nist_sp_800-53r5.yaml

ac:
  title: Access Control
  controls:
    ac-01: 
      label: AC-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, ac-1_prm_1 }}:
          1.  {{ insert: param, ac-1_prm_2 }} access control policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the access control policy and the associated access controls;
        b. Designate an {{ insert: param, ac-1_prm_3 }} to manage the development, documentation, and dissemination of the access control policy and procedures; and
        c. Review and update the current access control:
          1. Policy {{ insert: param, ac-1_prm_4 }} and following {{ insert: param, ac-1_prm_5 }}; and
          2. Procedures {{ insert: param, ac-1_prm_6 }} and following {{ insert: param, ac-1_prm_7 }}.
      parameters:
        ac-1_prm_1:
          label: "organization-defined personnel or roles"
        ac-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        ac-1_prm_3:
          label: "organization-defined official"
        ac-1_prm_4:
          label: "organization-defined frequency"
        ac-1_prm_5:
          label: "organization-defined events"
        ac-1_prm_6:
          label: "organization-defined frequency"
        ac-1_prm_7:
          label: "organization-defined events"
    ac-02: 
      label: AC-2
      title: Account Management
      statement: |
        a. Define and document the types of accounts allowed and specifically prohibited for use within the system;
        b. Assign account managers;
        c. Require {{ insert: param, ac-2_prm_1 }} for group and role membership;
        d. Specify:
          1. Authorized users of the system;
          2. Group and role membership; and
          3. Access authorizations (i.e., privileges) and {{ insert: param, ac-2_prm_2 }} for each account;
        e. Require approvals by {{ insert: param, ac-2_prm_3 }} for requests to create accounts;
        f. Create, enable, modify, disable, and remove accounts in accordance with {{ insert: param, ac-2_prm_4 }};
        g. Monitor the use of accounts;
        h. Notify account managers and {{ insert: param, ac-2_prm_5 }} within:
          1.  {{ insert: param, ac-2_prm_6 }} when accounts are no longer required;
          2.  {{ insert: param, ac-2_prm_7 }} when users are terminated or transferred; and
          3.  {{ insert: param, ac-2_prm_8 }} when system usage or need-to-know changes for an individual;
        i. Authorize access to the system based on:
          1. A valid access authorization;
          2. Intended system usage; and
          3.  {{ insert: param, ac-2_prm_9 }};
        j. Review accounts for compliance with account management requirements {{ insert: param, ac-2_prm_10 }};
        k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and
        l. Align account management processes with personnel termination and transfer processes.
      parameters:
        ac-2_prm_1:
          label: "organization-defined prerequisites and criteria"
        ac-2_prm_2:
          label: "organization-defined attributes (as required)"
        ac-2_prm_3:
          label: "organization-defined personnel or roles"
        ac-2_prm_4:
          label: "organization-defined policy, procedures, prerequisites, and criteria"
        ac-2_prm_5:
          label: "organization-defined personnel or roles"
        ac-2_prm_6:
          label: "organization-defined time period"
        ac-2_prm_7:
          label: "organization-defined time period"
        ac-2_prm_8:
          label: "organization-defined time period"
        ac-2_prm_9:
          label: "organization-defined attributes (as required)"
        ac-2_prm_10:
          label: "organization-defined frequency"
    ac-02.01:
      label: AC-2(1)
      parent_control: ac-02
      title: Automated System Account Management
      statement: |
        Support the management of system accounts using {{ insert: param, ac-2.1_prm_1 }}.
      parameters:
        ac-2.1_prm_1:
          label: "organization-defined automated mechanisms"
    ac-02.02:
      label: AC-2(2)
      parent_control: ac-02
      title: Automated Temporary and Emergency Account Management
      statement: |
        Automatically {{ insert: param, ac-2.2_prm_1 }} temporary and emergency accounts after {{ insert: param, ac-2.2_prm_2 }}.
      parameters:
        ac-2.2_prm_1:
          choice:
            - "remove"
            - "disable"
        ac-2.2_prm_2:
          label: "organization-defined time period for each type of account"
    ac-02.03:
      label: AC-2(3)
      parent_control: ac-02
      title: Disable Accounts
      statement: |
        Disable accounts within {{ insert: param, ac-2.3_prm_1 }} when the accounts: 
          (a) Have expired;
          (b) Are no longer associated with a user or individual;
          (c) Are in violation of organizational policy; or
          (d) Have been inactive for {{ insert: param, ac-2.3_prm_2 }}.
      parameters:
        ac-2.3_prm_1:
          label: "organization-defined time period"
        ac-2.3_prm_2:
          label: "organization-defined time period"
    ac-02.04:
      label: AC-2(4)
      parent_control: ac-02
      title: Automated Audit Actions
      statement: |
        Automatically audit account creation, modification, enabling, disabling, and removal actions.
    ac-02.05:
      label: AC-2(5)
      parent_control: ac-02
      title: Inactivity Logout
      statement: |
        Require that users log out when {{ insert: param, ac-2.5_prm_1 }}.
      parameters:
        ac-2.5_prm_1:
          label: "organization-defined time period of expected inactivity or description of when to log out"
    ac-02.06:
      label: AC-2(6)
      parent_control: ac-02
      title: Dynamic Privilege Management
      statement: |
        Implement {{ insert: param, ac-2.6_prm_1 }}.
      parameters:
        ac-2.6_prm_1:
          label: "organization-defined dynamic privilege management capabilities"
    ac-02.07:
      label: AC-2(7)
      parent_control: ac-02
      title: Privileged User Accounts
      statement: |
        (a) Establish and administer privileged user accounts in accordance with {{ insert: param, ac-2.7_prm_1 }};
        (b) Monitor privileged role or attribute assignments;
        (c) Monitor changes to roles or attributes; and
        (d) Revoke access when privileged role or attribute assignments are no longer appropriate.
      parameters:
        ac-2.7_prm_1:
          choice:
            - "a role-based access scheme"
            - "an attribute-based access scheme"
    ac-02.08:
      label: AC-2(8)
      parent_control: ac-02
      title: Dynamic Account Management
      statement: |
        Create, activate, manage, and deactivate {{ insert: param, ac-2.8_prm_1 }} dynamically.
