Common Control Identifiers (CCIs)CCIs

Defines the personnel or roles the organization-level; mission/business process-level; and/or system-level identification and authorization policy is disseminated to.

The organization defines a time period that the mean time to failure (MTTF) must exceed before the organization manually initiates a transfer between active and standby information system components.

Reduce the maximum bandwidth for identified covert storage and/or timing channels to organization-defined values.

Require the developer of the system, system component, or system service to internally structure the security-relevant firmware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.

The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible.

Ensure that the public has access to information about organizational privacy activities.

Access tokens are revoked in accordance with organization-defined identification and authentication policy.

Develop organization-defined privacy reports.

Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by either physically separated communications paths or logically separated communications paths based upon encryption.

Defines the personnel who are to report anomalies in visitor access records.

Implement an audit reduction capability that supports after-the-fact investigations of incidents.

Defines the time period within which to resolve deficiencies identified during facility fire protection inspections.

Defines the approval authorities to be notified when proposed changes to the system are received.

Review and update the CONOPS in accordance with organization-defined frequency.

The organization allocates sufficient organization-defined staffing resources to implement and operate the organization-wide privacy program.

The organization uses only FICAM-approved path discovery and validation products and services.

The organization employs automated mechanisms on an organization-defined frequency to determine the state of information system components with regard to flaw remediation.

Determine the organization-defined cryptographic uses.

The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical measures.

The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required.

Identify organization-defined user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.

Protect the availability of resources by allocating organization-defined resources based on priority, quota, and/or organization-defined controls.

Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.

Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.

The information system, when transferring information between different security domains, implements policy filters that constrain data structure and content to [Assignment: organization-defined information security policy requirements].

Schedule replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.

Defines the configurations to be implemented on systems and system components when they are located in areas of significant risk.

Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level audit and accountability policy is to be disseminated.

Manage system authenticators by implementing administrative procedures for revoking authenticators.

Approve the use of system maintenance tools.

Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are developed.

Defines the frequency with which to review the visitor access records for the facility where the system resides.

The device used in the information system implementation of multifactor authentication for network access to non-privileged accounts meets organization-defined strength of mechanism requirements.

Test sanitization procedures in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved.

The organization documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls.

Document replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.

Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.

Audit the identity of internal users associated with denied outgoing communications traffic posing a threat to external systems.

Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring tools.

Defines information security topics to be discussed while conducting exit interviews.

Enforce organization-defined mandatory access control policies over all subjects and objects.

Implement a reference monitor for organization-defined access control policies that is always invoked.

Employ a formal sanctions process for individuals failing to comply with established information security policies.

The organization identifies connections to external information systems (i.e., information systems outside of the authorization boundary).

When transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.

The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for testing.

Defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after-the-fact investigations of incidents and meet regulatory and organizational information retention requirements.

The organization ensures that authentication decisions are transmitted between organization-defined services consistent with organizational policies.

Defines the modification action when transferring information between different security domains.

Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are developed.

Enforce organization-defined limitations on embedding data types within other data types.

Provide the capability to check the integrity of organizational information while it resides in the external system.

For systems that process information that will be maintained in a Privacy Act system of records: publish system of records notices in the Federal Register.

Manage system identifiers by selecting an identifier that identifies an individual, group, role, or device.

Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.

Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.

The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the relevancy of that information.

Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statue or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.

The organization determines normal time-of-day and duration usage for information system accounts.

The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection of personally identifiable information (PII).

Defines the concealment and misdirection techniques employed for organization-defined systems to confuse and mislead adversaries.

Defines the frequency for performing periodic scans of the system for malicious code.

Maintain the integrity of organization-defined privacy attributes associated with organization-defined subjects.

The organization defines the frequency on which it will review the audit and accountability policy.

Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments.

Defines the information to be removed from associated media.

Require that organization-defined user-installed software in a confined physical or virtual machine environment with limited privileges.

Defines the measures to be employed to ensure data or information collected by organization-defined sensors is used only for authorized purposes.

Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication policy.

The information system tracks problems associated with the information transfer.

Produce asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.

Maintain a central resource webpage on the organization's principle public website that serves as a central source of information about the organization's privacy plan.

The organization defines the frequency for reviewing the incident response plan.

Defines the system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

Defines the automatic environmental controls for preventing potentially harmful fluctuations to the system.

Analyze vulnerability scan reports and results from vulnerability monitoring.

For publicly accessible systems, includes a description of the authorized uses of the system.

The information system uses organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts.

Defines the physical access devices to inventory.

Defines additional personnel screening criteria that individuals accessing a system processing, storing, or transmitting information requiring protection must satisfy.

Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management procedures are to be disseminated.

Require that the presented identity evidence be validated through organizational defined methods of validation.

The organization defines the time period within which to notify organization-defined personnel or roles upon termination of individual employment.

The organization issues guidelines maximizing the integrity of disseminated Privacy Act information.

The organization conducts security control assessments using organization-defined forms of testing in accordance with organization-defined frequency and assessment techniques.

Develop an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.

Acquire the system using an organization-defined system development life cycle that incorporates information security considerations.

Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.

Defines alternative action(s) to be taken when anomalies in the operation of organization-defined privacy functions are discovered.

Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are updated whenever the organization makes a substantive change to the practices it describes.

Activate the redundant secondary system that is not collocated with the primary system without loss of information or disruption to operations.

For systems that process information that will be maintained in a Privacy Act system of records: draft system of records notices in accordance with OMB guidance.

Defines the personnel or roles to whom the risk assessment procedures are disseminated.

The organization requires that the registration process to receive an individual identifier includes supervisor authorization.

Enforce physical access authorizations at organization-defined entry points to the facility where the system resides.

Defines the discretionary access control policies the system is to enforce over subjects and objects.

The organization defines the frequency on which it will update the audit and accountability policy.

Review the plans in accordance with organization-defined frequency.

Implement ongoing control assessments in accordance with the continuous monitoring strategy.

Conduct the modeling and analyses as the following level of rigor.