3) (a)","CCI-001961":"IA-3 (3) (a)","CCI-001962":"IA-3 (3) (a)","CCI-001963":"IA-3 (3) (a)","CCI-001964":"IA-3 (4)","CCI-001965":"IA-3 (4)","CCI-001966":"IA-3 (4)","CCI-001967":"IA-3 (1)","CCI-001968":"IA-3 (4)","CCI-001969":"IA-3 (4)","CCI-001970":"IA-4 a","CCI-001971":"IA-4 a","CCI-001972":"IA-4 b","CCI-001973":"IA-4 c","CCI-001974":"IA-4 d","CCI-001975":"IA-4 d","CCI-001976":"IA-4 (5)","CCI-001977":"IA-4 (6)","CCI-001978":"IA-4 (6)","CCI-001979":"IA-4 (7)","CCI-001980":"IA-5 a","CCI-001981":"IA-5 d","CCI-001982":"IA-5 d","CCI-001983":"IA-5 d","CCI-001984":"IA-5 d","CCI-001985":"IA-5 d","CCI-001986":"IA-5 d","CCI-001987":"IA-5 d","CCI-001988":"IA-5 d","CCI-001989":"IA-5 e","CCI-001990":"IA-5 i","CCI-001991":"IA-5 (2) (d)","CCI-001992":"IA-5 (3)","CCI-001993":"IA-5 (3)","CCI-001994":"IA-5 (3)","CCI-001995":"IA-5 (3)","CCI-001996":"IA-5 (4)","CCI-001997":"IA-5 (4)","CCI-001998":"IA-5 (5)","CCI-001999":"IA-5 (9)","CCI-002000":"IA-5 (9)","CCI-002001":"IA-5 (10)","CCI-002002":"IA-5 (11)","CCI-002003":"IA-5 (11)","CCI-002004":"IA-5 (12)","CCI-002005":"IA-5 (12)","CCI-002006":"IA-5 (13)","CCI-002007":"IA-5 (13)","CCI-002008":"IA-5 (14)","CCI-002009":"IA-8 (1)","CCI-002010":"IA-8 (1)","CCI-002011":"IA-8 (2)","CCI-002012":"IA-8 (3)","CCI-002013":"IA-8 (3)","CCI-002014":"IA-8 (4)","CCI-002015":"IA-8 (5)","CCI-002016":"IA-8 (5)","CCI-002017":"IA-9","CCI-002018":"IA-9","CCI-002019":"IA-9","CCI-002020":"IA-9","CCI-002021":"IA-9","CCI-002022":"IA-9","CCI-002023":"IA-9 (1)","CCI-002024":"IA-9 (1)","CCI-002025":"IA-9 (1)","CCI-002026":"IA-9 (1)","CCI-002027":"IA-9 (1)","CCI-002028":"IA-9 (1)","CCI-002029":"IA-9 (2)","CCI-002030":"IA-9 (2)","CCI-002031":"IA-9 (2)","CCI-002032":"IA-9 (2)","CCI-002033":"IA-10","CCI-002034":"IA-10","CCI-002035":"IA-10","CCI-002036":"IA-11","CCI-002037":"IA-11","CCI-002038":"IA-11","CCI-002039":"IA-11","CCI-002040":"IA-4 (2)","CCI-002041":"IA-5 (1) (f)","CCI-002042":"IA-5 g","CCI-002043":"IA-5 (15)","CCI-002044":"AU-11 (1)","CCI-002045":"AU-11 (1)","CCI-002046":"AU-8 (1) (b)","CCI-002047":"AU-12 (3)","CCI-002048":"AT-1 a 1 (a)","CCI-002049":"AT-1 a 2","CCI-002050":"AT-3 (1)","CCI-002051":"AT-3 (2)","CCI-002052":"AT-3 (3)","CCI-002053":"AT-3 (4)","CCI-002054":"AT-3 (4)","CCI-002055":"AT-2 (2)","CCI-002056":"CM-3 d","CCI-002057":"CM-3 (1) (f)","CCI-002058":"CM-3 (1) (f)","CCI-002059":"CM-6 (1)","CCI-002060":"CA-1 a 1","CCI-002061":"CA-1 a 1 (a)","CCI-002062":"CA-1 a 2","CCI-002063":"CA-2 (1)","CCI-002064":"CA-2 (2)","CCI-002065":"CA-2 (2)","CCI-002066":"CA-2 (3)","CCI-002067":"CA-2 (3)","CCI-002068":"CA-2 (3)","CCI-002069":"CA-2 (3)","CCI-002070":"CA-2 b 3","CCI-002071":"CA-2 f","CCI-002072":"CA-3 (1)","CCI-002073":"CA-3 (1)","CCI-002074":"CA-3 (2)","CCI-002075":"CA-3 (3)","CCI-002076":"CA-3 (3)","CCI-002077":"CA-3 (3)","CCI-002078":"CA-3 (4)","CCI-002079":"CA-3 (4)","CCI-002080":"CA-3 (5)","CCI-002081":"CA-3 (5)","CCI-002082":"CA-3 (5)","CCI-002083":"CA-3 c","CCI-002084":"CA-3 c","CCI-002085":"CA-7 (1)","CCI-002086":"CA-7 (3)","CCI-002087":"CA-7 a","CCI-002088":"CA-7 b","CCI-002089":"CA-7 b","CCI-002090":"CA-7 d","CCI-002091":"CA-7 e","CCI-002092":"CA-7 f","CCI-002093":"CA-8","CCI-002094":"CA-8","CCI-002095":"CA-8","CCI-002096":"CA-8 (1)","CCI-002097":"CA-8 (2)","CCI-002098":"CA-8 (2)","CCI-002099":"CA-8 (2)","CCI-002100":"CA-9 (1)","CCI-002101":"CA-9 (a)","CCI-002102":"CA-9 (a)","CCI-002103":"CA-9 (b)","CCI-002104":"CA-9 (b)","CCI-002105":"CA-9 (b)","CCI-002106":"AC-1 a 1","CCI-002107":"AC-1 a 1 (a)","CCI-002108":"AC-1 a 2","CCI-002109":"AC-1 a 2","CCI-002110":"AC-2 a","CCI-002111":"AC-2 a","CCI-002112":"AC-2 b","CCI-002113":"AC-2 c","CCI-002114":"AC-2 d","CCI-002115":"AC-2 d 1","CCI-002116":"AC-2 d 2","CCI-002117":"AC-2 d 2","CCI-002118":"AC-2 d 3","CCI-002119":"AC-2 d 3","CCI-002120":"AC-2 e","CCI-002121":"AC-2 f","CCI-002122":"AC-2 g","CCI-002123":"AC-2 h 1","CCI-002124":"AC-2 h 2","CCI-002125":"AC-2 h 3","CCI-002126":"AC-2 i 1","CCI-002127":"AC-2 i 2","CCI-002128":"AC-2 i 3","CCI-002129":"AC-2 k","CCI-002130":"AC-2 (4)","CCI-002131":"AC-2 (4)","CCI-002132":"AC-2 (4)","CCI-002133":"AC-2 (5)","CCI-002134":"AC-2 (6)","CCI-002135":"AC-2 (6)","CCI-002136":"AC-2 (7) (c)","CCI-002137":"AC-2 (7) (d)","CCI-002138":"AC-2 (8)","CCI-002139":"AC-2 (8)","CCI-002140":"AC-2 (9)","CCI-002141":"AC-2 (9)","CCI-002142":"AC-2 (10)","CCI-002143":"AC-2 (11)","CCI-002144":"AC-2 (11)","CCI-002145":"AC-2 (11)","CCI-002146":"AC-2 (12) (a)","CCI-002147":"AC-2 (12) (a)","CCI-002148":"AC-2 (12) (b)","CCI-002149":"AC-2 (12) (b)","CCI-002150":"AC-2 (13)","CCI-002151":"AC-2 (13)","CCI-002152":"AC-3 (2)","CCI-002153":"AC-3 (3)","CCI-002154":"AC-3 (3) (a)","CCI-002155":"AC-3 (3) (b) (1)","CCI-002156":"AC-3 (3) (b) (2)","CCI-002157":"AC-3 (3) (b) (3)","CCI-002158":"AC-3 (3) (b) (4)","CCI-002159":"AC-3 (3) (b) (4)","CCI-002160":"AC-3 (3) (b) (5)","CCI-002161":"AC-3 (3) (c)","CCI-002162":"AC-3 (3) (c)","CCI-002163":"AC-3 (4)","CCI-002164":"AC-3 (4)","CCI-002165":"AC-3 (4)","CCI-002166":"AC-3 (7)","CCI-002167":"AC-3 (7)","CCI-002168":"AC-3 (7)","CCI-002169":"AC-3 (7)","CCI-002170":"AC-3 (7)","CCI-002171":"AC-3 (7)","CCI-002172":"AC-3 (7)","CCI-002173":"AC-3 (7)","CCI-002174":"AC-3 (7)","CCI-002175":"AC-3 (7)","CCI-002176":"AC-3 (7)","CCI-002177":"AC-3 (8)","CCI-002178":"AC-3 (8)","CCI-002179":"AC-3 (8)","CCI-002180":"AC-3 (9) (a)","CCI-002181":"AC-3 (9) (a)","CCI-002182":"AC-3 (9) (a)","CCI-002183":"AC-3 (9) (b)","CCI-002184":"AC-3 (9) (b)","CCI-002185":"AC-3 (10)","CCI-002186":"AC-3 (10)","CCI-002187":"AC-4 (1)","CCI-002188":"AC-4 (1)","CCI-002189":"AC-4 (1)","CCI-002190":"AC-4 (1)","CCI-002191":"AC-4 (2)","CCI-002192":"AC-4 (3)","CCI-002193":"AC-4 (4)","CCI-002194":"AC-4 (6)","CCI-002195":"AC-4 (8) (a)","CCI-002196":"AC-4 (9)","CCI-002197":"AC-4 (9)","CCI-002198":"AC-4 (9)","CCI-002199":"AC-4 (10)","CCI-002200":"AC-4 (12)","CCI-002201":"AC-4 (12)","CCI-002202":"AC-4 (13)","CCI-002203":"AC-4 (15)","CCI-002204":"AC-4 (15)","CCI-002205":"AC-4 (17)","CCI-002206":"AC-4 (17)","CCI-002207":"AC-4 (17)","CCI-002208":"AC-4 (17)","CCI-002209":"AC-4 (18)","CCI-002210":"AC-4 (18)","CCI-002211":"AC-4 (19)","CCI-002212":"AC-4 (20)","CCI-002213":"AC-4 (20)","CCI-002214":"AC-4 (20)","CCI-002215":"AC-4 (21)","CCI-002216":"AC-4 (21)","CCI-002217":"AC-4 (21)","CCI-002218":"AC-4 (22)","CCI-002219":"AC-5 a","CCI-002220":"AC-5 b","CCI-002221":"AC-6 (1) (b)","CCI-002222":"AC-6 (1) (a)","CCI-002223":"AC-6 (1) (b)","CCI-002224":"AC-6 (3)","CCI-002225":"AC-6 (4)","CCI-002226":"AC-6 (5)","CCI-002227":"AC-6 (5)","CCI-002228":"AC-6 (7) (a)","CCI-002229":"AC-6 (7) (a)","CCI-002230":"AC-6 (7) (a)","CCI-002231":"AC-6 (7) (b)","CCI-002232":"AC-6 (8)","CCI-002233":"AC-6 (8)","CCI-002234":"AC-6 (9)","CCI-002235":"AC-6 (10)","CCI-002236":"AC-7 b","CCI-002237":"AC-7 b","CCI-002238":"AC-7 b","CCI-002239":"AC-7 (2)","CCI-002240":"AC-7 (2)","CCI-002241":"AC-7 (2)","CCI-002242":"AC-7 (2)","CCI-002243":"AC-8 a 1","CCI-002244":"AC-8 a 2","CCI-002245":"AC-8 a 3","CCI-002246":"AC-8 a 4","CCI-002247":"AC-8 a","CCI-002248":"AC-8 c 1","CCI-002249":"AC-9 (4)","CCI-002250":"AC-9 (4)","CCI-002251":"AC-9 (4)","CCI-002252":"AC-10","CCI-002253":"AC-10","CCI-002254":"AC-12","CCI-002255":"AC-14 a","CCI-002256":"AC-16 a","CCI-002257":"AC-16 a","CCI-002258":"AC-16 a","CCI-002259":"AC-16 a","CCI-002260":"AC-16 a","CCI-002261":"AC-16 a","CCI-002262":"AC-16 a","CCI-002263":"AC-16 a","CCI-002264":"AC-16 a","CCI-002265":"AC-16 b","CCI-002266":"AC-16 b","CCI-002267":"AC-16 c","CCI-002268":"AC-16 c","CCI-002269":"AC-16 c","CCI-002270":"AC-16 d","CCI-002271":"AC-16 d","CCI-002272":"AC-16 (1)","CCI-002273":"AC-16 (1)","CCI-002274":"AC-16 (1)","CCI-002275":"AC-16 (1)","CCI-002276":"AC-16 (2)","CCI-002277":"AC-16 (2)","CCI-002278":"AC-16 (3)","CCI-002279":"AC-16 (3)","CCI-002280":"AC-16 (3)","CCI-002281":"AC-16 (3)","CCI-002282":"AC-16 (3)","CCI-002283":"AC-16 (3)","CCI-002284":"AC-16 (3)","CCI-002285":"AC-16 (4)","CCI-002286":"AC-16 (4)","CCI-002287":"AC-16 (4)","CCI-002288":"AC-16 (4)","CCI-002289":"AC-16 (4)","CCI-002290":"AC-16 (4)","CCI-002291":"AC-16 (6)","CCI-002292":"AC-16 (6)","CCI-002293":"AC-16 (6)","CCI-002294":"AC-16 (6)","CCI-002295":"AC-16 (6)","CCI-002296":"AC-16 (6)","CCI-002297":"AC-16 (6)","CCI-002298":"AC-16 (6)","CCI-002299":"AC-16 (7)","CCI-002300":"AC-16 (8)","CCI-002301":"AC-16 (8)","CCI-002302":"AC-16 (8)","CCI-002303":"AC-16 (9)","CCI-002304":"AC-16 (9)","CCI-002305":"AC-16 (10)","CCI-002306":"AC-16 (10)","CCI-002307":"AC-16 (10)","CCI-002308":"AC-16 (10)","CCI-002309":"AC-16 (10)","CCI-002310":"AC-17 a","CCI-002311":"AC-17 a","CCI-002312":"AC-17 a","CCI-002313":"AC-17 (1)","CCI-002314":"AC-17 (1)","CCI-002315":"AC-17 (3)","CCI-002316":"AC-17 (4) (a)","CCI-002317":"AC-17 (4) (a)","CCI-002318":"AC-17 (4) (a)","CCI-002319":"AC-17 (4) (b)","CCI-002320":"AC-17 (4) (b)","CCI-002321":"AC-17 (9)","CCI-002322":"AC-17 (9)","CCI-002323":"AC-18 a","CCI-002324":"AC-18 (4)","CCI-002325":"AC-19 a","CCI-002326":"AC-19 a","CCI-002327":"AC-19 (4) (c)","CCI-002328":"AC-19 (4) (c)","CCI-002329":"AC-19 (5)","CCI-002330":"AC-19 (5)","CCI-002331":"AC-19 (5)","CCI-002332":"AC-20 a 2","CCI-002333":"AC-20 (1) (a)","CCI-002334":"AC-20 (1) (a)","CCI-002335":"AC-20 (1) (a)","CCI-002336":"AC-20 (1) (a)","CCI-002337":"AC-20 (1) (b)","CCI-002338":"AC-20 (3)","CCI-002339":"AC-20 (4)","CCI-002340":"AC-20 (4)","CCI-002341":"AC-21 (2)","CCI-002342":"AC-21 (2)","CCI-002343":"AC-23","CCI-002344":"AC-23","CCI-002345":"AC-23","CCI-002346":"AC-23","CCI-002347":"AC-23","CCI-002348":"AC-24","CCI-002349":"AC-24","CCI-002350":"AC-24 (1)","CCI-002351":"AC-24 (1)","CCI-002352":"AC-24 (1)","CCI-002353":"AC-24 (1)","CCI-002354":"AC-24 (2)","CCI-002355":"AC-24 (2)","CCI-002356":"AC-25","CCI-002357":"AC-25","CCI-002358":"AC-25","CCI-002359":"AC-25","CCI-002360":"AC-12","CCI-002361":"AC-12","CCI-002362":"AC-12 (1)","CCI-002363":"AC-12 (1)","CCI-002364":"AC-12 (2)","CCI-002365":"IA-5 i","CCI-002366":"IA-5 i","CCI-002367":"IA-5 (7)","CCI-002368":"RA-1 a 1 (a)","CCI-002369":"RA-1 a 2","CCI-002370":"RA-3 e","CCI-002371":"RA-3 e","CCI-002372":"RA-5 (10)","CCI-002373":"RA-5 (3)","CCI-002374":"RA-5 (4)","CCI-002375":"RA-5 (4)","CCI-002376":"RA-5 e","CCI-002377":"SC-1 a 1","CCI-002378":"SC-1 a 1","CCI-002379":"SC-1 a 2","CCI-002380":"SC-1 a 2","CCI-002381":"SC-3 (3)","CCI-002382":"SC-3 (4)","CCI-002383":"SC-4 (2)","CCI-002384":"SC-4 (2)","CCI-002385":"SC-5 a","CCI-002386":"SC-5","CCI-002387":"SC-5 (1)","CCI-002388":"SC-5 (3) (a)","CCI-002389":"SC-5 (3) (a)","CCI-002390":"SC-5 (3) (b)","CCI-002391":"SC-5 (3) (b)","CCI-002392":"SC-6","CCI-002393":"SC-6","CCI-002394":"SC-6","CCI-002395":"SC-7 b","CCI-002396":"SC-7 (4) (c)","CCI-002397":"SC-7 (7)","CCI-002398":"SC-7 (9) (a)","CCI-002399":"SC-7 (9) (a)","CCI-002400":"SC-7 (9) (b)","CCI-002401":"SC-7 (11)","CCI-002402":"SC-7 (11)","CCI-002403":"SC-7 (11)","CCI-002404":"SC-7 (12)","CCI-002405":"SC-7 (12)","CCI-002406":"SC-7 (12)","CCI-002407":"SC-7 (14)","CCI-002408":"SC-7 (19)","CCI-002409":"SC-7 (19)","CCI-002410":"SC-7 (20)","CCI-002411":"SC-7 (20)","CCI-002412":"SC-7 (21)","CCI-002413":"SC-7 (21)","CCI-002414":"SC-7 (21)","CCI-002415":"SC-7 (21)","CCI-002416":"SC-7 (22)","CCI-002417":"SC-7 (23)","CCI-002418":"SC-8","CCI-002419":"SC-8 (1)","CCI-002420":"SC-8 (2)","CCI-002421":"SC-8 (1)","CCI-002422":"SC-8 (2)","CCI-002423":"SC-8 (3)","CCI-002424":"SC-8 (4)","CCI-002425":"SC-8 (4)","CCI-002426":"SC-11 (1) (a)","CCI-002427":"SC-8 (3)","CCI-002428":"SC-12","CCI-002429":"SC-12","CCI-002430":"SC-12","CCI-002431":"SC-12","CCI-002432":"SC-12","CCI-002433":"SC-12","CCI-002434":"SC-12","CCI-002435":"SC-12","CCI-002436":"SC-12","CCI-002437":"SC-12","CCI-002438":"SC-12","CCI-002439":"SC-12","CCI-002440":"SC-12","CCI-002441":"SC-12","CCI-002442":"SC-12","CCI-002443":"SC-12 (2)","CCI-002444":"SC-12 (2)","CCI-002445":"SC-12 (2)","CCI-002446":"SC-12 (3)","CCI-002447":"SC-12 (3)","CCI-002448":"SC-12 (3)","CCI-002449":"SC-13","CCI-002450":"SC-13 b","CCI-002451":"SC-15 (3)","CCI-002452":"SC-15 (4)","CCI-002453":"SC-15 (4)","CCI-002454":"SC-16","CCI-002455":"SC-16","CCI-002456":"SC-17 a","CCI-002457":"SC-18 (1)","CCI-002458":"SC-18 (1)","CCI-002459":"SC-18 (3)","CCI-002460":"SC-18 (4)","CCI-002461":"SC-18 (5)","CCI-002462":"SC-20 a","CCI-002463":"SC-20 (2)","CCI-002464":"SC-20 (2)","CCI-002465":"SC-21","CCI-002466":"SC-21","CCI-002467":"SC-21","CCI-002468":"SC-21","CCI-002469":"SC-23 (5)","CCI-002470":"SC-23 (5)","CCI-002471":"SC-25","CCI-002472":"SC-28","CCI-002473":"SC-28 (1)","CCI-002474":"SC-28 (1)","CCI-002475":"SC-28 (1)","CCI-002476":"SC-28 (1)","CCI-002477":"SC-28 (2)","CCI-002478":"SC-28 (2)","CCI-002479":"SC-28 (2)","CCI-002480":"SC-29","CCI-002481":"SC-29 (1)","CCI-002482":"SC-30","CCI-002483":"SC-30","CCI-002484":"SC-30","CCI-002485":"SC-30","CCI-002486":"SC-30 (2)","CCI-002487":"SC-30 (2)","CCI-002488":"SC-30 (2)","CCI-002489":"SC-30 (3)","CCI-002490":"SC-30 (3)","CCI-002491":"SC-30 (3)","CCI-002492":"SC-30 (3)","CCI-002493":"SC-30 (4)","CCI-002494":"SC-30 (4)","CCI-002495":"SC-30 (5)","CCI-002496":"SC-30 (5)","CCI-002497":"SC-30 (5)","CCI-002498":"SC-31 a","CCI-002499":"SC-31 b","CCI-002500":"SC-31 (2)","CCI-002501":"SC-31 (2)","CCI-002502":"SC-31 (3)","CCI-002503":"SC-31 (3)","CCI-002504":"SC-32","CCI-002505":"SC-32","CCI-002506":"SC-32","CCI-002507":"SC-34 (2)","CCI-002508":"SC-51 a","CCI-002509":"SC-51 a","CCI-002510":"SC-51 b","CCI-002511":"SC-51 b","CCI-002512":"SC-51 b","CCI-002513":"SC-36","CCI-002514":"SC-36","CCI-002515":"SC-36","CCI-002516":"SC-36","CCI-002517":"SC-36 (1) (a)","CCI-002518":"SC-36 (1) (a)","CCI-002519":"SC-36 (1) (a)","CCI-002520":"SC-36 (1) (a)","CCI-002521":"SC-37","CCI-002522":"SC-37","CCI-002523":"SC-37, SC-37 (1)","CCI-002524":"SC-37","CCI-002525":"SC-37 (1)","CCI-002526":"SC-37 (1)","CCI-002527":"SC-37 (1)","CCI-002528":"SC-38","CCI-002529":"SC-38","CCI-002530":"SC-39","CCI-002531":"SC-39 (1)","CCI-002532":"SC-39 (2)","CCI-002533":"SC-39 (2)","CCI-002534":"SC-40","CCI-002535":"SC-40","CCI-002536":"SC-40","CCI-002537":"SC-40 (1)","CCI-002538":"SC-40 (1)","CCI-002539":"SC-40 (2)","CCI-002540":"SC-40 (2)","CCI-002541":"SC-40 (3)","CCI-002542":"SC-40 (4)","CCI-002543":"SC-40 (4)","CCI-002544":"SC-41","CCI-002545":"SC-41","CCI-002546":"SC-41","CCI-002547":"SC-42 a","CCI-002548":"SC-42 a","CCI-002549":"SC-42 b","CCI-002550":"SC-42 b","CCI-002551":"SC-42 (1)","CCI-002552":"SC-42 (1)","CCI-002553":"SC-42 (2)","CCI-002554":"SC-42 (2)","CCI-002555":"SC-42 (2)","CCI-002556":"SC-42 a","CCI-002557":"SC-42 a","CCI-002558":"SC-42 (3)","CCI-002559":"SC-43 a","CCI-002560":"SC-43 a","CCI-002561":"SC-43 b","CCI-002562":"SC-43 b","CCI-002563":"SC-43 b","CCI-002564":"SC-44","CCI-002565":"SC-44","CCI-002566":"MP-1 a 1","CCI-002567":"MP-6 (1)","CCI-002568":"MP-6 (1)","CCI-002569":"MP-6 (1)","CCI-002570":"MP-6 (1)","CCI-002571":"MP-6 (1)","CCI-002572":"MP-6 (1)","CCI-002573":"MP-6 (7)","CCI-002574":"MP-6 (7)","CCI-002575":"MP-6 (8)","CCI-002576":"MP-6 (8)","CCI-002577":"MP-6 (8)","CCI-002578":"MP-6 a","CCI-002579":"MP-6 a","CCI-002580":"MP-6 b","CCI-002581":"MP-7 (a)","CCI-002582":"MP-7 (a)","CCI-002583":"MP-7 (a)","CCI-002584":"MP-7 (a)","CCI-002585":"MP-7 (b)","CCI-002586":"MP-7 (2)","CCI-002587":"MP-8 (1)","CCI-002588":"MP-8 (2)","CCI-002589":"MP-8 (2)","CCI-002590":"MP-8 (2)","CCI-002591":"MP-8 (2)","CCI-002592":"MP-8 (3)","CCI-002593":"MP-8 (3)","CCI-002594":"MP-8 (4)","CCI-002595":"MP-8 a","CCI-002596":"MP-8 a","CCI-002597":"MP-8 a","CCI-002598":"MP-8 b","CCI-002599":"MP-8 c","CCI-002600":"MP-8 d","CCI-002601":"SI-1 a","CCI-002602":"SI-2 b","CCI-002603":"SI-2 b","CCI-002604":"SI-2 c","CCI-002605":"SI-2 c","CCI-002606":"SI-2 c","CCI-002607":"SI-2 c","CCI-002608":"SI-2 (3) (b)","CCI-002609":"SI-2 (5)","CCI-002610":"SI-2 (5)","CCI-002611":"SI-2 (5)","CCI-002612":"SI-2 (5)","CCI-002613":"SI-2 (5)","CCI-002614":"SI-2 (5)","CCI-002615":"SI-2 (6)","CCI-002616":"SI-2 (6)","CCI-002617":"SI-2 (6)","CCI-002618":"SI-2 (6)","CCI-002619":"SI-3 a","CCI-002620":"SI-3 a","CCI-002621":"SI-3 a","CCI-002622":"SI-3 a","CCI-002623":"SI-3 c 1","CCI-002624":"SI-3 c 1","CCI-002625":"SI-3 (6) (b)","CCI-002626":"SI-3 (6) (b)","CCI-002627":"SI-3 (7)","CCI-002628":"SI-3 (8) (a)","CCI-002629":"SI-3 (8) (a)","CCI-002630":"SI-3 (8) (a)","CCI-002631":"SI-3 (8) (b)","CCI-002632":"SI-3 (9)","CCI-002633":"SI-3 (9)","CCI-002634":"SI-3 (10) (a)","CCI-002635":"SI-3 (10) (a)","CCI-002636":"SI-3 (10) (a)","CCI-002637":"SI-3 (9)","CCI-002638":"SI-3 (10) (a)","CCI-002639":"SI-3 (10) (b)","CCI-002640":"SI-3 (10) (b)","CCI-002641":"SI-4 a 1","CCI-002642":"SI-4 a 2","CCI-002643":"SI-4 a 2","CCI-002644":"SI-4 a 2","CCI-002645":"SI-4 b","CCI-002646":"SI-4 b","CCI-002647":"SI-4 d","CCI-002648":"SI-4 d","CCI-002649":"SI-4 d","CCI-002650":"SI-4 g","CCI-002651":"SI-4 g","CCI-002652":"SI-4 g","CCI-002653":"SI-4","CCI-002654":"SI-4 g","CCI-002655":"SI-4 (1)","CCI-002656":"SI-4 (1)","CCI-002657":"SI-4 (3)","CCI-002658":"SI-4 (3)","CCI-002659":"SI-4 (4) (b)","CCI-002660":"SI-4 (4) (b)","CCI-002661":"SI-4 (4) (b)","CCI-002662":"SI-4 (4) (b)","CCI-002663":"SI-4 (5)","CCI-002664":"SI-4 (5)","CCI-002665":"SI-4 (10)","CCI-002666":"SI-4 (10)","CCI-002667":"SI-4 (10)","CCI-002668":"SI-4 (11)","CCI-002669":"SI-4 (13) (c)","CCI-002670":"SI-4 (18)","CCI-002671":"SI-4 (18)","CCI-002672":"SI-4 (18)","CCI-002673":"SI-4 (19)","CCI-002674":"SI-4 (19)","CCI-002675":"SI-4 (19)","CCI-002676":"SI-4 (20)","CCI-002677":"SI-4 (20)","CCI-002678":"SI-4 (21)","CCI-002679":"SI-4 (21)","CCI-002680":"SI-4 (21)","CCI-002681":"SI-4 (22) (a)","CCI-002682":"SI-4 (22) (a)","CCI-002683":"SI-4 (22) (a)","CCI-002684":"SI-4 (22) (b)","CCI-002685":"SI-4 (23)","CCI-002686":"SI-4 (23)","CCI-002687":"SI-4 (23)","CCI-002688":"SI-4 (24)","CCI-002689":"SI-4 (24)","CCI-002690":"SI-4 (24)","CCI-002691":"SI-4 (24)","CCI-002692":"SI-5 a","CCI-002693":"SI-5 c","CCI-002694":"SI-5 c","CCI-002695":"SI-6 a","CCI-002696":"SI-6 a","CCI-002697":"SI-6 b","CCI-002698":"SI-6 b","CCI-002699":"SI-6 b","CCI-002700":"SI-6 c","CCI-002701":"SI-6 d","CCI-002702":"SI-6 d","CCI-002703":"SI-7","CCI-002704":"SI-7 a","CCI-002705":"SI-7 (1)","CCI-002706":"SI-7 (1)","CCI-002707":"SI-7 (1)","CCI-002708":"SI-7 (1)","CCI-002709":"SI-7 (1)","CCI-002710":"SI-7 (1)","CCI-002711":"SI-7 (1)","CCI-002712":"SI-7 (1)","CCI-002713":"SI-7 (2)","CCI-002714":"SI-7 (5)","CCI-002715":"SI-7 (5)","CCI-002716":"SI-7 (6)","CCI-002717":"SI-7 (6)","CCI-002718":"SI-7 (6)","CCI-002719":"SI-7 (7)","CCI-002720":"SI-7 (7)","CCI-002721":"SI-7 (8)","CCI-002722":"SI-7 (8)","CCI-002723":"SI-7 (8)","CCI-002724":"SI-7 (8)","CCI-002725":"SI-7 (9)","CCI-002726":"SI-7 (9)","CCI-002727":"SI-7 (10)","CCI-002728":"SI-7 (10)","CCI-002729":"SI-7 (10)","CCI-002730":"SI-7 (11)","CCI-002731":"SI-7 (11)","CCI-002732":"SI-7 (12)","CCI-002733":"SI-7 (12)","CCI-002734":"SI-7 (13)","CCI-002735":"SI-7 (13)","CCI-002736":"SI-7 (13)","CCI-002737":"SI-7 (14) (a)","CCI-002738":"SI-7 (14) (b)","CCI-002739":"SI-7 (15)","CCI-002740":"SI-7 (15)","CCI-002741":"SI-8 a","CCI-002742":"SI-8 a","CCI-002743":"SI-8 (3)","CCI-002744":"SI-10","CCI-002745":"SI-10 (1) (a)","CCI-002746":"SI-10 (1) (a)","CCI-002747":"SI-10 (1) (b)","CCI-002748":"SI-10 (1) (b)","CCI-002749":"SI-10 (1) (c)","CCI-002750":"SI-10 (2)","CCI-002751":"SI-10 (2)","CCI-002752":"SI-10 (2)","CCI-002753":"SI-10 (2)","CCI-002754":"SI-10 (3)","CCI-002755":"SI-10 (4)","CCI-002756":"SI-10 (5)","CCI-002757":"SI-10 (5)","CCI-002758":"SI-10 (5)","CCI-002759":"SI-11 b","CCI-002760":"SI-13 a","CCI-002761":"SI-13 a","CCI-002762":"SI-13 b","CCI-002763":"SI-13 b","CCI-002764":"SI-14","CCI-002765":"SI-14","CCI-002766":"SI-14","CCI-002767":"SI-14","CCI-002768":"SI-14 (1)","CCI-002769":"SI-14 (1)","CCI-002770":"SI-15","CCI-002771":"SI-15","CCI-002772":"SI-15","CCI-002773":"SI-17","CCI-002774":"SI-17","CCI-002775":"SI-17","CCI-002776":"IR-1 a 1 (a)","CCI-002777":"IR-1 a 2","CCI-002778":"IR-2 a 1","CCI-002779":"IR-2 a 2","CCI-002780":"IR-3 (2)","CCI-002781":"IR-4 (2)","CCI-002782":"IR-4 (6)","CCI-002783":"IR-4 (7)","CCI-002784":"IR-4 (7)","CCI-002785":"IR-4 (8)","CCI-002786":"IR-4 (8)","CCI-002787":"IR-4 (8)","CCI-002788":"IR-4 (9)","CCI-002789":"IR-4 (9)","CCI-002790":"IR-4 (10)","CCI-002791":"IR-6 b","CCI-002792":"IR-6 (2)","CCI-002793":"IR-6 (3)","CCI-002794":"IR-8 a","CCI-002795":"IR-8 a 1","CCI-002796":"IR-8 a 2","CCI-002797":"IR-8 a 3","CCI-002798":"IR-8 a 4","CCI-002799":"IR-8 a 5","CCI-002800":"IR-8 a 6","CCI-002801":"IR-8 a 7","CCI-002802":"IR-8 a 9","CCI-002803":"IR-8 d","CCI-002804":"IR-8 e","CCI-002805":"IR-9 b","CCI-002806":"IR-9 c","CCI-002807":"IR-9 c","CCI-002808":"IR-9 d","CCI-002809":"IR-9 e","CCI-002810":"IR-9 f","CCI-002811":"IR-9 g","CCI-002812":"IR-9 g","CCI-002813":"IR-9 (1)","CCI-002814":"IR-9 (1)","CCI-002815":"IR-9 (1)","CCI-002816":"IR-9 (2)","CCI-002817":"IR-9 (2)","CCI-002818":"IR-9 (3)","CCI-002819":"IR-9 (3)","CCI-002820":"IR-9 (4)","CCI-002821":"IR-9 (4)","CCI-002822":"IR-10","CCI-002823":"SI-16","CCI-002824":"SI-16","CCI-002825":"CP-1 a 1 (a)","CCI-002826":"CP-1 a 2","CCI-002827":"CP-2 (7)","CCI-002828":"CP-2 (8)","CCI-002829":"CP-2 (8)","CCI-002830":"CP-2 a 7","CCI-002831":"CP-2 f","CCI-002832":"CP-2 h","CCI-002833":"CP-3 a 1","CCI-002834":"CP-3 a 2","CCI-002835":"CP-4 (2) (b)","CCI-002836":"CP-6 b","CCI-002837":"CP-7 (6)","CCI-002838":"CP-7 (6)","CCI-002839":"CP-7 a","CCI-002840":"CP-8","CCI-002841":"CP-8","CCI-002842":"CP-8 (4) (b)","CCI-002843":"CP-8 (4) (c)","CCI-002844":"CP-8 (4) (c)","CCI-002845":"CP-8 (4) (c)","CCI-002846":"CP-8 (4) (c)","CCI-002847":"CP-8 (5)","CCI-002848":"CP-8 (5)","CCI-002849":"CP-9 (3)","CCI-002850":"CP-9 (3)","CCI-002851":"CP-9 (7)","CCI-002852":"CP-9 (7)","CCI-002853":"CP-11","CCI-002854":"CP-11","CCI-002855":"CP-12","CCI-002856":"CP-12","CCI-002857":"CP-12","CCI-002858":"CP-13","CCI-002859":"CP-13","CCI-002860":"CP-13","CCI-002861":"MA-1 a 1 (a)","CCI-002862":"MA-1 a 2","CCI-002863":"MA-2 (2) (a)","CCI-002864":"MA-2 (2) (b)","CCI-002865":"MA-2 (2) (b)","CCI-002866":"MA-2 a","CCI-002867":"MA-2 a","CCI-002868":"MA-2 a","CCI-002869":"MA-2 a","CCI-002870":"MA-2 a","CCI-002871":"MA-2 a","CCI-002872":"MA-2 a","CCI-002873":"MA-2 a","CCI-002874":"MA-2 c","CCI-002875":"MA-2 f","CCI-002876":"MA-2 f","CCI-002877":"MA-3 (3) (a)","CCI-002878":"MA-3 (3) (b)","CCI-002879":"MA-3 (3) (c)","CCI-002880":"MA-3 (3) (c)","CCI-002881":"MA-3 (3) (d)","CCI-002882":"MA-3 (3) (d)","CCI-002883":"MA-3 (4)","CCI-002884":"MA-4 (1) (a)","CCI-002885":"MA-4 (1) (a)","CCI-002886":"MA-4 (1) (b)","CCI-002887":"MA-4 (4) (a)","CCI-002888":"MA-4 (5) (a)","CCI-002889":"MA-4 (5) (b)","CCI-002890":"MA-4 (6)","CCI-002891":"MA-4 (7)","CCI-002892":"MA-5 (1) (b)","CCI-002893":"MA-5 (5)","CCI-002894":"MA-5 b","CCI-002895":"MA-5 c","CCI-002896":"MA-6","CCI-002897":"MA-6","CCI-002898":"MA-6 (1)","CCI-002899":"MA-6 (1)","CCI-002900":"MA-6 (1)","CCI-002901":"MA-6 (2)","CCI-002902":"MA-6 (2)","CCI-002903":"MA-6 (2)","CCI-002904":"MA-6 (3)","CCI-002905":"MA-2 (2) (a)","CCI-002906":"RA-5 (5)","CCI-002907":"AU-5 (4)","CCI-002908":"PE-1 a 1","CCI-002909":"PE-1 a 2","CCI-002910":"PE-2 a","CCI-002911":"PE-2 a","CCI-002912":"PE-2 (2)","CCI-002913":"PE-2 (3)","CCI-002914":"PE-2 (3)","CCI-002915":"PE-3 a","CCI-002916":"PE-3 a 2","CCI-002917":"PE-3 b","CCI-002918":"PE-3 b","CCI-002919":"PE-3 c","CCI-002920":"PE-3 c","CCI-002921":"PE-3 d","CCI-002922":"PE-3 d","CCI-002923":"PE-3 d","CCI-002924":"PE-3 d","CCI-002925":"PE-3 f","CCI-002926":"PE-3 (1)","CCI-002927":"PE-3 (2)","CCI-002928":"PE-3 (5)","CCI-002929":"PE-3 (5)","CCI-002930":"PE-4","CCI-002931":"PE-4","CCI-002932":"PE-5 (1) (a)","CCI-002933":"PE-5 (1) (a)","CCI-002934":"PE-5 (1) (b)","CCI-002935":"PE-5 (2) (a)","CCI-002936":"PE-5 (2) (b)","CCI-002937":"PE-5 (3)","CCI-002938":"PE-5 (3)","CCI-002939":"PE-6 a","CCI-002940":"PE-6 b","CCI-002941":"PE-6 b","CCI-002942":"PE-6 (2)","CCI-002943":"PE-6 (2)","CCI-002944":"PE-6 (2)","CCI-002945":"PE-6 (2)","CCI-002946":"PE-6 (3) (a)","CCI-002947":"PE-6 (3) (a)","CCI-002948":"PE-6 (3) (c)","CCI-002949":"PE-6 (3) (c)","CCI-002950":"PE-6 (4)","CCI-002951":"PE-6 (4)","CCI-002952":"PE-8 a","CCI-002953":"PE-9 (1)","CCI-002954":"PE-9 (1)","CCI-002955":"PE-11","CCI-002956":"PE-11 (2) (a)","CCI-002957":"PE-11 (2) (b)","CCI-002958":"PE-11 (2) (c)","CCI-002959":"PE-12 (1)","CCI-002960":"PE-12 (1)","CCI-002961":"PE-13 (1)","CCI-002962":"PE-13 (1)","CCI-002963":"PE-13 (1)","CCI-002964":"PE-13 (1)","CCI-002965":"PE-13 (2) (a)","CCI-002966":"PE-13 (2) (a)","CCI-002967":"PE-13 (2) (a)","CCI-002968":"PE-13 (4)","CCI-002969":"PE-13 (4)","CCI-002970":"PE-13 (4)","CCI-002971":"PE-13 (4)","CCI-002972":"PE-15 (1)","CCI-002973":"PE-15 (1)","CCI-002974":"PE-16 a","CCI-002975":"PE-17 b","CCI-002976":"PE-18","CCI-002977":"PE-18 (1)","CCI-002978":"PE-18 (1)","CCI-002979":"PE-20","CCI-002980":"PE-20","CCI-002981":"PE-20","CCI-002982":"PE-20","CCI-002983":"PE-20 b","CCI-002984":"PM-1 a 3","CCI-002985":"PM-1 a 1","CCI-002986":"PM-1 a 2","CCI-002987":"PM-1 a 3","CCI-002988":"PM-1 a 4","CCI-002989":"PM-1 c","CCI-002990":"PM-1 c","CCI-002991":"PM-4 a 1","CCI-002992":"PM-4 a 3","CCI-002993":"PM-4 b","CCI-002994":"PM-9 c","CCI-002995":"PM-9 c","CCI-002996":"PM-12","CCI-002997":"PM-13","CCI-002998":"PM-14 a 1","CCI-002999":"PM-14 a 1","CCI-003000":"PM-14 a 1","CCI-003001":"PM-14 a 1","CCI-003002":"PM-14 a 1","CCI-003003":"PM-14 a 1","CCI-003004":"PM-14 a 2","CCI-003005":"PM-14 a 2","CCI-003006":"PM-14 a 2","CCI-003007":"PM-14 b","CCI-003008":"PM-14 b","CCI-003009":"PM-14 b","CCI-003010":"PM-15 a","CCI-003011":"PM-15 b","CCI-003012":"PM-15 c","CCI-003013":"PM-16","CCI-003014":"AC-3 (3)","CCI-003015":"AC-3 (3) (c)","CCI-003016":"PS-4 f","CCI-003017":"PS-1 a 1","CCI-003018":"PS-1 a 2","CCI-003019":"PS-3 (3) (a)","CCI-003020":"PS-3 (3) (b)","CCI-003021":"PS-3 (3) (b)","CCI-003022":"PS-4 a","CCI-003023":"PS-4 b","CCI-003024":"PS-4 c","CCI-003025":"PS-4 f","CCI-003026":"PS-4 f","CCI-003027":"PS-4 (1) (a)","CCI-003028":"PS-4 (1) (b)","CCI-003029":"PS-4 (2)","CCI-003030":"PS-4 (2)","CCI-003031":"PS-5 c","CCI-003032":"PS-5 d","CCI-003033":"PS-5 d","CCI-003034":"PS-5 d","CCI-003035":"PS-6 a","CCI-003036":"PS-6 c 2","CCI-003037":"PS-6 c 2","CCI-003038":"PS-6 (3) (a)","CCI-003039":"PS-6 (3) (b)","CCI-003040":"PS-7 b","CCI-003041":"PS-7 d","CCI-003042":"PS-7 d","CCI-003043":"PS-7 d","CCI-003044":"PS-8 b","CCI-003045":"PS-8 b","CCI-003046":"PS-8 b","CCI-003047":"PL-1 a 1 (a)","CCI-003048":"PL-1 a 2","CCI-003049":"PL-2 a","CCI-003050":"PL-2 a 1","CCI-003051":"PL-2 a 2","CCI-003052":"PL-2 a 3","CCI-003053":"PL-2 a 6","CCI-003054":"PL-2 a 9","CCI-003055":"PL-2 a 10","CCI-003056":"PL-2 a 11","CCI-003057":"PL-2 a 12","CCI-003058":"PL-2 b","CCI-003059":"PL-2 b","CCI-003060":"PL-2 b","CCI-003061":"PL-2 b","CCI-003062":"PL-2 b","CCI-003063":"PL-2 e","CCI-003064":"PL-2 e","CCI-003065":"PL-2 (3)","CCI-003066":"PL-2 (3)","CCI-003067":"PL-2 (3)","CCI-003068":"PL-4 c","CCI-003069":"PL-4 c","CCI-003070":"PL-4 d","CCI-003071":"PL-7 a","CCI-003072":"PL-8 a","CCI-003073":"PL-8 a 1","CCI-003074":"PL-8 a 3","CCI-003075":"PL-8 a 4","CCI-003076":"PL-8 b","CCI-003077":"PL-8 b","CCI-003078":"PL-8 c","CCI-003079":"PL-8 c","CCI-003080":"PL-8 c","CCI-003081":"PL-8 (1) (a)","CCI-003082":"PL-8 (1) (a)","CCI-003083":"PL-8 (1) (a)","CCI-003084":"PL-8 (1) (a)","CCI-003085":"PL-8 (1) (a)","CCI-003086":"PL-8 (1) (a)","CCI-003087":"PL-8 (1) (b)","CCI-003088":"PL-8 (2)","CCI-003089":"SA-1 a 1 (a)","CCI-003090":"SA-1 a 2","CCI-003091":"SA-2 a","CCI-003092":"SA-3 a","CCI-003093":"SA-3 d","CCI-003094":"SA-4 a","CCI-003095":"SA-4 b","CCI-003096":"SA-4 c","CCI-003097":"SA-4 e","CCI-003098":"SA-4 f","CCI-003099":"SA-4 g","CCI-003100":"SA-4 i","CCI-003101":"SA-4 (2)","CCI-003102":"SA-4 (2)","CCI-003103":"SA-4 (2)","CCI-003104":"SA-4 (2)","CCI-003105":"SA-4 (2)","CCI-003106":"SA-4 (2)","CCI-003107":"SA-4 (3)","CCI-003108":"SA-4 (3)","CCI-003109":"SA-4 (5) (a)","CCI-003110":"SA-4 (5) (a)","CCI-003111":"SA-4 (5) (b)","CCI-003112":"SA-4 (8)","CCI-003113":"SA-4 (8)","CCI-003114":"SA-4 (9)","CCI-003115":"SA-4 (9)","CCI-003116":"SA-4 (10)","CCI-003117":"PL-9","CCI-003118":"PL-9","CCI-003119":"RA-6","CCI-003120":"RA-6","CCI-003121":"RA-6","CCI-003122":"RA-6","CCI-003123":"MA-4 (6)","CCI-003124":"SA-5 a 1","CCI-003125":"SA-5 a 1","CCI-003126":"SA-5 a 1","CCI-003127":"SA-5 a 2","CCI-003128":"SA-5 a 3","CCI-003129":"SA-5 b 1","CCI-003130":"SA-5 b 2","CCI-003131":"SA-5 b 3","CCI-003132":"SA-5 c","CCI-003133":"SA-5 c","CCI-003134":"SA-5 d","CCI-003135":"SA-5 d","CCI-003136":"SA-5 d","CCI-003137":"SA-9 a","CCI-003138":"SA-9 c","CCI-003139":"SA-9 c","CCI-003140":"SA-9 (1) (a)","CCI-003141":"SA-9 (1) (b)","CCI-003142":"SA-9 (1) (b)","CCI-003143":"SA-9 (2)","CCI-003144":"SA-9 (2)","CCI-003145":"SA-9 (3)","CCI-003146":"SA-9 (3)","CCI-003147":"SA-9 (3)","CCI-003148":"SA-9 (3)","CCI-003149":"SA-9 (4)","CCI-003150":"SA-9 (4)","CCI-003151":"SA-9 (4)","CCI-003152":"SA-9 (5)","CCI-003153":"SA-9 (5)","CCI-003154":"SA-9 (5)","CCI-003155":"SA-10 a","CCI-003156":"SA-10 b","CCI-003157":"SA-10 b","CCI-003158":"SA-10 b","CCI-003159":"SA-10 b","CCI-003160":"SA-10 d","CCI-003161":"SA-10 e","CCI-003162":"SA-10 e","CCI-003163":"SA-10 e","CCI-003164":"SA-10 e","CCI-003165":"SA-10 (3)","CCI-003166":"SA-10 (4)","CCI-003167":"SA-10 (4)","CCI-003168":"SA-10 (4)","CCI-003169":"SA-10 (5)","CCI-003170":"SA-10 (6)","CCI-003171":"SA-11 a","CCI-003172":"SA-11 a","CCI-003173":"SA-11 b","CCI-003174":"SA-11 b","CCI-003175":"SA-11 c","CCI-003176":"SA-11 c","CCI-003177":"SA-11 d","CCI-003178":"SA-11 e","CCI-003179":"SA-11 (1)","CCI-003180":"SA-11 (1)","CCI-003181":"SA-11 (2)","CCI-003182":"SA-11 (2)","CCI-003183":"SA-11 (3) (a)","CCI-003184":"SA-11 (3) (a)","CCI-003185":"SA-11 (3) (a)","CCI-003186":"SA-11 (3) (b)","CCI-003187":"SA-11 (4)","CCI-003188":"SA-11 (4)","CCI-003189":"SA-11 (4)","CCI-003190":"SA-11 (5)","CCI-003191":"SA-11 (5) (a)","CCI-003192":"SA-11 (5) (b)","CCI-003193":"SA-11 (6)","CCI-003194":"SA-11 (7)","CCI-003195":"SA-11 (7)","CCI-003196":"SA-11 (8)","CCI-003197":"SA-11 (8)","CCI-003198":"SA-12 (1)","CCI-003199":"SA-12 (1)","CCI-003200":"SA-12 (2)","CCI-003201":"SA-12 (5)","CCI-003202":"SA-12 (5)","CCI-003203":"SA-12 (7)","CCI-003204":"SA-12 (7)","CCI-003205":"SA-12 (8)","CCI-003206":"SA-12 (9)","CCI-003207":"SA-12 (1)","CCI-003208":"SA-12 (1)","CCI-003209":"SA-12 (1)","CCI-003210":"SA-12 (9)","CCI-003211":"SA-12 (9)","CCI-003212":"SA-12 (10)","CCI-003213":"SA-12 (10)","CCI-003214":"SA-12 (11)","CCI-003215":"SA-12 (11)","CCI-003216":"SA-12 (12)","CCI-003217":"SA-12 (12)","CCI-003218":"SA-12 (13)","CCI-003219":"SA-12 (13)","CCI-003220":"SA-12 (13)","CCI-003221":"SA-12 (14)","CCI-003222":"SA-12 (14)","CCI-003223":"SA-12 (14)","CCI-003224":"SA-12 (15)","CCI-003225":"SA-13 a","CCI-003226":"SA-13 a","CCI-003227":"SA-13 b","CCI-003228":"SA-13 b","CCI-003229":"SA-14","CCI-003230":"SA-14","CCI-003231":"SA-14","CCI-003232":"SA-14","CCI-003233":"SA-15 a","CCI-003234":"SA-15 a 1","CCI-003235":"SA-15 a 2","CCI-003236":"SA-15 a 2","CCI-003237":"SA-15 a 3","CCI-003238":"SA-15 a 4","CCI-003239":"SA-15 a 4","CCI-003240":"SA-15 a 4","CCI-003241":"SA-15 b","CCI-003242":"SA-15 b","CCI-003243":"SA-15 b","CCI-003244":"SA-15 b","CCI-003245":"SA-15 b","CCI-003246":"SA-15 b","CCI-003247":"SA-15 (1) (a)","CCI-003248":"SA-15 (1) (b)","CCI-003249":"SA-15 (1) (b)","CCI-003250":"SA-15 (1) (b)","CCI-003251":"SA-15 (2)","CCI-003252":"SA-15 (2)","CCI-003253":"SA-15 (3)","CCI-003254":"SA-15 (3) (b)","CCI-003255":"SA-15 (3) (a)","CCI-003256":"SA-15 (4)","CCI-003257":"SA-15 (4)","CCI-003258":"SA-15 (4)","CCI-003259":"SA-15 (4)","CCI-003260":"SA-15 (4) (a)","CCI-003261":"SA-15 (4) (a)","CCI-003262":"SA-15 (4) (a)","CCI-003263":"SA-15 (4) (a)","CCI-003264":"SA-15 (4) (b)","CCI-003265":"SA-15 (4) (b)","CCI-003266":"SA-15 (4) (b)","CCI-003267":"SA-15 (4) (b)","CCI-003268":"SA-15 (4) (c)","CCI-003269":"SA-15 (4) (c)","CCI-003270":"SA-15 (4) (c)","CCI-003271":"SA-15 (4) (c)","CCI-003272":"SA-15 (5)","CCI-003273":"SA-15 (5)","CCI-003274":"SA-15 (6)","CCI-003275":"SA-15 (7) (a)","CCI-003276":"SA-15 (7) (a)","CCI-003277":"SA-15 (7) (b)","CCI-003278":"SA-15 (7) (c)","CCI-003279":"SA-15 (7) (d)","CCI-003280":"SA-15 (7) (d)","CCI-003281":"SA-15 (8)","CCI-003282":"SA-15 (8)","CCI-003283":"SA-15 (9)","CCI-003284":"SA-15 (9)","CCI-003285":"SA-15 (9)","CCI-003286":"SA-15 (9)","CCI-003287":"SA-15 (9)","CCI-003288":"SA-15 (9)","CCI-003289":"SA-15 (10)","CCI-003290":"SA-15 (11)","CCI-003291":"SA-16","CCI-003292":"SA-16","CCI-003293":"SA-17","CCI-003294":"SA-17 a","CCI-003295":"SA-17 b","CCI-003296":"SA-17 b","CCI-003297":"SA-17 c","CCI-003298":"SA-17 (1) (a)","CCI-003299":"SA-17 (1) (a)","CCI-003300":"SA-17 (1) (b)","CCI-003301":"SA-17 (2) (a)","CCI-003302":"SA-17 (2) (a)","CCI-003303":"SA-17 (2) (a)","CCI-003304":"SA-17 (2) (a)","CCI-003305":"SA-17 (2) (b)","CCI-003306":"SA-17 (2) (b)","CCI-003307":"SA-17 (2) (b)","CCI-003308":"SA-17 (3) (a)","CCI-003309":"SA-17 (3) (a)","CCI-003310":"SA-17 (3) (a)","CCI-003311":"SA-17 (3) (b)","CCI-003312":"SA-17 (3) (c)","CCI-003313":"SA-17 (3) (c)","CCI-003314":"SA-17 (3) (c)","CCI-003315":"SA-17 (3) (d)","CCI-003316":"SA-17 (3) (d)","CCI-003317":"SA-17 (3) (d)","CCI-003318":"SA-17 (3) (e)","CCI-003319":"SA-17 (3) (e)","CCI-003320":"SA-17 (3) (e)","CCI-003321":"SA-17 (4) (a)","CCI-003322":"SA-17 (4) (a)","CCI-003323":"SA-17 (4) (a)","CCI-003324":"SA-17 (4) (b)","CCI-003325":"SA-17 (4) (c)","CCI-003326":"SA-17 (4) (c)","CCI-003327":"SA-17 (4) (c)","CCI-003328":"SA-17 (4) (d)","CCI-003329":"SA-17 (4) (d)","CCI-003330":"SA-17 (4) (d)","CCI-003331":"SA-17 (4) (e)","CCI-003332":"SA-17 (4) (e)","CCI-003333":"SA-17 (4) (e)","CCI-003334":"SA-17 (5) (a)","CCI-003335":"SA-17 (5) (a)","CCI-003336":"SA-17 (5) (a)","CCI-003337":"SA-17 (5) (b)","CCI-003338":"SA-17 (5) (b)","CCI-003339":"SA-17 (5) (b)","CCI-003340":"SA-17 (6)","CCI-003341":"SA-17 (6)","CCI-003342":"SA-17 (6)","CCI-003343":"SA-17 (7)","CCI-003344":"SA-17 (7)","CCI-003345":"SA-17 (7)","CCI-003346":"SA-18","CCI-003347":"SA-18 (1)","CCI-003348":"SA-18 (1)","CCI-003349":"SA-18 (1)","CCI-003350":"SA-18 (1)","CCI-003351":"SA-18 (1)","CCI-003352":"SA-18 (2)","CCI-003353":"SA-18 (2)","CCI-003354":"SA-18 (2)","CCI-003355":"SA-18 (2)","CCI-003356":"SA-19 a","CCI-003357":"SA-19 a","CCI-003358":"SA-19 a","CCI-003359":"SA-19 a","CCI-003360":"SA-19 a","CCI-003361":"SA-19 a","CCI-003362":"SA-19 a","CCI-003363":"SA-19 a","CCI-003364":"SA-19 b","CCI-003365":"SA-19 b","CCI-003366":"SA-19 b","CCI-003367":"SA-19 (1)","CCI-003368":"SA-19 (1)","CCI-003369":"SA-19 (2)","CCI-003370":"SA-19 (2)","CCI-003371":"SA-19 (2)","CCI-003372":"SA-22 b","CCI-003373":"SA-22 b","CCI-003374":"SA-22 b","CCI-003375":"SA-22 b","CCI-003376":"SA-22 a","CCI-003377":"SA-21 (1)","CCI-003378":"SA-21 (1)","CCI-003379":"SA-21 (1)","CCI-003380":"SA-21 (1)","CCI-003381":"SA-21 b","CCI-003382":"SA-21 b","CCI-003383":"SA-21 a","CCI-003384":"SA-21","CCI-003385":"SA-21 a","CCI-003386":"SA-20","CCI-003387":"SA-20","CCI-003388":"SA-19 (4)","CCI-003389":"SA-19 (4)","CCI-003390":"SA-19 (3)","CCI-003391":"SA-19 (3)","CCI-003392":"AP-1","CCI-003393":"AP-1","CCI-003394":"AP-1","CCI-003395":"AP-1","CCI-003396":"AP-2","CCI-003397":"AR-1 a","CCI-003398":"AP-2","CCI-003399":"AP-2","CCI-003400":"AP-2","CCI-003401":"AR-1 b","CCI-003402":"AR-1 c","CCI-003403":"AR-1 c","CCI-003404":"AR-1 c","CCI-003405":"AR-1 c","CCI-003406":"AR-1 d","CCI-003407":"AR-1 e","CCI-003408":"AR-1 e","CCI-003409":"AR-1 e","CCI-003410":"AR-1 e","CCI-003411":"AR-1 e","CCI-003412":"AR-1 e","CCI-003413":"AR-1 f","CCI-003414":"AR-1 f","CCI-003415":"AR-1 f","CCI-003416":"AR-1 f","CCI-003417":"AR-2 a","CCI-003418":"AR-2 a","CCI-003419":"AR-2 a","CCI-003420":"AR-2 a","CCI-003421":"AR-2 a","CCI-003422":"AR-2 a","CCI-003423":"AR-2 a","CCI-003424":"AR-2 a","CCI-003425":"AR-2 b","CCI-003426":"AR-3 a","CCI-003427":"AR-3 a","CCI-003428":"AR-3 a","CCI-003429":"AR-3 a","CCI-003430":"AR-3 a","CCI-003431":"AR-3 a","CCI-003432":"AR-3 b","CCI-003433":"AR-3 b","CCI-003434":"AR-4","CCI-003435":"AR-4","CCI-003436":"AR-4","CCI-003437":"AR-4","CCI-003438":"AR-4","CCI-003439":"AR-4","CCI-003440":"AR-5 a","CCI-003441":"AR-5 a","CCI-003442":"AR-5 a","CCI-003443":"AR-5 b","CCI-003444":"AR-5 b","CCI-003445":"AR-5 b","CCI-003446":"AR-5 b","CCI-003447":"AR-5 c","CCI-003448":"AR-5 c","CCI-003449":"AR-6","CCI-003450":"AR-6","CCI-003451":"AR-6","CCI-003452":"AR-6","CCI-003453":"AR-6","CCI-003454":"AR-6","CCI-003455":"AR-7","CCI-003456":"AR-8 a (1)","CCI-003457":"AR-8 a (1)","CCI-003458":"AR-8 a (1)","CCI-003459":"AR-8 a (1)","CCI-003460":"AR-8 a (2)","CCI-003461":"AR-8 b","CCI-003462":"AR-8 c","CCI-003463":"DI-1 a","CCI-003464":"DI-1 a","CCI-003465":"DI-1 a","CCI-003466":"DI-1 a","CCI-003467":"DI-1 b","CCI-003468":"DI-1 c","CCI-003469":"DI-1 c","CCI-003470":"DI-1 d","CCI-003471":"DI-1 d","CCI-003472":"DI-1 d","CCI-003473":"DI-1 d","CCI-003474":"DI-1 d","CCI-003475":"DI-1 d","CCI-003476":"DI-1 d","CCI-003477":"DI-1 d","CCI-003478":"DI-1 (1)","CCI-003479":"DI-1 (2)","CCI-003480":"DI-1 (2)","CCI-003481":"DI-2 a","CCI-003482":"DI-2 b","CCI-003483":"DI-2 b","CCI-003484":"DI-2 b","CCI-003485":"DI-2 (1)","CCI-003486":"DM-1 a","CCI-003487":"DM-1 b","CCI-003488":"DM-1 b","CCI-003489":"DM-1 c","CCI-003490":"DM-1 c","CCI-003491":"DM-1 c","CCI-003492":"DM-1 c","CCI-003493":"DM-1 c","CCI-003494":"DM-1 c","CCI-003495":"DM-1 (1)","CCI-003496":"DM-1 (1)","CCI-003497":"DM-2 a","CCI-003498":"DM-2 a","CCI-003499":"DM-2 b","CCI-003500":"DM-2 b","CCI-003501":"DM-2 c","CCI-003502":"DM-2 c","CCI-003503":"DM-2 (1)","CCI-003504":"DM-2 (1)","CCI-003505":"DM-2 (1)","CCI-003506":"DM-2 (1)","CCI-003507":"DM-3 a","CCI-003508":"DM-3 a","CCI-003509":"DM-3 a","CCI-003510":"DM-3 a","CCI-003511":"DM-3 a","CCI-003512":"DM-3 a","CCI-003513":"DM-3 b","CCI-003514":"DM-3 b","CCI-003515":"DM-3 b","CCI-003516":"DM-3 (1)","CCI-003517":"DM-3 (1)","CCI-003518":"DM-3 (1)","CCI-003519":"IP-1 a","CCI-003520":"IP-1 a","CCI-003521":"IP-1 a","CCI-003522":"IP-1 a","CCI-003523":"IP-1 b","CCI-003524":"IP-1 b","CCI-003525":"IP-1 b","CCI-003526":"IP-1 b","CCI-003527":"IP-1 c","CCI-003528":"IP-1 d","CCI-003529":"IP-1 d","CCI-003530":"IP-1 (1)","CCI-003531":"IP-2 a","CCI-003532":"IP-2 b","CCI-003533":"IP-2 b","CCI-003534":"IP-2 c","CCI-003535":"IP-2 d","CCI-003536":"IP-2 d","CCI-003537":"IP-3 a","CCI-003538":"IP-3 b","CCI-003539":"IP-3 b","CCI-003540":"IP-4","CCI-003541":"IP-4","CCI-003542":"IP-4 (1)","CCI-003543":"IP-4 (1)","CCI-003544":"SE-1 a","CCI-003545":"SE-1 a","CCI-003546":"SE-1 a","CCI-003547":"SE-1 a","CCI-003548":"SE-1 a","CCI-003549":"SE-1 a","CCI-003550":"SE-1 