      parameters:
        ac-2.8_prm_1:
          label: "organization-defined system accounts"
    ac-02.09:
      label: AC-2(9)
      parent_control: ac-02
      title: Restrictions on Use of Shared and Group Accounts
      statement: |
        Only permit the use of shared and group accounts that meet {{ insert: param, ac-2.9_prm_1 }}.
      parameters:
        ac-2.9_prm_1:
          label: "organization-defined conditions for establishing shared and group accounts"
    ac-02.11:
      label: AC-2(11)
      parent_control: ac-02
      title: Usage Conditions
      statement: |
        Enforce {{ insert: param, ac-2.11_prm_1 }} for {{ insert: param, ac-2.11_prm_2 }}.
      parameters:
        ac-2.11_prm_1:
          label: "organization-defined circumstances and/or usage conditions"
        ac-2.11_prm_2:
          label: "organization-defined system accounts"
    ac-02.12:
      label: AC-2(12)
      parent_control: ac-02
      title: Account Monitoring for Atypical Usage
      statement: |
        (a) Monitor system accounts for {{ insert: param, ac-2.12_prm_1 }}; and
        (b) Report atypical usage of system accounts to {{ insert: param, ac-2.12_prm_2 }}.
      parameters:
        ac-2.12_prm_1:
          label: "organization-defined atypical usage"
        ac-2.12_prm_2:
          label: "organization-defined personnel or roles"
    ac-02.13:
      label: AC-2(13)
      parent_control: ac-02
      title: Disable Accounts for High-risk Individuals
      statement: |
        Disable accounts of individuals within {{ insert: param, ac-2.13_prm_1 }} of discovery of {{ insert: param, ac-2.13_prm_2 }}.
      parameters:
        ac-2.13_prm_1:
          label: "organization-defined time period"
        ac-2.13_prm_2:
          label: "organization-defined significant risks"
    ac-03: 
      label: AC-3
      title: Access Enforcement
      statement: |
        Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
    ac-03.02:
      label: AC-3(2)
      parent_control: ac-03
      title: Dual Authorization
      statement: |
        Enforce dual authorization for {{ insert: param, ac-3.2_prm_1 }}.
      parameters:
        ac-3.2_prm_1:
          label: "organization-defined privileged commands and/or other organization-defined actions"
    ac-03.03:
      label: AC-3(3)
      parent_control: ac-03
      title: Mandatory Access Control
      statement: |
        Enforce {{ insert: param, ac-3.3_prm_1 }} over the set of covered subjects and objects specified in the policy, and where the policy:
          (a) Is uniformly enforced across the covered subjects and objects within the system; 
          (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following;
            (1) Passing the information to unauthorized subjects or objects;
            (2) Granting its privileges to other subjects; 
            (3) Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components;
            (4) Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects; and
            (5) Changing the rules governing access control; and
          (c) Specifies that {{ insert: param, ac-3.3_prm_2 }} may explicitly be granted {{ insert: param, ac-3.3_prm_3 }} such that they are not limited by any defined subset (or all) of the above constraints.
      parameters:
        ac-3.3_prm_1:
          label: "organization-defined mandatory access control policy"
        ac-3.3_prm_2:
          label: "organization-defined subjects"
        ac-3.3_prm_3:
          label: "organization-defined privileges"
    ac-03.04:
      label: AC-3(4)
      parent_control: ac-03
      title: Discretionary Access Control
      statement: |
        Enforce {{ insert: param, ac-3.4_prm_1 }} over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following:
          (a) Pass the information to any other subjects or objects;
          (b) Grant its privileges to other subjects; 
          (c) Change security attributes on subjects, objects, the system, or the system’s components;
          (d) Choose the security attributes to be associated with newly created or revised objects; or
          (e) Change the rules governing access control.
      parameters:
        ac-3.4_prm_1:
          label: "organization-defined discretionary access control policy"
    ac-03.05:
      label: AC-3(5)
      parent_control: ac-03
      title: Security-relevant Information
      statement: |
        Prevent access to {{ insert: param, ac-3.5_prm_1 }} except during secure, non-operable system states.
      parameters:
        ac-3.5_prm_1:
          label: "organization-defined security-relevant information"
    ac-03.07:
      label: AC-3(7)
      parent_control: ac-03
      title: Role-based Access Control
      statement: |
        Enforce a role-based access control policy over defined subjects and objects and control access based upon {{ insert: param, ac-3.7_prm_1 }}.
      parameters:
        ac-3.7_prm_1:
          label: "organization-defined roles and users authorized to assume such roles"
    ac-03.08:
      label: AC-3(8)
      parent_control: ac-03
      title: Revocation of Access Authorizations
      statement: |
        Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on {{ insert: param, ac-3.8_prm_1 }}.
      parameters:
        ac-3.8_prm_1:
          label: "organization-defined rules governing the timing of revocations of access authorizations"
    ac-03.09:
      label: AC-3(9)
      parent_control: ac-03
      title: Controlled Release
      statement: |
        Release information outside of the system only if:
          (a) The receiving {{ insert: param, ac-3.9_prm_1 }} provides {{ insert: param, ac-3.9_prm_2 }}; and
          (b)  {{ insert: param, ac-3.9_prm_3 }} are used to validate the appropriateness of the information designated for release.
      parameters:
        ac-3.9_prm_1:
          label: "organization-defined system or system component"
        ac-3.9_prm_2:
          label: "organization-defined controls"
        ac-3.9_prm_3:
          label: "organization-defined controls"
    ac-03.10:
      label: AC-3(10)
      parent_control: ac-03
      title: Audited Override of Access Control Mechanisms
      statement: |
        Employ an audited override of automated access control mechanisms under {{ insert: param, ac-3.10_prm_1 }} by {{ insert: param, ac-3.10_prm_2 }}.
      parameters:
        ac-3.10_prm_1:
          label: "organization-defined conditions"
        ac-3.10_prm_2:
          label: "organization-defined roles"
    ac-03.11:
      label: AC-3(11)
      parent_control: ac-03
      title: Restrict Access to Specific Information Types
      statement: |
        Restrict access to data repositories containing {{ insert: param, ac-3.11_prm_1 }}.
      parameters:
        ac-3.11_prm_1:
          label: "organization-defined information types"
    ac-03.12:
      label: AC-3(12)
      parent_control: ac-03
      title: Assert and Enforce Application Access
      statement: |
        (a) Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: {{ insert: param, ac-3.12_prm_1 }};
        (b) Provide an enforcement mechanism to prevent unauthorized access; and
        (c) Approve access changes after initial installation of the application.
      parameters:
        ac-3.12_prm_1:
          label: "organization-defined system applications and functions"
    ac-03.13:
      label: AC-3(13)
      parent_control: ac-03
      title: Attribute-based Access Control
      statement: |
        Enforce attribute-based access control policy over defined subjects and objects and control access based upon {{ insert: param, ac-3.13_prm_1 }}.
      parameters:
        ac-3.13_prm_1:
          label: "organization-defined attributes to assume access permissions"
    ac-03.14:
      label: AC-3(14)
      parent_control: ac-03
      title: Individual Access
      statement: |
        Provide {{ insert: param, ac-3.14_prm_1 }} to enable individuals to have access to the following elements of their personally identifiable information: {{ insert: param, ac-3.14_prm_2 }}.
      parameters:
        ac-3.14_prm_1:
          label: "organization-defined mechanisms"
        ac-3.14_prm_2:
          label: "organization-defined elements"
    ac-03.15:
      label: AC-3(15)
      parent_control: ac-03
      title: Discretionary and Mandatory Access Control
      statement: |
        (a) Enforce {{ insert: param, ac-3.15_prm_1 }} over the set of covered subjects and objects specified in the policy; and
        (b) Enforce {{ insert: param, ac-3.15_prm_2 }} over the set of covered subjects and objects specified in the policy.
      parameters:
        ac-3.15_prm_1:
          label: "organization-defined mandatory access control policy"
        ac-3.15_prm_2:
          label: "organization-defined discretionary access control policy"
    ac-04: 
      label: AC-4
      title: Information Flow Enforcement
      statement: |
        Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on {{ insert: param, ac-4_prm_1 }}.
      parameters:
        ac-4_prm_1:
          label: "organization-defined information flow control policies"
    ac-04.01:
      label: AC-4(1)
      parent_control: ac-04
      title: Object Security and Privacy Attributes
      statement: |
        Use {{ insert: param, ac-4.1_prm_1 }} associated with {{ insert: param, ac-4.1_prm_2 }} to enforce {{ insert: param, ac-4.1_prm_3 }} as a basis for flow control decisions.
      parameters:
        ac-4.1_prm_1:
          label: "organization-defined security and privacy attributes"
        ac-4.1_prm_2:
          label: "organization-defined information, source, and destination objects"
        ac-4.1_prm_3:
          label: "organization-defined information flow control policies"
    ac-04.02:
      label: AC-4(2)
      parent_control: ac-04
      title: Processing Domains
      statement: |
        Use protected processing domains to enforce {{ insert: param, ac-4.2_prm_1 }} as a basis for flow control decisions.
      parameters:
        ac-4.2_prm_1:
          label: "organization-defined information flow control policies"
    ac-04.03:
      label: AC-4(3)
      parent_control: ac-04
      title: Dynamic Information Flow Control
      statement: |
        Enforce {{ insert: param, ac-4.3_prm_1 }}.
      parameters:
        ac-4.3_prm_1:
          label: "organization-defined information flow control policies"
    ac-04.04:
      label: AC-4(4)
      parent_control: ac-04
      title: Flow Control of Encrypted Information
      statement: |
        Prevent encrypted information from bypassing {{ insert: param, ac-4.4_prm_1 }} by {{ insert: param, ac-4.4_prm_2 }}.
      parameters:
        ac-4.4_prm_1:
          label: "organization-defined information flow control mechanisms"
        ac-4.4_prm_2:
          how-many: one or more
          choice:
            - "decrypting the information"
            - "blocking the flow of the encrypted information"
            - "terminating communications sessions attempting to pass encrypted information"
            - " {{ insert: param, ac-4.4_prm_3 }} "
        ac-4.4_prm_3:
          label: "organization-defined procedure or method"
    ac-04.05:
      label: AC-4(5)
      parent_control: ac-04
      title: Embedded Data Types
      statement: |
        Enforce {{ insert: param, ac-4.5_prm_1 }} on embedding data types within other data types.
      parameters:
        ac-4.5_prm_1:
          label: "organization-defined limitations"
    ac-04.06:
      label: AC-4(6)
      parent_control: ac-04
      title: Metadata
      statement: |
        Enforce information flow control based on {{ insert: param, ac-4.6_prm_1 }}.
      parameters:
        ac-4.6_prm_1:
          label: "organization-defined metadata"
    ac-04.07:
      label: AC-4(7)
      parent_control: ac-04
      title: One-way Flow Mechanisms
      statement: |
        Enforce one-way information flows through hardware-based flow control mechanisms.
    ac-04.08:
      label: AC-4(8)
      parent_control: ac-04
      title: Security and Privacy Policy Filters
      statement: |
        (a) Enforce information flow control using {{ insert: param, ac-4.8_prm_1 }} as a basis for flow control decisions for {{ insert: param, ac-4.8_prm_2 }}; and
        (b)  {{ insert: param, ac-4.8_prm_3 }} data after a filter processing failure in accordance with {{ insert: param, ac-4.8_prm_4 }}.
      parameters:
        ac-4.8_prm_1:
          label: "organization-defined security or privacy policy filters"
        ac-4.8_prm_2:
          label: "organization-defined information flows"
        ac-4.8_prm_3:
          how-many: one or more
          choice:
            - "Block"
            - "Strip"
            - "Modify"
            - "Quarantine"
        ac-4.8_prm_4:
          label: "organization-defined security or privacy policy"
    ac-04.09:
      label: AC-4(9)
      parent_control: ac-04
      title: Human Reviews
      statement: |
        Enforce the use of human reviews for {{ insert: param, ac-4.9_prm_1 }} under the following conditions: {{ insert: param, ac-4.9_prm_2 }}.