a","CCI-003551":"SE-1 b","CCI-003552":"SE-1 b","CCI-003553":"SE-2 a","CCI-003554":"SE-2 a","CCI-003555":"SE-2 b","CCI-003556":"TR-1 a","CCI-003557":"TR-1 a","CCI-003558":"TR-1 a","CCI-003559":"TR-1 a","CCI-003560":"TR-1 a","CCI-003561":"TR-1 a","CCI-003562":"TR-1 a","CCI-003563":"TR-1 a","CCI-003564":"TR-1 a","CCI-003565":"TR-1 a","CCI-003566":"TR-1 a","CCI-003567":"TR-1 a","CCI-003568":"TR-1 b","CCI-003569":"TR-1 b","CCI-003570":"TR-1 b","CCI-003571":"TR-1 b","CCI-003572":"TR-1 b","CCI-003573":"TR-1 b","CCI-003574":"TR-1 b","CCI-003575":"TR-1 b","CCI-003576":"TR-1 b","CCI-003577":"TR-1 b","CCI-003578":"TR-1 c","CCI-003579":"TR-1 c","CCI-003580":"TR-1 (1)","CCI-003581":"TR-2 a","CCI-003582":"TR-2 b","CCI-003583":"TR-2 c","CCI-003584":"TR-2 (1)","CCI-003585":"TR-3 a","CCI-003586":"TR-3 a","CCI-003587":"TR-3 b","CCI-003588":"UL-1","CCI-003589":"UL-2 a","CCI-003590":"UL-2 b","CCI-003591":"UL-2 b","CCI-003592":"UL-2 c","CCI-003593":"UL-2 c","CCI-003594":"UL-2 c","CCI-003595":"UL-2 c","CCI-003596":"UL-2 d","CCI-003597":"UL-2 d","CCI-003598":"TR-1 b","CCI-003599":"SC-37","CCI-003601":"AC-1 a 1 (b)","CCI-003602":"AC-1 a 1 (a)","CCI-003603":"AC-1 a 1 (b)","CCI-003604":"AC-1 a 2","CCI-003605":"AC-1 b","CCI-003606":"AC-1 b","CCI-003607":"AC-1 b","CCI-003608":"AC-1 c 1","CCI-003609":"AC-1 c 1","CCI-003610":"AC-1 c 2","CCI-003611":"AC-1 c 2","CCI-003612":"AC-2 a","CCI-003613":"AC-2 c","CCI-003614":"AC-2 c","CCI-003615":"AC-2 c","CCI-003616":"AC-2 d 3","CCI-003617":"AC-2 f","CCI-003618":"AC-2 f","CCI-003619":"AC-2 f","CCI-003620":"AC-2 f","CCI-003621":"AC-2 f","CCI-003622":"AC-2 f","CCI-003623":"AC-2 h","CCI-003624":"AC-2 h","CCI-003625":"AC-2 i 3","CCI-003626":"AC-2 l","CCI-003627":"AC-2 (3) (a)","CCI-003628":"AC-2 (3) (b)","CCI-003629":"AC-2 (3) (c)","CCI-003630":"AC-2 (7) (c)","CCI-003631":"AC-2 (8)","CCI-003632":"AC-2 (8)","CCI-003633":"AC-2 (8)","CCI-003634":"AC-2 (8)","CCI-003635":"AC-2 (8)","CCI-003636":"AC-2 (8)","CCI-003637":"AC-2 (13)","CCI-003638":"AC-3 (4) (a)","CCI-003639":"AC-3 (4) (b)","CCI-003640":"AC-3 (4) (c)","CCI-003641":"AC-3 (4) (d)","CCI-003642":"AC-3 (4) (e)","CCI-003643":"AC-3 (10)","CCI-003644":"AC-3 (11)","CCI-003645":"AC-3 (11)","CCI-003646":"AC-3 (12) (a)","CCI-003647":"AC-3 (12) (a)","CCI-003648":"AC-3 (12) (b)","CCI-003649":"AC-3 (12) (c)","CCI-003650":"AC-3 (13)","CCI-003651":"AC-3 (13)","CCI-003652":"AC-3 (13)","CCI-003653":"AC-3 (13)","CCI-003654":"AC-3 (14)","CCI-003655":"AC-3 (14)","CCI-003656":"AC-3 (14)","CCI-003657":"AC-3 (15) (a)","CCI-003658":"AC-3 (15) (a)","CCI-003659":"AC-3 (15) (b)","CCI-003660":"AC-3 (15) (b)","CCI-003661":"AC-4 (1)","CCI-003662":"AC-4 (4)","CCI-003663":"AC-4 (8) (a)","CCI-003664":"AC-4 (8) (b)","CCI-003665":"AC-4 (8) (b)","CCI-003666":"AC-4 (19)","CCI-003667":"AC-4 (23)","CCI-003668":"AC-4 (23)","CCI-003669":"AC-4 (24)","CCI-003670":"AC-4 (24)","CCI-003671":"AC-4 (25)","CCI-003672":"AC-4 (25)","CCI-003673":"AC-4 (26)","CCI-003674":"AC-4 (27)","CCI-003675":"AC-4 (28)","CCI-003676":"AC-4 (29) (a)","CCI-003677":"AC-4 (29) (b)","CCI-003678":"AC-4 (30)","CCI-003679":"AC-4 (31)","CCI-003680":"AC-4 (32) (a)","CCI-003681":"AC-4 (32) (b)","CCI-003682":"AC-4 (32) (c)","CCI-003683":"AC-4 (32) (d)","CCI-003684":"AC-5 a","CCI-003685":"AC-6 (1) (a)","CCI-003686":"AC-6 (1) (b)","CCI-003687":"AC-7 (3)","CCI-003688":"AC-7 (3)","CCI-003689":"AC-7 (4) (a)","CCI-003690":"AC-7 (4) (a)","CCI-003691":"AC-7 (4) (b)","CCI-003692":"AC-7 (4) (b)","CCI-003693":"AC-12 (3)","CCI-003694":"AC-12 (3)","CCI-003695":"AC-14 a","CCI-003696":"AC-16 a","CCI-003697":"AC-16 a","CCI-003698":"AC-16 a","CCI-003699":"AC-16 a","CCI-003700":"AC-16 a","CCI-003701":"AC-16 a","CCI-003702":"AC-16 b","CCI-003703":"AC-16 b","CCI-003704":"AC-16 c","CCI-003705":"AC-16 c","CCI-003706":"AC-16 d","CCI-003707":"AC-16 e","CCI-003708":"AC-16 f","CCI-003709":"AC-16 f","CCI-003710":"AC-16 f","CCI-003711":"AC-16 f","CCI-003712":"AC-16 (1)","CCI-003713":"AC-16 (1)","CCI-003714":"AC-16 (1)","CCI-003715":"AC-16 (2)","CCI-003716":"AC-16 (2)","CCI-003717":"AC-16 (3)","CCI-003718":"AC-16 (3)","CCI-003719":"AC-16 (3)","CCI-003720":"AC-16 (3)","CCI-003721":"AC-16 (3)","CCI-003722":"AC-16 (4)","CCI-003723":"AC-16 (4)","CCI-003724":"AC-16 (4)","CCI-003725":"AC-16 (4)","CCI-003726":"AC-16 (4)","CCI-003727":"AC-16 (5)","CCI-003728":"AC-16 (5)","CCI-003729":"AC-16 (5)","CCI-003730":"AC-16 (6)","CCI-003731":"AC-16 (6)","CCI-003732":"AC-16 (6)","CCI-003733":"AC-16 (6)","CCI-003734":"AC-16 (6)","CCI-003735":"AC-16 (6)","CCI-003736":"AC-16 (6)","CCI-003737":"AC-16 (6)","CCI-003738":"AC-16 (7)","CCI-003739":"AC-16 (8)","CCI-003740":"AC-16 (8)","CCI-003741":"AC-16 (8)","CCI-003742":"AC-16 (9)","CCI-003743":"AC-16 (10)","CCI-003744":"AC-16 (10)","CCI-003745":"AC-16 (10)","CCI-003746":"AC-16 (10)","CCI-003747":"AC-17 (10)","CCI-003748":"AC-17 (10)","CCI-003749":"AC-17 (10)","CCI-003750":"AC-20 a 1","CCI-003751":"AC-20 a 1","CCI-003752":"AC-20 a 2","CCI-003753":"AC-20 a 2","CCI-003754":"AC-20 b","CCI-003755":"AC-20 b","CCI-003756":"AC-20 (1) (a)","CCI-003757":"AC-20 (1) (a)","CCI-003758":"AC-20 (2)","CCI-003759":"AC-20 (5)","CCI-003760":"AC-24 (2)","CCI-003761":"AT-1 a 1 (b)","CCI-003762":"AT-1 b","CCI-003763":"AT-1 b","CCI-003764":"AT-1 b","CCI-003765":"AT-1 b","CCI-003766":"AT-2 a 2","CCI-003767":"AT-2 b","CCI-003768":"AT-2 b","CCI-003769":"AT-2 b","CCI-003770":"AT-2 c","CCI-003771":"AT-2 c","CCI-003772":"AT-2 c","CCI-003773":"AT-2 c","CCI-003774":"AT-2 d","CCI-003775":"AT-2 (3)","CCI-003776":"AT-2 (3)","CCI-003777":"AT-2 (4)","CCI-003778":"AT-2 (4)","CCI-003779":"AT-2 (5)","CCI-003780":"AT-2 (6) (a)","CCI-003781":"AT-2 (6) (b)","CCI-003782":"AT-3 a","CCI-003783":"AT-3 a 1","CCI-003784":"AT-3 a 2","CCI-003785":"AT-3 b","CCI-003786":"AT-3 b","CCI-003787":"AT-3 b","CCI-003788":"AT-3 b","CCI-003789":"AT-3 c","CCI-003790":"AT-3 (3)","CCI-003791":"AT-3 (5)","CCI-003792":"AT-3 (5)","CCI-003793":"AT-3 (5)","CCI-003794":"AT-4 a","CCI-003795":"AT-4 a","CCI-003796":"AT-6","CCI-003797":"AT-6","CCI-003798":"AT-6","CCI-003799":"AU-1 a 1 (b)","CCI-003800":"AU-1 b","CCI-003801":"AU-1 b","CCI-003802":"AU-1 b","CCI-003803":"AU-1 b","CCI-003804":"AU-1 b","CCI-003805":"AU-1 b","CCI-003806":"AU-1 c 1","CCI-003807":"AU-1 c 1","CCI-003808":"AU-1 c 2","CCI-003809":"AU-1 c 2","CCI-003810":"AU-2 e","CCI-003811":"AU-2 e","CCI-003812":"AU-3 (3)","CCI-003813":"AU-3 (3)","CCI-003814":"AU-5 a","CCI-003815":"AU-5 (5)","CCI-003816":"AU-5 (5)","CCI-003817":"AU-6 a","CCI-003818":"AU-6 c","CCI-003819":"AU-6 c","CCI-003820":"AU-6 (1)","CCI-003821":"AU-6 (4)","CCI-003822":"AU-7 a","CCI-003823":"AU-7 a","CCI-003824":"AU-7 a","CCI-003825":"AU-7 a","CCI-003826":"AU-7 a","CCI-003827":"AU-7 a","CCI-003828":"AU-7 b","CCI-003829":"AU-7 b","CCI-003830":"AU-7 (1)","CCI-003831":"AU-9 b","CCI-003832":"AU-9 b","CCI-003833":"AU-9 (7)","CCI-003834":"AU-12 (3)","CCI-003835":"AU-12 (4)","CCI-003836":"AU-12 (4)","CCI-003837":"AU-13 b 1","CCI-003838":"AU-13 b 1","CCI-003839":"AU-13 b 2","CCI-003840":"AU-13 b 2","CCI-003841":"AU-13 (1)","CCI-003842":"AU-13 (1)","CCI-003843":"AU-13 (3)","CCI-003844":"AU-14 a","CCI-003845":"AU-14 a","CCI-003846":"AU-14 a","CCI-003847":"AU-14 b","CCI-003848":"AU-14 (3)","CCI-003849":"CA-1 a 1 (b)","CCI-003850":"CA-1 a 2","CCI-003851":"CA-1 b","CCI-003852":"CA-1 b","CCI-003853":"CA-1 b","CCI-003854":"CA-1 b","CCI-003855":"CA-1 c 1","CCI-003856":"CA-1 c 1","CCI-003857":"CA-1 c 2","CCI-003858":"CA-1 c 2","CCI-003859":"CA-2 a","CCI-003860":"CA-2 c","CCI-003861":"CA-2 d","CCI-003862":"CA-3 a","CCI-003863":"CA-3 b","CCI-003864":"CA-3 (6)","CCI-003865":"CA-3 (7) (a)","CCI-003866":"CA-3 (7) (b)","CCI-003867":"CA-5 (1)","CCI-003868":"CA-6 b","CCI-003869":"CA-6 c 1","CCI-003870":"CA-6 d","CCI-003871":"CA-6 (1)","CCI-003872":"CA-6 (2)","CCI-003873":"CA-7","CCI-003874":"CA-7 a","CCI-003875":"CA-7 b","CCI-003876":"CA-7 b","CCI-003877":"CA-7 b","CCI-003878":"CA-7 c","CCI-003879":"CA-7 g","CCI-003880":"CA-7 g","CCI-003881":"CA-7 (4) (a)","CCI-003882":"CA-7 (4) (b)","CCI-003883":"CA-7 (4) (c)","CCI-003884":"CA-7 (5)","CCI-003885":"CA-7 (5)","CCI-003886":"CA-7 (5)","CCI-003887":"CA-7 (6)","CCI-003888":"CA-7 (6)","CCI-003889":"CA-8 (3)","CCI-003890":"CA-8 (3)","CCI-003891":"CA-9 (b)","CCI-003892":"CA-9 (c)","CCI-003893":"CA-9 (c)","CCI-003894":"CA-9 (d)","CCI-003895":"CA-9 (d)","CCI-003896":"CA-9 (1)","CCI-003897":"CM-1 a 1 (b)","CCI-003898":"CM-1 b","CCI-003899":"CM-1 b","CCI-003900":"CM-1 b","CCI-003901":"CM-1 b","CCI-003902":"CM-1 b","CCI-003903":"CM-1 b","CCI-003904":"CM-1 c 1","CCI-003905":"CM-1 c 1","CCI-003906":"CM-1 c 2","CCI-003907":"CM-1 c 2","CCI-003908":"CM-1 c 2","CCI-003909":"CM-2 a","CCI-003910":"CM-2 b 3","CCI-003911":"CM-2 (2)","CCI-003912":"CM-3 b","CCI-003913":"CM-3 (1) (a)","CCI-003914":"CM-3 (1) (b)","CCI-003915":"CM-3 (1) (c)","CCI-003916":"CM-3 (1) (d)","CCI-003917":"CM-3 (1) (e)","CCI-003918":"CM-3 (1) (f)","CCI-003919":"CM-3 (3)","CCI-003920":"CM-3 (3)","CCI-003921":"CM-3 (4)","CCI-003922":"CM-3 (4)","CCI-003923":"CM-3 (4)","CCI-003924":"CM-3 (4)","CCI-003925":"CM-3 (7)","CCI-003926":"CM-3 (7)","CCI-003927":"CM-3 (7)","CCI-003928":"CM-3 (8)","CCI-003929":"CM-3 (8)","CCI-003930":"CM-4","CCI-003931":"CM-4 (1)","CCI-003932":"CM-4 (2)","CCI-003933":"CM-4 (2)","CCI-003934":"CM-4 (2)","CCI-003935":"CM-5","CCI-003936":"CM-5","CCI-003937":"CM-5 (1) (a)","CCI-003938":"CM-5 (1) (b)","CCI-003939":"CM-5 (5) (b)","CCI-003940":"CM-5 (5) (b)","CCI-003941":"CM-6 a","CCI-003942":"CM-6 a","CCI-003943":"CM-6 d","CCI-003944":"CM-6 d","CCI-003945":"CM-6 d","CCI-003946":"CM-6 d","CCI-003947":"CM-6 (1)","CCI-003948":"CM-7 a","CCI-003949":"CM-7 (6)","CCI-003950":"CM-7 (6)","CCI-003951":"CM-7 (7) (a)","CCI-003952":"CM-7 (7) (a)","CCI-003953":"CM-7 (7) (b)","CCI-003954":"CM-7 (7) (b)","CCI-003955":"CM-7 (8) (a)","CCI-003956":"CM-7 (8) (b)","CCI-003957":"CM-7 (9) (a)","CCI-003958":"CM-7 (9) (a)","CCI-003959":"CM-7 (9) (b)","CCI-003960":"CM-7 (9) (c)","CCI-003961":"CM-7 (9) (c)","CCI-003962":"CM-8 a 1","CCI-003963":"CM-8 a 2","CCI-003964":"CM-8 a 3","CCI-003965":"CM-8 a 4","CCI-003966":"CM-8 a 4","CCI-003967":"CM-8 a 5","CCI-003968":"CM-8 (2)","CCI-003969":"CM-8 (3) (a)","CCI-003970":"CM-8 (8)","CCI-003971":"CM-9 a","CCI-003972":"CM-9 a","CCI-003973":"CM-9 b","CCI-003974":"CM-9 b","CCI-003975":"CM-9 c","CCI-003976":"CM-9 c","CCI-003977":"CM-9 d","CCI-003978":"CM-9 d","CCI-003979":"CM-9 d","CCI-003980":"CM-11 (2)","CCI-003981":"CM-11 (3)","CCI-003982":"CM-12 a","CCI-003983":"CM-12 a","CCI-003984":"CM-12 a","CCI-003985":"CM-12 b","CCI-003986":"CM-12 b","CCI-003987":"CM-12 c","CCI-003988":"CM-12 (1)","CCI-003989":"CM-12 (1)","CCI-003990":"CM-12 (1)","CCI-003991":"CM-13","CCI-003992":"CM-14","CCI-003993":"CM-14","CCI-003994":"CP-1 a 1 (b)","CCI-003995":"CP-1 a 1 (b)","CCI-003996":"CP-1 b","CCI-003997":"CP-1 b","CCI-003998":"CP-1 b","CCI-003999":"CP-1 b","CCI-004000":"CP-1 b","CCI-004001":"CP-1 b","CCI-004002":"CP-1 c 1","CCI-004003":"CP-1 c 1","CCI-004004":"CP-1 c 2","CCI-004005":"CP-1 c 2","CCI-004006":"CP-2 a 4","CCI-004007":"CP-2 a 4","CCI-004008":"CP-2 a 6","CCI-004009":"CP-2 g","CCI-004010":"CP-3 b","CCI-004011":"CP-3 b","CCI-004012":"CP-3 b","CCI-004013":"CP-3 b","CCI-004014":"CP-4 (3)","CCI-004015":"CP-4 (5)","CCI-004016":"CP-4 (5)","CCI-004017":"CP-4 (5)","CCI-004018":"CP-6 a","CCI-004019":"CP-8 (1) (b)","CCI-004020":"CP-9 (a)","CCI-004021":"CP-9 (c)","CCI-004022":"CP-9 (d)","CCI-004023":"CP-9 (d)","CCI-004024":"CP-9 (d)","CCI-004025":"CP-9 (8)","CCI-004026":"CP-9 (8)","CCI-004027":"CP-9 (8)","CCI-004028":"CP-10","CCI-004029":"CP-10","CCI-004030":"CP-10 (6)","CCI-004031":"IA-1 a 1","CCI-004032":"IA-1 a 1 (a)","CCI-004033":"IA-1 a 1 (b)","CCI-004034":"IA-1 a 2","CCI-004035":"IA-1 b","CCI-004036":"IA-1 b","CCI-004037":"IA-1 b","CCI-004038":"IA-1 b","CCI-004039":"IA-1 b","CCI-004040":"IA-1 b","CCI-004041":"IA-1 c 1","CCI-004042":"IA-1 c 1","CCI-004043":"IA-1 c 2","CCI-004044":"IA-1 c 2","CCI-004045":"IA-2 (5)","CCI-004046":"IA-2 (6) (a)","CCI-004047":"IA-2 (6) (b)","CCI-004048":"IA-2 (6) (b)","CCI-004049":"IA-4 (5)","CCI-004050":"IA-4 (8)","CCI-004051":"IA-4 (9)","CCI-004052":"IA-4 (9)","CCI-004053":"IA-5 d","CCI-004054":"IA-5 d","CCI-004055":"IA-5 e","CCI-004056":"IA-5 f","CCI-004057":"IA-5 (1) (a)","CCI-004058":"IA-5 (1) (a)","CCI-004059":"IA-5 (1) (a)","CCI-004060":"IA-5 (1) (a)","CCI-004061":"IA-5 (1) (b)","CCI-004062":"IA-5 (1) (d)","CCI-004063":"IA-5 (1) (e)","CCI-004064":"IA-5 (1) (f)","CCI-004065":"IA-5 (1) (g)","CCI-004066":"IA-5 (1) (h)","CCI-004067":"IA-5 (1) (h)","CCI-004068":"IA-5 (2) (b) (2)","CCI-004069":"IA-5 (7)","CCI-004070":"IA-5 (9)","CCI-004071":"IA-5 (9)","CCI-004072":"IA-5 (10)","CCI-004073":"IA-5 (15)","CCI-004074":"IA-5 (16)","CCI-004075":"IA-5 (16)","CCI-004076":"IA-5 (16)","CCI-004077":"IA-5 (16)","CCI-004078":"IA-5 (17)","CCI-004079":"IA-5 (18) (a)","CCI-004080":"IA-5 (18) (a)","CCI-004081":"IA-5 (18) (b)","CCI-004082":"IA-5 (18) (b)","CCI-004083":"IA-8 (2) (a)","CCI-004084":"IA-8 (2) (b)","CCI-004085":"IA-8 (4)","CCI-004086":"IA-8 (4)","CCI-004087":"IA-8 (5)","CCI-004088":"IA-8 (6)","CCI-004089":"IA-8 (6)","CCI-004090":"IA-8 (6)","CCI-004091":"IA-8 (6)","CCI-004092":"IA-12 a","CCI-004093":"IA-12 a","CCI-004094":"IA-12 b","CCI-004095":"IA-12 c","CCI-004096":"IA-12 c","CCI-004097":"IA-12 c","CCI-004098":"IA-12 (1)","CCI-004099":"IA-12 (2)","CCI-004100":"IA-12 (3)","CCI-004101":"IA-12 (3)","CCI-004102":"IA-12 (3)","CCI-004103":"IA-12 (3)","CCI-004104":"IA-12 (4)","CCI-004105":"IA-12 (4)","CCI-004106":"IA-12 (5)","CCI-004107":"IA-12 (6)","CCI-004108":"IA-12 (6)","CCI-004109":"IR-1 a 1 (b)","CCI-004110":"IR-1 b","CCI-004111":"IR-1 b","CCI-004112":"IR-1 b","CCI-004113":"IR-1 c 1","CCI-004114":"IR-1 c 1","CCI-004115":"IR-1 c 2","CCI-004116":"IR-1 c 2","CCI-004117":"IR-2 (2)","CCI-004118":"IR-2 (3)","CCI-004119":"IR-3 (1)","CCI-004120":"IR-3 (3) (a)","CCI-004121":"IR-3 (3) (a)","CCI-004122":"IR-3 (3) (b)","CCI-004123":"IR-3 (3) (b)","CCI-004124":"IR-3 (3) (c)","CCI-004125":"IR-3 (3) (c)","CCI-004126":"IR-3 (3) (c)","CCI-004127":"IR-3 (3) (c)","CCI-004128":"IR-3 (3) (c)","CCI-004129":"IR-3 (3) (c)","CCI-004130":"IR-4 c","CCI-004131":"IR-4 c","CCI-004132":"IR-4 c","CCI-004133":"IR-4 d","CCI-004134":"IR-4 d","CCI-004135":"IR-4 d","CCI-004136":"IR-4 d","CCI-004137":"IR-4 (1)","CCI-004138":"IR-4 (2)","CCI-004139":"IR-4 (3)","CCI-004140":"IR-4 (3)","CCI-004141":"IR-4 (7)","CCI-004142":"IR-4 (7)","CCI-004143":"IR-4 (11)","CCI-004144":"IR-4 (11)","CCI-004145":"IR-4 (12)","CCI-004146":"IR-4 (13)","CCI-004147":"IR-4 (13)","CCI-004148":"IR-4 (14)","CCI-004149":"IR-4 (15) (a)","CCI-004150":"IR-4 (15) (b)","CCI-004151":"IR-5 (1)","CCI-004152":"IR-5 (1)","CCI-004153":"IR-5 (1)","CCI-004154":"IR-5 (1)","CCI-004155":"IR-6 (1)","CCI-004156":"IR-6 (3)","CCI-004157":"IR-8 a 8","CCI-004158":"IR-8 a 9","CCI-004159":"IR-8 a 10","CCI-004160":"IR-8 (1) (a)","CCI-004161":"IR-8 (1) (b)","CCI-004162":"IR-8 (1) (c)","CCI-004163":"IR-9 a","CCI-004164":"IR-9 a","CCI-004165":"MA-1 a 1 (b)","CCI-004166":"MA-1 b","CCI-004167":"MA-1 b","CCI-004168":"MA-1 b","CCI-004169":"MA-1 b","CCI-004170":"MA-1 c 1","CCI-004171":"MA-1 c 1","CCI-004172":"MA-1 c 2","CCI-004173":"MA-1 c 2","CCI-004174":"MA-2 a","CCI-004175":"MA-2 a","CCI-004176":"MA-2 a","CCI-004177":"MA-2 b","CCI-004178":"MA-2 b","CCI-004179":"MA-2 b","CCI-004180":"MA-2 b","CCI-004181":"MA-2 d","CCI-004182":"MA-2 (2) (a)","CCI-004183":"MA-2 (2) (a)","CCI-004184":"MA-2 (2) (a)","CCI-004185":"MA-2 (2) (b)","CCI-004186":"MA-3 b","CCI-004187":"MA-3 b","CCI-004188":"MA-3 (5)","CCI-004189":"MA-3 (6)","CCI-004190":"MA-4 e","CCI-004191":"MA-4 e","CCI-004192":"MA-4 (4) (b) (2)","CCI-004193":"MA-4 (6)","CCI-004194":"MA-5 (1) (b)","CCI-004195":"MA-5 (1) (b)","CCI-004196":"MA-5 (1) (b)","CCI-004197":"MA-6 (3)","CCI-004198":"MA-7","CCI-004199":"MA-7","CCI-004200":"MA-7","CCI-004201":"MP-1 a 1 (b)","CCI-004202":"MP-1 b","CCI-004203":"MP-1 b","CCI-004204":"MP-1 b","CCI-004205":"MP-1 b","CCI-004206":"MP-1 b","CCI-004207":"MP-1 c 1","CCI-004208":"MP-1 c 1","CCI-004209":"MP-1 c 2","CCI-004210":"MP-1 c 2","CCI-004211":"MP-4 a","CCI-004212":"MP-4 a","CCI-004213":"MP-4 b","CCI-004214":"MP-4 b","CCI-004215":"MP-4 b","CCI-004216":"MP-4 (2)","CCI-004217":"MP-5 a","CCI-004218":"MP-5 a","CCI-004219":"MP-6 (2)","CCI-004220":"MP-6 (2)","CCI-004221":"MP-8 a","CCI-004222":"MP-8 a","CCI-004223":"MP-8 b","CCI-004224":"MP-8 b","CCI-004225":"MP-8 c","CCI-004226":"MP-8 c","CCI-004227":"MP-8 (2)","CCI-004228":"MP-8 (2)","CCI-004229":"PE-1 a 1 (b)","CCI-004230":"PE-1 b","CCI-004231":"PE-1 b","CCI-004232":"PE-1 b","CCI-004233":"PE-1 b","CCI-004234":"PE-1 b","CCI-004235":"PE-1 b","CCI-004236":"PE-1 c 1","CCI-004237":"PE-1 c 1","CCI-004238":"PE-1 c 2","CCI-004239":"PE-1 c 2","CCI-004240":"PE-3 a","CCI-004241":"PE-3 a","CCI-004242":"PE-3 a 2","CCI-004243":"PE-3 a 2","CCI-004244":"PE-3 (7)","CCI-004245":"PE-3 (8)","CCI-004246":"PE-3 (8)","CCI-004247":"PE-5 (2)","CCI-004248":"PE-6 (2)","CCI-004249":"PE-6 (3) (b)","CCI-004250":"PE-6 (3) (b)","CCI-004251":"PE-8 c","CCI-004252":"PE-8 c","CCI-004253":"PE-8 (1)","CCI-004254":"PE-8 (3)","CCI-004255":"PE-8 (3)","CCI-004256":"PE-10 a","CCI-004257":"PE-14 (1)","CCI-004258":"PE-14 (2)","CCI-004259":"PE-15 (1)","CCI-004260":"PE-15 (1)","CCI-004261":"PE-15 (1)","CCI-004262":"PE-17 a","CCI-004263":"PE-17 d","CCI-004264":"PE-19 (1)","CCI-004265":"PE-19 (1)","CCI-004266":"PE-21","CCI-004267":"PE-21","CCI-004268":"PE-21","CCI-004269":"PE-22","CCI-004270":"PE-22","CCI-004271":"PE-23 a","CCI-004272":"PE-23 b","CCI-004273":"PL-1 a 1 (b)","CCI-004274":"PL-1 b","CCI-004275":"PL-1 b","CCI-004276":"PL-1 c 1","CCI-004277":"PL-1 c 2","CCI-004278":"PL-2 a 4","CCI-004279":"PL-2 a 5","CCI-004280":"PL-2 a 7","CCI-004281":"PL-2 a 8","CCI-004282":"PL-2 a 13","CCI-004283":"PL-2 a 14","CCI-004284":"PL-4 a","CCI-004285":"PL-4 a","CCI-004286":"PL-4 a","CCI-004287":"PL-4 a","CCI-004288":"PL-4 a","CCI-004289":"PL-4 d","CCI-004290":"PL-4 (1) (c)","CCI-004291":"PL-7 a","CCI-004292":"PL-8 a","CCI-004293":"PL-8 a 1","CCI-004294":"PL-8 a 2","CCI-004295":"PL-8 a 2","CCI-004296":"PL-8 a 3","CCI-004297":"PL-8 a 4","CCI-004298":"PL-8 c","CCI-004299":"PL-8 c","CCI-004300":"PL-8 c","CCI-004301":"PL-8 (1) (a)","CCI-004302":"PL-8 (1) (a)","CCI-004303":"PL-8 (1) (a)","CCI-004304":"PL-8 (1) (a)","CCI-004305":"PL-8 (1) (a)","CCI-004306":"PL-8 (1) (a)","CCI-004307":"PL-8 (1) (b)","CCI-004308":"PL-8 (2)","CCI-004309":"PL-8 (2)","CCI-004310":"PL-10","CCI-004311":"PL-11","CCI-004312":"PM-1 b","CCI-004313":"PM-1 b","CCI-004314":"PM-3 a","CCI-004315":"PM-3 a","CCI-004316":"PM-3 b","CCI-004317":"PM-3 b","CCI-004318":"PM-3 c","CCI-004319":"PM-4 a 1","CCI-004320":"PM-4 a 1","CCI-004321":"PM-4 a 1","CCI-004322":"PM-4 a 1","CCI-004323":"PM-4 a 2","CCI-004324":"PM-4 a 2","CCI-004325":"PM-4 a 3","CCI-004326":"PM-4 a 3","CCI-004327":"PM-4 a 3","CCI-004328":"PM-5","CCI-004329":"PM-5","CCI-004330":"PM-5","CCI-004331":"PM-5 (1)","CCI-004332":"PM-5 (1)","CCI-004333":"PM-5 (1)","CCI-004334":"PM-5 (1)","CCI-004335":"PM-6","CCI-004336":"PM-6","CCI-004337":"PM-6","CCI-004338":"PM-7","CCI-004339":"PM-7","CCI-004340":"PM-7","CCI-004341":"PM-7 (1)","CCI-004342":"PM-7 (1)","CCI-004343":"PM-8","CCI-004344":"PM-8","CCI-004345":"PM-9 a 2","CCI-004346":"PM-10 a","CCI-004347":"PM-10 a","CCI-004348":"PM-11 