      parameters:
        ac-4.9_prm_1:
          label: "organization-defined information flows"
        ac-4.9_prm_2:
          label: "organization-defined conditions"
    ac-04.10:
      label: AC-4(10)
      parent_control: ac-04
      title: Enable and Disable Security or Privacy Policy Filters
      statement: |
        Provide the capability for privileged administrators to enable and disable {{ insert: param, ac-4.10_prm_1 }} under the following conditions: {{ insert: param, ac-4.10_prm_2 }}.
      parameters:
        ac-4.10_prm_1:
          label: "organization-defined security or privacy policy filters"
        ac-4.10_prm_2:
          label: "organization-defined conditions"
    ac-04.11:
      label: AC-4(11)
      parent_control: ac-04
      title: Configuration of Security or Privacy Policy Filters
      statement: |
        Provide the capability for privileged administrators to configure {{ insert: param, ac-4.11_prm_1 }} to support different security or privacy policies.
      parameters:
        ac-4.11_prm_1:
          label: "organization-defined security or privacy policy filters"
    ac-04.12:
      label: AC-4(12)
      parent_control: ac-04
      title: Data Type Identifiers
      statement: |
        When transferring information between different security domains, use {{ insert: param, ac-4.12_prm_1 }} to validate data essential for information flow decisions.
      parameters:
        ac-4.12_prm_1:
          label: "organization-defined data type identifiers"
    ac-04.13:
      label: AC-4(13)
      parent_control: ac-04
      title: Decomposition into Policy-relevant Subcomponents
      statement: |
        When transferring information between different security domains, decompose information into {{ insert: param, ac-4.13_prm_1 }} for submission to policy enforcement mechanisms.
      parameters:
        ac-4.13_prm_1:
          label: "organization-defined policy-relevant subcomponents"
    ac-04.14:
      label: AC-4(14)
      parent_control: ac-04
      title: Security or Privacy Policy Filter Constraints
      statement: |
        When transferring information between different security domains, implement {{ insert: param, ac-4.14_prm_1 }} requiring fully enumerated formats that restrict data structure and content.
      parameters:
        ac-4.14_prm_1:
          label: "organization-defined security or privacy policy filters"
    ac-04.15:
      label: AC-4(15)
      parent_control: ac-04
      title: Detection of Unsanctioned Information
      statement: |
        When transferring information between different security domains, examine the information for the presence of {{ insert: param, ac-4.15_prm_1 }} and prohibit the transfer of such information in accordance with the {{ insert: param, ac-4.15_prm_2 }}.
      parameters:
        ac-4.15_prm_1:
          label: "organization-defined unsanctioned information"
        ac-4.15_prm_2:
          label: "organization-defined security or privacy policy"
    ac-04.17:
      label: AC-4(17)
      parent_control: ac-04
      title: Domain Authentication
      statement: |
        Uniquely identify and authenticate source and destination points by {{ insert: param, ac-4.17_prm_1 }} for information transfer.
      parameters:
        ac-4.17_prm_1:
          how-many: one or more
          choice:
            - "organization"
            - "system"
            - "application"
            - "service"
            - "individual"
    ac-04.19:
      label: AC-4(19)
      parent_control: ac-04
      title: Validation of Metadata
      statement: |
        When transferring information between different security domains, implement {{ insert: param, ac-4.19_prm_1 }} on metadata.
      parameters:
        ac-4.19_prm_1:
          label: "organization-defined security or privacy policy filters"
    ac-04.20:
      label: AC-4(20)
      parent_control: ac-04
      title: Approved Solutions
      statement: |
        Employ {{ insert: param, ac-4.20_prm_1 }} to control the flow of {{ insert: param, ac-4.20_prm_2 }} across security domains.
      parameters:
        ac-4.20_prm_1:
          label: "organization-defined solutions in approved configurations"
        ac-4.20_prm_2:
          label: "organization-defined information"
    ac-04.21:
      label: AC-4(21)
      parent_control: ac-04
      title: Physical or Logical Separation of Information Flows
      statement: |
        Separate information flows logically or physically using {{ insert: param, ac-4.21_prm_1 }} to accomplish {{ insert: param, ac-4.21_prm_2 }}.
      parameters:
        ac-4.21_prm_1:
          label: "organization-defined mechanisms and/or techniques"
        ac-4.21_prm_2:
          label: "organization-defined required separations by types of information"
    ac-04.22:
      label: AC-4(22)
      parent_control: ac-04
      title: Access Only
      statement: |
        Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains.
    ac-04.23:
      label: AC-4(23)
      parent_control: ac-04
      title: Modify Non-releasable Information
      statement: |
        When transferring information between different security domains, modify non-releasable information by implementing {{ insert: param, ac-4.23_prm_1 }}.
      parameters:
        ac-4.23_prm_1:
          label: "organization-defined modification action"
    ac-04.24:
      label: AC-4(24)
      parent_control: ac-04
      title: Internal Normalized Format
      statement: |
        When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification.
    ac-04.25:
      label: AC-4(25)
      parent_control: ac-04
      title: Data Sanitization
      statement: |
        When transferring information between different security domains, sanitize data to minimize {{ insert: param, ac-4.25_prm_1 }} in accordance with {{ insert: param, ac-4.25_prm_2 }}.
      parameters:
        ac-4.25_prm_1:
          how-many: one or more
          choice:
            - "delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography encoded data"
            - "spillage of sensitive information"
        ac-4.25_prm_2:
          label: "organization-defined policy"
    ac-04.26:
      label: AC-4(26)
      parent_control: ac-04
      title: Audit Filtering Actions
      statement: |
        When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.
    ac-04.27:
      label: AC-4(27)
      parent_control: ac-04
      title: Redundant/independent Filtering Mechanisms
      statement: |
        When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.
    ac-04.28:
      label: AC-4(28)
      parent_control: ac-04
      title: Linear Filter Pipelines
      statement: |
        When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.
    ac-04.29:
      label: AC-4(29)
      parent_control: ac-04
      title: Filter Orchestration Engines
      statement: |
        When transferring information between different security domains, employ content filter orchestration engines to ensure that:
          (a) Content filtering mechanisms successfully complete execution without errors; and
          (b) Content filtering actions occur in the correct order and comply with {{ insert: param, ac-4.29_prm_1 }}.
      parameters:
        ac-4.29_prm_1:
          label: "organization-defined policy"
    ac-04.30:
      label: AC-4(30)
      parent_control: ac-04
      title: Filter Mechanisms Using Multiple Processes
      statement: |
        When transferring information between different security domains, implement content filtering mechanisms using multiple processes.
    ac-04.31:
      label: AC-4(31)
      parent_control: ac-04
      title: Failed Content Transfer Prevention
      statement: |
        When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.
    ac-04.32:
      label: AC-4(32)
      parent_control: ac-04
      title: Process Requirements for Information Transfer
      statement: |
        When transferring information between different security domains, the process that transfers information between filter pipelines:
          (a) Does not filter message content;
          (b) Validates filtering metadata;
          (c) Ensures the content associated with the filtering metadata has successfully completed filtering; and
          (d) Transfers the content to the destination filter pipeline.
    ac-05: 
      label: AC-5
      title: Separation of Duties
      statement: |
        a. Identify and document {{ insert: param, ac-5_prm_1 }}; and
        b. Define system access authorizations to support separation of duties.
      parameters:
        ac-5_prm_1:
          label: "organization-defined duties of individuals requiring separation"
    ac-06: 
      label: AC-6
      title: Least Privilege
      statement: |
        Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
    ac-06.01:
      label: AC-6(1)
      parent_control: ac-06
      title: Authorize Access to Security Functions
      statement: |
        Authorize access for {{ insert: param, ac-6.1_prm_1 }} to:
          (a)  {{ insert: param, ac-6.1_prm_2 }}; and
          (b)  {{ insert: param, ac-6.1_prm_3 }}.
      parameters:
        ac-6.1_prm_1:
          label: "organization-defined individuals or roles"
        ac-6.1_prm_2:
          label: "organization-defined security functions (deployed in hardware, software, and firmware)"
        ac-6.1_prm_3:
          label: "organization-defined security-relevant information"
    ac-06.02:
      label: AC-6(2)
      parent_control: ac-06
      title: Non-privileged Access for Nonsecurity Functions
      statement: |
        Require that users of system accounts (or roles) with access to {{ insert: param, ac-6.2_prm_1 }} use non-privileged accounts or roles, when accessing nonsecurity functions.
      parameters:
        ac-6.2_prm_1:
          label: "organization-defined security functions or security-relevant information"
    ac-06.03:
      label: AC-6(3)
      parent_control: ac-06
      title: Network Access to Privileged Commands
      statement: |
        Authorize network access to {{ insert: param, ac-6.3_prm_1 }} only for {{ insert: param, ac-6.3_prm_2 }} and document the rationale for such access in the security plan for the system.
      parameters:
        ac-6.3_prm_1:
          label: "organization-defined privileged commands"
        ac-6.3_prm_2:
          label: "organization-defined compelling operational needs"
    ac-06.04:
      label: AC-6(4)
      parent_control: ac-06
      title: Separate Processing Domains
      statement: |
        Provide separate processing domains to enable finer-grained allocation of user privileges.
    ac-06.05:
      label: AC-6(5)
      parent_control: ac-06
      title: Privileged Accounts
      statement: |
        Restrict privileged accounts on the system to {{ insert: param, ac-6.5_prm_1 }}.
      parameters:
        ac-6.5_prm_1:
          label: "organization-defined personnel or roles"
    ac-06.06:
      label: AC-6(6)
      parent_control: ac-06
      title: Privileged Access by Non-organizational Users
      statement: |
        Prohibit privileged access to the system by non-organizational users.
    ac-06.07:
      label: AC-6(7)
      parent_control: ac-06
      title: Review of User Privileges
      statement: |
        (a) Review {{ insert: param, ac-6.7_prm_1 }} the privileges assigned to {{ insert: param, ac-6.7_prm_2 }} to validate the need for such privileges; and
        (b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
      parameters:
        ac-6.7_prm_1:
          label: "organization-defined frequency"
        ac-6.7_prm_2:
          label: "organization-defined roles or classes of users"
    ac-06.08:
      label: AC-6(8)
      parent_control: ac-06
      title: Privilege Levels for Code Execution
      statement: |
        Prevent the following software from executing at higher privilege levels than users executing the software: {{ insert: param, ac-6.8_prm_1 }}.
      parameters:
        ac-6.8_prm_1:
          label: "organization-defined software"
    ac-06.09:
      label: AC-6(9)
      parent_control: ac-06
      title: Log Use of Privileged Functions
      statement: |
        Log the execution of privileged functions.
    ac-06.10:
      label: AC-6(10)
      parent_control: ac-06
      title: Prohibit Non-privileged Users from Executing Privileged Functions
      statement: |
        Prevent non-privileged users from executing privileged functions.
    ac-07: 
      label: AC-7
      title: Unsuccessful Logon Attempts
      statement: |
        a. Enforce a limit of {{ insert: param, ac-7_prm_1 }} consecutive invalid logon attempts by a user during a {{ insert: param, ac-7_prm_2 }}; and
        b. Automatically {{ insert: param, ac-7_prm_3 }} when the maximum number of unsuccessful attempts is exceeded.
      parameters:
        ac-7_prm_1:
          label: "organization-defined number"
        ac-7_prm_2:
          label: "organization-defined time period"
        ac-7_prm_3:
          how-many: one or more
          choice:
            - "lock the account or node for an {{ insert: param, ac-7_prm_4 }} "
            - "lock the account or node until released by an administrator"
            - "delay next logon prompt per {{ insert: param, ac-7_prm_5 }} "
            - "notify system administrator"
            - "take other {{ insert: param, ac-7_prm_6 }} "
        ac-7_prm_4:
          label: "organization-defined time period"
        ac-7_prm_5:
          label: "organization-defined delay algorithm"
        ac-7_prm_6:
          label: "organization-defined action"
    ac-07.02:
      label: AC-7(2)
      parent_control: ac-07
      title: Purge or Wipe Mobile Device
      statement: |
        Purge or wipe information from {{ insert: param, ac-7.2_prm_1 }} based on {{ insert: param, ac-7.2_prm_2 }} after {{ insert: param, ac-7.2_prm_3 }} consecutive, unsuccessful device logon attempts.