a","CCI-004349":"PM-11 b","CCI-004350":"PM-11 c","CCI-004351":"PM-11 c","CCI-004352":"PM-13","CCI-004353":"PM-14 a 1","CCI-004354":"PM-14 a 1","CCI-004355":"PM-14 a 1","CCI-004356":"PM-14 a 1","CCI-004357":"PM-14 a 1","CCI-004358":"PM-14 a 1","CCI-004359":"PM-14 a 2","CCI-004360":"PM-14 a 2","CCI-004361":"PM-14 a 2","CCI-004362":"PM-15 a","CCI-004363":"PM-15 b","CCI-004364":"PM-15 c","CCI-004365":"PM-16 (1)","CCI-004366":"PM-17 a","CCI-004367":"PM-17 a","CCI-004368":"PM-17 b","CCI-004369":"PM-17 b","CCI-004370":"PM-17 b","CCI-004371":"PM-17 b","CCI-004372":"PM-18 a","CCI-004373":"PM-18 a","CCI-004374":"PM-18 a 1","CCI-004375":"PM-18 a 1","CCI-004376":"PM-18 a 2","CCI-004377":"PM-18 a 2","CCI-004378":"PM-18 a 2","CCI-004379":"PM-18 a 2","CCI-004380":"PM-18 a 3","CCI-004381":"PM-18 a 3","CCI-004382":"PM-18 a 4","CCI-004383":"PM-18 a 4","CCI-004384":"PM-18 a 5","CCI-004385":"PM-18 a 5","CCI-004386":"PM-18 a 6","CCI-004387":"PM-18 a 6","CCI-004388":"PM-18 a 6","CCI-004389":"PM-18 b","CCI-004390":"PM-19","CCI-004391":"PM-19","CCI-004392":"PM-19","CCI-004393":"PM-19","CCI-004394":"PM-20","CCI-004395":"PM-20 a","CCI-004396":"PM-20 a","CCI-004397":"PM-20 b","CCI-004398":"PM-20 c","CCI-004399":"PM-20 (1) (a)","CCI-004400":"PM-20 (1) (a)","CCI-004401":"PM-20 (1) (b)","CCI-004402":"PM-20 (1) (c)","CCI-004403":"PM-20 (1) (c)","CCI-004404":"PM-21 a","CCI-004405":"PM-21 a","CCI-004406":"PM-21 a 1","CCI-004407":"PM-21 a 1","CCI-004408":"PM-21 a 2","CCI-004409":"PM-21 a 2","CCI-004410":"PM-21 b","CCI-004411":"PM-21 c","CCI-004412":"PM-22 a","CCI-004413":"PM-22 a","CCI-004414":"PM-22 b","CCI-004415":"PM-22 b","CCI-004416":"PM-22 c","CCI-004417":"PM-22 c","CCI-004418":"PM-22 d","CCI-004419":"PM-22 d","CCI-004420":"PM-23","CCI-004421":"PM-23","CCI-004422":"PM-23","CCI-004423":"PM-24 a","CCI-004424":"PM-24 b","CCI-004425":"PM-25 a","CCI-004426":"PM-25 a","CCI-004427":"PM-25 a","CCI-004428":"PM-25 a","CCI-004429":"PM-25 b","CCI-004430":"PM-25 c","CCI-004431":"PM-25 d","CCI-004432":"PM-25 d","CCI-004433":"PM-25 d","CCI-004434":"PM-25 d","CCI-004435":"PM-26","CCI-004436":"PM-26","CCI-004437":"PM-26 a","CCI-004438":"PM-26 a","CCI-004439":"PM-26 b","CCI-004440":"PM-26 c","CCI-004441":"PM-26 c","CCI-004442":"PM-26 d","CCI-004443":"PM-26 d","CCI-004444":"PM-26 e","CCI-004445":"PM-26 e","CCI-004446":"PM-27","CCI-004447":"PM-27","CCI-004448":"PM-27 a 1","CCI-004449":"PM-27 a 2","CCI-004450":"PM-27 a 2","CCI-004451":"PM-27 a 2","CCI-004452":"PM-27 b","CCI-004453":"PM-27 b","CCI-004454":"PM-28 a 1","CCI-004455":"PM-28 a 2","CCI-004456":"PM-28 a 3","CCI-004457":"PM-28 a 4","CCI-004458":"PM-28 b","CCI-004459":"PM-28 b","CCI-004460":"PM-28 c","CCI-004461":"PM-28 c","CCI-004462":"PM-29 a","CCI-004463":"PM-29 a","CCI-004464":"PM-29 b","CCI-004465":"PM-29 b","CCI-004466":"PM-30 a","CCI-004467":"PM-30 a","CCI-004468":"PM-30 a","CCI-004469":"PM-30 a","CCI-004470":"PM-30 b","CCI-004471":"PM-30 c","CCI-004472":"PM-30 c","CCI-004473":"PM-31 a","CCI-004474":"PM-31 a","CCI-004475":"PM-31 a","CCI-004476":"PM-31 b","CCI-004477":"PM-31 b","CCI-004478":"PM-31 b","CCI-004479":"PM-31 b","CCI-004480":"PM-31 b","CCI-004481":"PM-31 b","CCI-004482":"PM-31 c","CCI-004483":"PM-31 c","CCI-004484":"PM-31 d","CCI-004485":"PM-31 d","CCI-004486":"PM-31 e","CCI-004487":"PM-31 e","CCI-004488":"PM-31 f","CCI-004489":"PM-31 f","CCI-004490":"PM-31 f","CCI-004491":"PM-31 f","CCI-004492":"PM-31 f","CCI-004493":"PM-31 f","CCI-004494":"PM-31 f","CCI-004495":"PM-31 f","CCI-004496":"PM-32","CCI-004497":"PM-32","CCI-004498":"PS-1 a 1 (b)","CCI-004499":"PS-1 b","CCI-004500":"PS-1 b","CCI-004501":"PS-1 b","CCI-004502":"PS-1 b","CCI-004503":"PS-1 b","CCI-004504":"PS-1 b","CCI-004505":"PS-1 c 1","CCI-004506":"PS-1 c 1","CCI-004507":"PS-1 c 2","CCI-004508":"PS-1 c 2","CCI-004509":"PS-3 (4)","CCI-004510":"PS-3 (4)","CCI-004511":"PS-3 (4)","CCI-004512":"PS-4 (2)","CCI-004513":"PS-6 c 1","CCI-004514":"PS-6 c 1","CCI-004515":"PS-6 c 2","CCI-004516":"PS-6 c 2","CCI-004517":"PS-6 c 2","CCI-004518":"PS-6 c 2","CCI-004519":"PS-7 b","CCI-004520":"PS-7 b","CCI-004521":"PS-8 a","CCI-004522":"PS-8 a","CCI-004523":"PS-9","CCI-004524":"PS-9","CCI-004525":"PT-1 a 1 (a)","CCI-004526":"PT-1 a","CCI-004527":"PT-1 a","CCI-004528":"PT-1 a 1 (b)","CCI-004529":"PT-1 a 2","CCI-004530":"PT-1 b","CCI-004531":"PT-1 b","CCI-004532":"PT-1 b","CCI-004533":"PT-1 c 1","CCI-004534":"PT-1 c 1","CCI-004535":"PT-1 c 1","CCI-004536":"PT-1 c 2","CCI-004537":"PT-1 c 2","CCI-004538":"PT-1 c 2","CCI-004539":"PT-2 a","CCI-004540":"PT-2 a","CCI-004541":"PT-2 a","CCI-004542":"PT-2 b","CCI-004543":"PT-2 b","CCI-004544":"PT-2 (1)","CCI-004545":"PT-2 (1)","CCI-004546":"PT-2 (1)","CCI-004547":"PT-2 (2)","CCI-004548":"PT-2 (2)","CCI-004549":"PT-3 a","CCI-004550":"PT-3 a","CCI-004551":"PT-3 b","CCI-004552":"PT-3 c","CCI-004553":"PT-3 c","CCI-004554":"PT-3 d","CCI-004555":"PT-3 d","CCI-004556":"PT-3 d","CCI-004557":"PT-3 d","CCI-004558":"PT-3 (1)","CCI-004559":"PT-3 (1)","CCI-004560":"PT-3 (2)","CCI-004561":"PT-4","CCI-004562":"PT-4","CCI-004563":"PT-4 (1)","CCI-004564":"PT-4 (1)","CCI-004565":"PT-4 (2)","CCI-004566":"PT-4 (2)","CCI-004567":"PT-4 (2)","CCI-004568":"PT-4 (2)","CCI-004569":"PT-4 (3)","CCI-004570":"PT-4 (3)","CCI-004571":"PT-5 a","CCI-004572":"PT-5 a","CCI-004573":"PT-5 b","CCI-004574":"PT-5 c","CCI-004575":"PT-5 d","CCI-004576":"PT-5 e","CCI-004577":"PT-5 e","CCI-004578":"PT-5 (1)","CCI-004579":"PT-5 (1)","CCI-004580":"PT-5 (2)","CCI-004581":"PT-6 a","CCI-004582":"PT-6 a","CCI-004583":"PT-6 b","CCI-004584":"PT-6 c","CCI-004585":"PT-6 (1)","CCI-004586":"PT-6 (1)","CCI-004587":"PT-6 (1)","CCI-004588":"PT-6 (2)","CCI-004589":"PT-6 (2)","CCI-004590":"PT-6 (2)","CCI-004591":"PT-6 (2)","CCI-004592":"PT-7","CCI-004593":"PT-7","CCI-004594":"PT-7 (1) (a)","CCI-004595":"PT-7 (1) (b)","CCI-004596":"PT-7 (1) (c)","CCI-004597":"PT-7 (2)","CCI-004598":"PT-8 a","CCI-004599":"PT-8 b","CCI-004600":"PT-8 c","CCI-004601":"PT-8 d","CCI-004602":"PT-8 e","CCI-004603":"RA-1 a 1 (b)","CCI-004604":"RA-1 a 1 (b)","CCI-004605":"RA-1 b","CCI-004606":"RA-1 b","CCI-004607":"RA-1 b","CCI-004608":"RA-1 b","CCI-004609":"RA-1 b","CCI-004610":"RA-1 c 1","CCI-004611":"RA-1 c 1","CCI-004612":"RA-1 c 2","CCI-004613":"RA-1 c 2","CCI-004614":"RA-2 a","CCI-004615":"RA-2 a","CCI-004616":"RA-2 a","CCI-004617":"RA-2 (1)","CCI-004618":"RA-3 a 1","CCI-004619":"RA-3 a 1","CCI-004620":"RA-3 a 3","CCI-004621":"RA-3 b","CCI-004622":"RA-3 b","CCI-004623":"RA-3 b","CCI-004624":"RA-3 (1) (a)","CCI-004625":"RA-3 (1) (a)","CCI-004626":"RA-3 (1) (b)","CCI-004627":"RA-3 (1) (b)","CCI-004628":"RA-3 (2)","CCI-004629":"RA-3 (3)","CCI-004630":"RA-3 (3)","CCI-004631":"RA-3 (4)","CCI-004632":"RA-3 (4)","CCI-004633":"RA-3 (4)","CCI-004634":"RA-5 b 2","CCI-004635":"RA-5 b 3","CCI-004636":"RA-5 f","CCI-004637":"RA-5 (6)","CCI-004638":"RA-5 (8)","CCI-004639":"RA-5 (8)","CCI-004640":"RA-5 (11)","CCI-004641":"RA-7","CCI-004642":"RA-7","CCI-004643":"RA-7","CCI-004644":"RA-7","CCI-004645":"RA-8 a","CCI-004646":"RA-8 b 1","CCI-004647":"RA-8 b 2","CCI-004648":"RA-9","CCI-004649":"RA-9","CCI-004650":"RA-9","CCI-004651":"RA-10 a 1","CCI-004652":"RA-10 a 2","CCI-004653":"RA-10 b","CCI-004654":"RA-10 b","CCI-004655":"SA-1 a 1 (b)","CCI-004656":"SA-1 b","CCI-004657":"SA-1 b","CCI-004658":"SA-1 b","CCI-004659":"SA-1 b","CCI-004660":"SA-1 b","CCI-004661":"SA-1 b","CCI-004662":"SA-1 c 1","CCI-004663":"SA-1 c 1","CCI-004664":"SA-1 c 2","CCI-004665":"SA-1 c 2","CCI-004666":"SA-2 a","CCI-004667":"SA-2 c","CCI-004668":"SA-2 c","CCI-004669":"SA-3 a","CCI-004670":"SA-3 a","CCI-004671":"SA-3 a","CCI-004672":"SA-3 a","CCI-004673":"SA-3 a","CCI-004674":"SA-3 a","CCI-004675":"SA-3 a","CCI-004676":"SA-3 b","CCI-004677":"SA-3 c","CCI-004678":"SA-3 d","CCI-004679":"SA-3 (1)","CCI-004680":"SA-3 (2) (a)","CCI-004681":"SA-3 (2) (a)","CCI-004682":"SA-3 (2) (a)","CCI-004683":"SA-3 (2) (b)","CCI-004684":"SA-3 (3)","CCI-004685":"SA-3 (3)","CCI-004686":"SA-4","CCI-004687":"SA-4 a","CCI-004688":"SA-4 c","CCI-004689":"SA-4 d","CCI-004690":"SA-4 d","CCI-004691":"SA-4 e","CCI-004692":"SA-4 f","CCI-004693":"SA-4 f","CCI-004694":"SA-4 h","CCI-004695":"SA-4 h","CCI-004696":"SA-4 h","CCI-004697":"SA-4 (3) (a)","CCI-004698":"SA-4 (3) (a)","CCI-004699":"SA-4 (3) (b)","CCI-004700":"SA-4 (3) (b)","CCI-004701":"SA-4 (3) (c)","CCI-004702":"SA-4 (3) (c)","CCI-004703":"SA-4 (11)","CCI-004704":"SA-4 (11)","CCI-004705":"SA-4 (12) (a)","CCI-004706":"SA-4 (12) (b)","CCI-004707":"SA-4 (12) (b)","CCI-004708":"SA-5 a 2","CCI-004709":"SA-5 b 1","CCI-004710":"SA-5 b 2","CCI-004711":"SA-5 b 3","CCI-004712":"SA-8","CCI-004713":"SA-8","CCI-004714":"SA-8","CCI-004715":"SA-8","CCI-004716":"SA-8","CCI-004717":"SA-8 (1)","CCI-004718":"SA-8 (2)","CCI-004719":"SA-8 (2)","CCI-004720":"SA-8 (3)","CCI-004721":"SA-8 (3)","CCI-004722":"SA-8 (4)","CCI-004723":"SA-8 (4)","CCI-004724":"SA-8 (5)","CCI-004725":"SA-8 (5)","CCI-004726":"SA-8 (6)","CCI-004727":"SA-8 (6)","CCI-004728":"SA-8 (7)","CCI-004729":"SA-8 (7)","CCI-004730":"SA-8 (8)","CCI-004731":"SA-8 (8)","CCI-004732":"SA-8 (9)","CCI-004733":"SA-8 (9)","CCI-004734":"SA-8 (10)","CCI-004735":"SA-8 (10)","CCI-004736":"SA-8 (11)","CCI-004737":"SA-8 (11)","CCI-004738":"SA-8 (12)","CCI-004739":"SA-8 (12)","CCI-004740":"SA-8 (13)","CCI-004741":"SA-8 (13)","CCI-004742":"SA-8 (14)","CCI-004743":"SA-8 (14)","CCI-004744":"SA-8 (15)","CCI-004745":"SA-8 (15)","CCI-004746":"SA-8 (16)","CCI-004747":"SA-8 (16)","CCI-004748":"SA-8 (17)","CCI-004749":"SA-8 (17)","CCI-004750":"SA-8 (18)","CCI-004751":"SA-8 (18)","CCI-004752":"SA-8 (19)","CCI-004753":"SA-8 (19)","CCI-004754":"SA-8 (20)","CCI-004755":"SA-8 (20)","CCI-004756":"SA-8 (21)","CCI-004757":"SA-8 (21)","CCI-004758":"SA-8 (22)","CCI-004759":"SA-8 (22)","CCI-004760":"SA-8 (23)","CCI-004761":"SA-8 (23)","CCI-004762":"SA-8 (24)","CCI-004763":"SA-8 (24)","CCI-004764":"SA-8 (25)","CCI-004765":"SA-8 (25)","CCI-004766":"SA-8 (26)","CCI-004767":"SA-8 (26)","CCI-004768":"SA-8 (27)","CCI-004769":"SA-8 (27)","CCI-004770":"SA-8 (28)","CCI-004771":"SA-8 (28)","CCI-004772":"SA-8 (29)","CCI-004773":"SA-8 (29)","CCI-004774":"SA-8 (30)","CCI-004775":"SA-8 (30)","CCI-004776":"SA-8 (31)","CCI-004777":"SA-8 (31)","CCI-004778":"SA-8 (32)","CCI-004779":"SA-8 (32)","CCI-004780":"SA-8 (33)","CCI-004781":"SA-8 (33)","CCI-004782":"SA-9 a","CCI-004783":"SA-9 a","CCI-004784":"SA-9 a","CCI-004785":"SA-9 b","CCI-004786":"SA-9 b","CCI-004787":"SA-9 (3)","CCI-004788":"SA-9 (3)","CCI-004789":"SA-9 (3)","CCI-004790":"SA-9 (3)","CCI-004791":"SA-9 (6)","CCI-004792":"SA-9 (7)","CCI-004793":"SA-9 (8)","CCI-004794":"SA-10 d","CCI-004795":"SA-10 (7)","CCI-004796":"SA-10 (7)","CCI-004797":"SA-10 (7)","CCI-004798":"SA-11 a","CCI-004799":"SA-11 a","CCI-004800":"SA-11 b","CCI-004801":"SA-11 (2) (a)","CCI-004802":"SA-11 (2) (a)","CCI-004803":"SA-11 (2) (b)","CCI-004804":"SA-11 (2) (b)","CCI-004805":"SA-11 (2) (c)","CCI-004806":"SA-11 (2) (c)","CCI-004807":"SA-11 (2) (d)","CCI-004808":"SA-11 (2) (d)","CCI-004809":"SA-11 (3) (a)","CCI-004810":"SA-11 (3) (a)","CCI-004811":"SA-11 (3) (a)","CCI-004812":"SA-11 (5) (a)","CCI-004813":"SA-11 (5) (b)","CCI-004814":"SA-11 (9)","CCI-004815":"SA-11 (9)","CCI-004816":"SA-15 a 1","CCI-004817":"SA-15 b","CCI-004818":"SA-15 b","CCI-004819":"SA-15 b","CCI-004820":"SA-15 b","CCI-004821":"SA-15 b","CCI-004822":"SA-15 b","CCI-004823":"SA-15 (2)","CCI-004824":"SA-15 (2)","CCI-004825":"SA-15 (3) (a)","CCI-004826":"SA-15 (3) (b)","CCI-004827":"SA-15 (7) (a)","CCI-004828":"SA-15 (7) (b)","CCI-004829":"SA-15 (7) (c)","CCI-004830":"SA-15 (7) (d)","CCI-004831":"SA-15 (10)","CCI-004832":"SA-15 (10)","CCI-004833":"SA-15 (11)","CCI-004834":"SA-15 (12)","CCI-004835":"SA-16","CCI-004836":"SA-16","CCI-004837":"SA-17","CCI-004838":"SA-17 a","CCI-004839":"SA-17 b","CCI-004840":"SA-17 b","CCI-004841":"SA-17 c","CCI-004842":"SA-17 (1) (a)","CCI-004843":"SA-17 (1) (a)","CCI-004844":"SA-17 (1) (b)","CCI-004845":"SA-17 (8)","CCI-004846":"SA-17 (8)","CCI-004847":"SA-17 (8)","CCI-004848":"SA-17 (9)","CCI-004849":"SA-17 (9)","CCI-004850":"SA-23","CCI-004851":"SA-23","CCI-004852":"SC-1 a 1 (a)","CCI-004853":"SC-1 a 1 (b)","CCI-004854":"SC-1 a 2","CCI-004855":"SC-1 b","CCI-004856":"SC-1 b","CCI-004857":"SC-1 b","CCI-004858":"SC-1 b","CCI-004859":"SC-1 b","CCI-004860":"SC-1 b","CCI-004861":"SC-1 c 1","CCI-004862":"SC-1 c 1","CCI-004863":"SC-1 c 2","CCI-004864":"SC-1 c 2","CCI-004865":"SC-2 (2)","CCI-004866":"SC-5 b","CCI-004867":"SC-5 b","CCI-004868":"SC-7 c","CCI-004869":"SC-7 (4) (f)","CCI-004870":"SC-7 (4) (g)","CCI-004871":"SC-7 (4) (h)","CCI-004872":"SC-7 (5)","CCI-004873":"SC-7 (7)","CCI-004874":"SC-7 (10) (b)","CCI-004875":"SC-7 (10) (b)","CCI-004876":"SC-7 (24) (a)","CCI-004877":"SC-7 (24) (a)","CCI-004878":"SC-7 (24) (b)","CCI-004879":"SC-7 (24) (c)","CCI-004880":"SC-7 (24) (d)","CCI-004881":"SC-7 (25)","CCI-004882":"SC-7 (25)","CCI-004883":"SC-7 (25)","CCI-004884":"SC-7 (26)","CCI-004885":"SC-7 (26)","CCI-004886":"SC-7 (27)","CCI-004887":"SC-7 (27)","CCI-004888":"SC-7 (27)","CCI-004889":"SC-7 (28)","CCI-004890":"SC-7 (28)","CCI-004891":"SC-7 (29)","CCI-004892":"SC-7 (29)","CCI-004893":"SC-8 (5)","CCI-004894":"SC-8 (5)","CCI-004895":"SC-11 b","CCI-004896":"SC-11 (1) (b)","CCI-004897":"SC-11 (1) (b)","CCI-004898":"SC-12 (3)","CCI-004899":"SC-12 (6)","CCI-004900":"SC-13 a","CCI-004901":"SC-16","CCI-004902":"SC-16","CCI-004903":"SC-16","CCI-004904":"SC-16 (1)","CCI-004905":"SC-16 (2)","CCI-004906":"SC-16 (3)","CCI-004907":"SC-16 (3)","CCI-004908":"SC-16 (3)","CCI-004909":"SC-17 b","CCI-004910":"SC-28 (3)","CCI-004911":"SC-28 (3)","CCI-004912":"SC-32 (1)","CCI-004913":"SC-36 (1) (b)","CCI-004914":"SC-36 (1) (b)","CCI-004915":"SC-36 (2)","CCI-004916":"SC-36 (2)","CCI-004917":"SC-42 (4)","CCI-004918":"SC-42 (4)","CCI-004919":"SC-42 (4)","CCI-004920":"SC-42 (5)","CCI-004921":"SC-42 (5)","CCI-004922":"SC-45","CCI-004923":"SC-45 (1) (a)","CCI-004924":"SC-45 (1) (a)","CCI-004925":"SC-45 (1) (a)","CCI-004926":"SC-45 (1) (b)","CCI-004927":"SC-45 (1) (b)","CCI-004928":"SC-45 (2) (a)","CCI-004929":"SC-45 (2) (b)","CCI-004930":"SC-46","CCI-004931":"SC-47","CCI-004932":"SC-48","CCI-004933":"SC-48","CCI-004934":"SC-48","CCI-004935":"SC-48","CCI-004936":"SC-48 (1)","CCI-004937":"SC-48 (1)","CCI-004938":"SC-48 (1)","CCI-004939":"SC-48 (1)","CCI-004940":"SC-49","CCI-004941":"SC-49","CCI-004942":"SC-50","CCI-004943":"SC-50","CCI-004944":"SI-1 a 1 (b)","CCI-004945":"SI-1 b","CCI-004946":"SI-1 b","CCI-004947":"SI-1 b","CCI-004948":"SI-1 b","CCI-004949":"SI-1 b","CCI-004950":"SI-1 b","CCI-004951":"SI-1 c 1","CCI-004952":"SI-1 c 1","CCI-004953":"SI-1 c 2","CCI-004954":"SI-1 c 2","CCI-004955":"SI-2 (2)","CCI-004956":"SI-2 (2)","CCI-004957":"SI-2 (2)","CCI-004958":"SI-2 (2)","CCI-004959":"SI-2 (2)","CCI-004960":"SI-2 (2)","CCI-004961":"SI-2 (4)","CCI-004962":"SI-2 (4)","CCI-004963":"SI-3 a","CCI-004964":"SI-3 b","CCI-004965":"SI-3 b","CCI-004966":"SI-3 c 2","CCI-004967":"SI-4 d","CCI-004968":"SI-4 (2)","CCI-004969":"SI-4 (3)","CCI-004970":"SI-4 (3)","CCI-004971":"SI-4 (4) (a)","CCI-004972":"SI-4 (4) (a)","CCI-004973":"SI-4 (4) (b)","CCI-004974":"SI-4 (4) (b)","CCI-004975":"SI-4 (9)","CCI-004976":"SI-4 (9)","CCI-004977":"SI-4 (10)","CCI-004978":"SI-4 (10)","CCI-004979":"SI-4 (10)","CCI-004980":"SI-4 (12)","CCI-004981":"SI-4 (16)","CCI-004982":"SI-4 (25)","CCI-004983":"SI-5 (1)","CCI-004984":"SI-6 a","CCI-004985":"SI-6 a","CCI-004986":"SI-6 b","CCI-004987":"SI-6 b","CCI-004988":"SI-6 b","CCI-004989":"SI-6 c","CCI-004990":"SI-6 c","CCI-004991":"SI-6 d","CCI-004992":"SI-6 d","CCI-004993":"SI-6 (2)","CCI-004994":"SI-6 (3)","CCI-004995":"SI-6 (3)","CCI-004996":"SI-7 b","CCI-004997":"SI-7 b","CCI-004998":"SI-7 (17)","CCI-004999":"SI-7 (17)","CCI-005000":"SI-8 b","CCI-005001":"SI-8 b","CCI-005002":"SI-8 (2)","CCI-005003":"SI-10 (6)","CCI-005004":"SI-12 (1)","CCI-005005":"SI-12 (1)","CCI-005006":"SI-12 (2)","CCI-005007":"SI-12 (2)","CCI-005008":"SI-12 (3)","CCI-005009":"SI-13 (3)","CCI-005010":"SI-13 (4) (b)","CCI-005011":"SI-14 (2) (a)","CCI-005012":"SI-14 (2) (a)","CCI-005013":"SI-14 (2) (a)","CCI-005014":"SI-14 (2) (a)","CCI-005015":"SI-14 (2) (b)","CCI-005016":"SI-14 (3)","CCI-005017":"SI-14 (3)","CCI-005018":"SI-18 a","CCI-005019":"SI-18 a","CCI-005020":"SI-18 b 1","CCI-005021":"SI-18 (1)","CCI-005022":"SI-18 (1)","CCI-005023":"SI-18 (2)","CCI-005024":"SI-18 (3)","CCI-005025":"SI-18 (4)","CCI-005026":"SI-18 (5)","CCI-005027":"SI-18 (5)","CCI-005028":"SI-18 (5)","CCI-005029":"SI-19 a","CCI-005030":"SI-19 a","CCI-005031":"SI-19 b","CCI-005032":"SI-19 b","CCI-005033":"SI-19 (1)","CCI-005034":"SI-19 (2)","CCI-005035":"SI-19 (3)","CCI-005036":"SI-19 (4)","CCI-005037":"SI-19 (5)","CCI-005038":"SI-19 (6)","CCI-005039":"SI-19 (7)","CCI-005040":"SI-19 (8)","CCI-005041":"SI-20","CCI-005042":"SI-20","CCI-005043":"SI-21","CCI-005044":"SI-21","CCI-005045":"SI-21","CCI-005046":"SI-22 a","CCI-005047":"SI-22 a","CCI-005048":"SI-22 b","CCI-005049":"SI-22 b","CCI-005050":"SI-23 a","CCI-005051":"SI-23 a","CCI-005052":"SI-23 a","CCI-005053":"SI-23 b","CCI-005054":"SI-23 b","CCI-005055":"SI-23 b","CCI-005056":"SR-1 a 1","CCI-005057":"SR-1 a 1 (a)","CCI-005058":"SR-1 a 1 (b)","CCI-005059":"SR-1 a 2","CCI-005060":"SR-1 b","CCI-005061":"SR-1 b","CCI-005062":"SR-1 b","CCI-005063":"SR-1 b","CCI-005064":"SR-1 c 1","CCI-005065":"SR-1 c 1","CCI-005066":"SR-1 c 1","CCI-005067":"SR-1 c 1","CCI-005068":"SR-1 c 2","CCI-005069":"SR-1 c 2","CCI-005070":"SR-1 c 2","CCI-005071":"SR-1 c 2","CCI-005072":"SR-2 a","CCI-005073":"SR-2 a","CCI-005074":"SR-2 b","CCI-005075":"SR-2 b","CCI-005076":"SR-2 c","CCI-005077":"SR-2 (1)","CCI-005078":"SR-2 (1)","CCI-005079":"SR-2 (1)","CCI-005080":"SR-3 a","CCI-005081":"SR-3 a","CCI-005082":"SR-3 a","CCI-005083":"SR-3 a","CCI-005084":"SR-3 a","CCI-005085":"SR-3 a","CCI-005086":"SR-3 b","CCI-005087":"SR-3 b","CCI-005088":"SR-3 b","CCI-005089":"SR-3 c","CCI-005090":"SR-3 c","CCI-005091":"SR-3 (1)","CCI-005092":"SR-3 (1)","CCI-005093":"SR-3 (2)","CCI-005094":"SR-3 (2)","CCI-005095":"SR-3 (3)","CCI-005096":"SR-4","CCI-005097":"SR-4","CCI-005098":"SR-4","CCI-005099":"SR-4","CCI-005100":"SR-4 (1)","CCI-005101":"SR-4 (1)","CCI-005102":"SR-4 (2)","CCI-005103":"SR-4 (2)","CCI-005104":"SR-4 (3)","CCI-005105":"SR-4 (3)","CCI-005106":"SR-4 (3)","CCI-005107":"SR-4 (3)","CCI-005108":"SR-4 (4)","CCI-005109":"SR-4 (4)","CCI-005110":"SR-4 (4)","CCI-005111":"SR-4 (4)","CCI-005112":"SR-5","CCI-005113":"SR-5","CCI-005114":"SR-5 (1)","CCI-005115":"SR-5 (1)","CCI-005116":"SR-5 (1)","CCI-005117":"SR-5 (2)","CCI-005118":"SR-6","CCI-005119":"SR-6","CCI-005120":"SR-6 (1)","CCI-005121":"SR-6 (1)","CCI-005122":"SR-7","CCI-005123":"SR-7","CCI-005124":"SR-8","CCI-005125":"SR-8","CCI-005126":"SR-9","CCI-005127":"SR-9 (1)","CCI-005128":"SR-10","CCI-005129":"SR-10","CCI-005130":"SR-10","CCI-005131":"SR-10","CCI-005132":"SR-11 a","CCI-005133":"SR-11 a","CCI-005134":"SR-11 b","CCI-005135":"SR-11 b","CCI-005136":"SR-11 b","CCI-005137":"SR-11 (1)","CCI-005138":"SR-11 (1)","CCI-005139":"SR-11 (2)","CCI-005140":"SR-11 (2)","CCI-005141":"SR-11 (2)","CCI-005142":"SR-11 (3)","CCI-005143":"SR-11 (3)","CCI-005144":"SR-12","CCI-005145":"SR-12","CCI-005146":"SR-12","CCI-005147":"AT-2 a 1","CCI-005149":"AU-16 (3)","CCI-005150":"PM-30 (1)"} \ No newline at end of file