      parameters:
        ac-7.2_prm_1:
          label: "organization-defined mobile devices"
        ac-7.2_prm_2:
          label: "organization-defined purging or wiping requirements and techniques"
        ac-7.2_prm_3:
          label: "organization-defined number"
    ac-07.03:
      label: AC-7(3)
      parent_control: ac-07
      title: Biometric Attempt Limiting
      statement: |
        Limit the number of unsuccessful biometric logon attempts to {{ insert: param, ac-7.3_prm_1 }}.
      parameters:
        ac-7.3_prm_1:
          label: "organization-defined number"
    ac-07.04:
      label: AC-7(4)
      parent_control: ac-07
      title: Use of Alternate Authentication Factor
      statement: |
        (a) Allow the use of {{ insert: param, ac-7.4_prm_1 }} that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and
        (b) Enforce a limit of {{ insert: param, ac-7.4_prm_2 }} consecutive invalid logon attempts through use of the alternative factors by a user during a {{ insert: param, ac-7.4_prm_3 }}.
      parameters:
        ac-7.4_prm_1:
          label: "organization-defined authentication factors"
        ac-7.4_prm_2:
          label: "organization-defined number"
        ac-7.4_prm_3:
          label: "organization-defined time period"
    ac-08: 
      label: AC-8
      title: System Use Notification
      statement: |
        a. Display {{ insert: param, ac-8_prm_1 }} to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:
          1. Users are accessing a U.S. Government system;
          2. System usage may be monitored, recorded, and subject to audit;
          3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
          4. Use of the system indicates consent to monitoring and recording;
        b. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and
        c. For publicly accessible systems:
          1. Display system use information {{ insert: param, ac-8_prm_2 }}, before granting further access to the publicly accessible system;
          2. Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
          3. Include a description of the authorized uses of the system.
      parameters:
        ac-8_prm_1:
          label: "organization-defined system use notification message or banner"
        ac-8_prm_2:
          label: "organization-defined conditions"
    ac-09: 
      label: AC-9
      title: Previous Logon Notification
      statement: |
        Notify the user, upon successful logon to the system, of the date and time of the last logon. 
    ac-09.01:
      label: AC-9(1)
      parent_control: ac-09
      title: Unsuccessful Logons
      statement: |
        Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
    ac-09.02:
      label: AC-9(2)
      parent_control: ac-09
      title: Successful and Unsuccessful Logons
      statement: |
        Notify the user, upon successful logon, of the number of {{ insert: param, ac-9.2_prm_1 }} during {{ insert: param, ac-9.2_prm_2 }}.
      parameters:
        ac-9.2_prm_1:
          choice:
            - "successful logons"
            - "unsuccessful logon attempts"
            - "both"
        ac-9.2_prm_2:
          label: "organization-defined time period"
    ac-09.03:
      label: AC-9(3)
      parent_control: ac-09
      title: Notification of Account Changes
      statement: |
        Notify the user, upon successful logon, of changes to {{ insert: param, ac-9.3_prm_1 }} during {{ insert: param, ac-9.3_prm_2 }}.
      parameters:
        ac-9.3_prm_1:
          label: "organization-defined security-related characteristics or parameters of the user’s account"
        ac-9.3_prm_2:
          label: "organization-defined time period"
    ac-09.04:
      label: AC-9(4)
      parent_control: ac-09
      title: Additional Logon Information
      statement: |
        Notify the user, upon successful logon, of the following additional information: {{ insert: param, ac-9.4_prm_1 }}.
      parameters:
        ac-9.4_prm_1:
          label: "organization-defined additional information"
    ac-10: 
      label: AC-10
      title: Concurrent Session Control
      statement: |
        Limit the number of concurrent sessions for each {{ insert: param, ac-10_prm_1 }} to {{ insert: param, ac-10_prm_2 }}.
      parameters:
        ac-10_prm_1:
          label: "organization-defined account and/or account type"
        ac-10_prm_2:
          label: "organization-defined number"
    ac-11: 
      label: AC-11
      title: Device Lock
      statement: |
        a. Prevent further access to the system by {{ insert: param, ac-11_prm_1 }}; and
        b. Retain the device lock until the user reestablishes access using established identification and authentication procedures.
      parameters:
        ac-11_prm_1:
          how-many: one or more
          choice:
            - "initiating a device lock after {{ insert: param, ac-11_prm_2 }} of inactivity"
            - "requiring the user to initiate a device lock before leaving the system unattended"
        ac-11_prm_2:
          label: "organization-defined time period"
    ac-11.01:
      label: AC-11(1)
      parent_control: ac-11
      title: Pattern-hiding Displays
      statement: |
         **Conceal, via the device lock, information previously visible on the display with a publicly viewable image**.
    ac-12: 
      label: AC-12
      title: Session Termination
      statement: |
        Automatically terminate a user session after {{ insert: param, ac-12_prm_1 }}.
      parameters:
        ac-12_prm_1:
          label: "organization-defined conditions or trigger events requiring session disconnect"
    ac-12.01:
      label: AC-12(1)
      parent_control: ac-12
      title: User-initiated Logouts
      statement: |
        Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to {{ insert: param, ac-12.1_prm_1 }}.
      parameters:
        ac-12.1_prm_1:
          label: "organization-defined information resources"
    ac-12.02:
      label: AC-12(2)
      parent_control: ac-12
      title: Termination Message
      statement: |
        Display an explicit logout message to users indicating the termination of authenticated communications sessions.
    ac-12.03:
      label: AC-12(3)
      parent_control: ac-12
      title: Timeout Warning Message
      statement: |
        Display an explicit message to users indicating that the session will end in {{ insert: param, ac-12.3_prm_1 }}.
      parameters:
        ac-12.3_prm_1:
          label: "organization-defined time until end of session"
    ac-14: 
      label: AC-14
      title: Permitted Actions Without Identification or Authentication
      statement: |
        a. Identify {{ insert: param, ac-14_prm_1 }} that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and
        b. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.
      parameters:
        ac-14_prm_1:
          label: "organization-defined user actions"
    ac-16: 
      label: AC-16
      title: Security and Privacy Attributes
      statement: |
        a. Provide the means to associate {{ insert: param, ac-16_prm_1 }} with {{ insert: param, ac-16_prm_2 }} for information in storage, in process, and/or in transmission;
        b. Ensure that the attribute associations are made and retained with the information;
        c. Establish the following permitted security and privacy attributes from the attributes defined in [AC-16a](#ac-16_smt.a) for {{ insert: param, ac-16_prm_3 }}: {{ insert: param, ac-16_prm_4 }};
        d. Determine the following permitted attribute values or ranges for each of the established attributes: {{ insert: param, ac-16_prm_5 }};
        e. Audit changes to attributes; and
        f. Review {{ insert: param, ac-16_prm_6 }} for applicability {{ insert: param, ac-16_prm_7 }}.
      parameters:
        ac-16_prm_1:
          label: "organization-defined types of security and privacy attributes"
        ac-16_prm_2:
          label: "organization-defined security and privacy attribute values"
        ac-16_prm_3:
          label: "organization-defined systems"
        ac-16_prm_4:
          label: "organization-defined security and privacy attributes"
        ac-16_prm_5:
          label: "organization-defined attribute values or ranges for established attributes"
        ac-16_prm_6:
          label: "organization-defined security and privacy attributes"
        ac-16_prm_7:
          label: "organization-defined frequency"
    ac-16.01:
      label: AC-16(1)
      parent_control: ac-16
      title: Dynamic Attribute Association
      statement: |
        Dynamically associate security and privacy attributes with {{ insert: param, ac-16.1_prm_1 }} in accordance with the following security and privacy policies as information is created and combined: {{ insert: param, ac-16.1_prm_2 }}.
      parameters:
        ac-16.1_prm_1:
          label: "organization-defined subjects and objects"
        ac-16.1_prm_2:
          label: "organization-defined security and privacy policies"
    ac-16.02:
      label: AC-16(2)
      parent_control: ac-16
      title: Attribute Value Changes by Authorized Individuals
      statement: |
        Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and privacy attributes.
    ac-16.03:
      label: AC-16(3)
      parent_control: ac-16
      title: Maintenance of Attribute Associations by System
      statement: |
        Maintain the association and integrity of {{ insert: param, ac-16.3_prm_1 }} to {{ insert: param, ac-16.3_prm_2 }}.
      parameters:
        ac-16.3_prm_1:
          label: "organization-defined security and privacy attributes"
        ac-16.3_prm_2:
          label: "organization-defined subjects and objects"
    ac-16.04:
      label: AC-16(4)
      parent_control: ac-16
      title: Association of Attributes by Authorized Individuals
      statement: |
        Provide the capability to associate {{ insert: param, ac-16.4_prm_1 }} with {{ insert: param, ac-16.4_prm_2 }} by authorized individuals (or processes acting on behalf of individuals).
      parameters:
        ac-16.4_prm_1:
          label: "organization-defined security and privacy attributes"
        ac-16.4_prm_2:
          label: "organization-defined subjects and objects"
    ac-16.05:
      label: AC-16(5)
      parent_control: ac-16
      title: Attribute Displays on Objects to Be Output
      statement: |
        Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify {{ insert: param, ac-16.5_prm_1 }} using {{ insert: param, ac-16.5_prm_2 }}.
      parameters:
        ac-16.5_prm_1:
          label: "organization-defined special dissemination, handling, or distribution instructions"
        ac-16.5_prm_2:
          label: "organization-defined human-readable, standard naming conventions"
    ac-16.06:
      label: AC-16(6)
      parent_control: ac-16
      title: Maintenance of Attribute Association
      statement: |
        Require personnel to associate and maintain the association of {{ insert: param, ac-16.6_prm_1 }} with {{ insert: param, ac-16.6_prm_2 }} in accordance with {{ insert: param, ac-16.6_prm_3 }}.
      parameters:
        ac-16.6_prm_1:
          label: "organization-defined security and privacy attributes"
        ac-16.6_prm_2:
          label: "organization-defined subjects and objects"
        ac-16.6_prm_3:
          label: "organization-defined security and privacy policies"
    ac-16.07:
      label: AC-16(7)
      parent_control: ac-16
      title: Consistent Attribute Interpretation
      statement: |
        Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.
    ac-16.08:
      label: AC-16(8)
      parent_control: ac-16
      title: Association Techniques and Technologies
      statement: |
        Implement {{ insert: param, ac-16.8_prm_1 }} in associating security and privacy attributes to information.
      parameters:
        ac-16.8_prm_1:
          label: "organization-defined techniques and technologies"
    ac-16.09:
      label: AC-16(9)
      parent_control: ac-16
      title: Attribute Reassignment — Regrading Mechanisms
      statement: |
        Change security and privacy attributes associated with information only via regrading mechanisms validated using {{ insert: param, ac-16.9_prm_1 }}.
      parameters:
        ac-16.9_prm_1:
          label: "organization-defined techniques or procedures"
    ac-16.10:
      label: AC-16(10)
      parent_control: ac-16
      title: Attribute Configuration by Authorized Individuals
      statement: |
        Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with subjects and objects.
    ac-17: 
      label: AC-17
      title: Remote Access
      statement: |
        a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
        b. Authorize each type of remote access to the system prior to allowing such connections.
    ac-17.01:
      label: AC-17(1)
      parent_control: ac-17
      title: Monitoring and Control
      statement: |
        Employ automated mechanisms to monitor and control remote access methods.
    ac-17.02:
      label: AC-17(2)
      parent_control: ac-17
      title: Protection of Confidentiality and Integrity Using Encryption
      statement: |
        Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
    ac-17.03:
      label: AC-17(3)
      parent_control: ac-17
      title: Managed Access Control Points
      statement: |
        Route remote accesses through authorized and managed network access control points.
    ac-17.04:
      label: AC-17(4)
      parent_control: ac-17
      title: Privileged Commands and Access
      statement: |
        (a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: {{ insert: param, ac-17.4_prm_1 }}; and
        (b) Document the rationale for remote access in the security plan for the system.
      parameters:
        ac-17.4_prm_1:
          label: "organization-defined needs"
    ac-17.06:
      label: AC-17(6)
      parent_control: ac-17
      title: Protection of Mechanism Information
      statement: |
        Protect information about remote access mechanisms from unauthorized use and disclosure.
    ac-17.09:
      label: AC-17(9)
      parent_control: ac-17
      title: Disconnect or Disable Access
      statement: |
        Provide the capability to disconnect or disable remote access to the system within {{ insert: param, ac-17.9_prm_1 }}.
      parameters:
        ac-17.9_prm_1:
          label: "organization-defined time period"
    ac-17.10:
      label: AC-17(10)
      parent_control: ac-17
      title: Authenticate Remote Commands
      statement: |
        Implement {{ insert: param, ac-17.10_prm_1 }} to authenticate {{ insert: param, ac-17.10_prm_2 }}.
      parameters:
        ac-17.10_prm_1:
          label: "organization-defined mechanisms"
        ac-17.10_prm_2:
          label: "organization-defined remote commands"
    ac-18: 
      label: AC-18
      title: Wireless Access
      statement: |
        a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and
        b. Authorize each type of wireless access to the system prior to allowing such connections.
    ac-18.01:
      label: AC-18(1)
      parent_control: ac-18
      title: Authentication and Encryption
      statement: |
        Protect wireless access to the system using authentication of {{ insert: param, ac-18.1_prm_1 }} and encryption.
      parameters:
        ac-18.1_prm_1:
          how-many: one or more
          choice:
            - "users"
            - "devices"
    ac-18.03:
      label: AC-18(3)
      parent_control: ac-18
      title: Disable Wireless Networking
      statement: |
        Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.
    ac-18.04:
      label: AC-18(4)
      parent_control: ac-18
      title: Restrict Configurations by Users
      statement: |
        Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.
    ac-18.05:
      label: AC-18(5)
      parent_control: ac-18
      title: Antennas and Transmission Power Levels
      statement: |
        Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
    ac-19: 
      label: AC-19
      title: Access Control for Mobile Devices
      statement: |
        a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and
        b. Authorize the connection of mobile devices to organizational systems.
    ac-19.04:
      label: AC-19(4)
      parent_control: ac-19
      title: Restrictions for Classified Information
      statement: |
        (a) Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and
        (b) Enforce the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information:
          (1) Connection of unclassified mobile devices to classified systems is prohibited;
          (2) Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official;
          (3) Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and
          (4) Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by {{ insert: param, ac-19.4_prm_1 }}, and if classified information is found, the incident handling policy is followed.
        (c) Restrict the connection of classified mobile devices to classified systems in accordance with {{ insert: param, ac-19.4_prm_2 }}.
      parameters:
        ac-19.4_prm_1:
          label: "organization-defined security officials"
        ac-19.4_prm_2:
          label: "organization-defined security policies"
    ac-19.05:
      label: AC-19(5)
      parent_control: ac-19
      title: Full Device or Container-based Encryption
      statement: |
        Employ {{ insert: param, ac-19.5_prm_1 }} to protect the confidentiality and integrity of information on {{ insert: param, ac-19.5_prm_2 }}.
      parameters:
        ac-19.5_prm_1:
          choice:
            - "full-device encryption"
            - "container-based encryption"
        ac-19.5_prm_2:
          label: "organization-defined mobile devices"
    ac-20: 
      label: AC-20
      title: Use of External Systems
      statement: |
        a.  {{ insert: param, ac-20_prm_1 }}, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:
          1. Access the system from external systems; and
          2. Process, store, or transmit organization-controlled information using external systems; or
        b. Prohibit the use of {{ insert: param, ac-20_prm_4 }}.
      parameters:
        ac-20_prm_1:
          how-many: one or more
          choice:
            - "Establish {{ insert: param, ac-20_prm_2 }} "
            - "Identify {{ insert: param, ac-20_prm_3 }} "
        ac-20_prm_2:
          label: "organization-defined terms and conditions"
        ac-20_prm_3:
          label: "organization-defined controls asserted to be implemented on external systems"
        ac-20_prm_4:
          label: "organizationally-defined types of external systems"
    ac-20.01:
      label: AC-20(1)
      parent_control: ac-20
      title: Limits on Authorized Use
      statement: |
        Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after:
          (a) Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or
          (b) Retention of approved system connection or processing agreements with the organizational entity hosting the external system.
    ac-20.02:
      label: AC-20(2)
      parent_control: ac-20
      title: Portable Storage Devices — Restricted Use
      statement: |
        Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using {{ insert: param, ac-20.2_prm_1 }}.
      parameters:
        ac-20.2_prm_1:
          label: "organization-defined restrictions"
    ac-20.03:
      label: AC-20(3)
      parent_control: ac-20
      title: Non-organizationally Owned Systems — Restricted Use
      statement: |
        Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using {{ insert: param, ac-20.3_prm_1 }}. 
      parameters:
        ac-20.3_prm_1:
          label: "organization-defined restrictions"
    ac-20.04:
      label: AC-20(4)
      parent_control: ac-20
      title: Network Accessible Storage Devices — Prohibited Use
      statement: |
        Prohibit the use of {{ insert: param, ac-20.4_prm_1 }} in external systems.
      parameters:
        ac-20.4_prm_1:
          label: "organization-defined network accessible storage devices"
    ac-20.05:
      label: AC-20(5)
      parent_control: ac-20
      title: Portable Storage Devices — Prohibited Use
      statement: |
        Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.
    ac-21: 
      label: AC-21
      title: Information Sharing
      statement: |
        a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for {{ insert: param, ac-21_prm_1 }}; and
        b. Employ {{ insert: param, ac-21_prm_2 }} to assist users in making information sharing and collaboration decisions.
      parameters:
        ac-21_prm_1:
          label: "organization-defined information sharing circumstances where user discretion is required"
        ac-21_prm_2:
          label: "organization-defined automated mechanisms or manual processes"
    ac-21.01:
      label: AC-21(1)
      parent_control: ac-21
      title: Automated Decision Support
      statement: |
        Employ {{ insert: param, ac-21.1_prm_1 }} to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
      parameters:
        ac-21.1_prm_1:
          label: "organization-defined automated mechanisms"
    ac-21.02:
      label: AC-21(2)
      parent_control: ac-21
      title: Information Search and Retrieval
      statement: |
        Implement information search and retrieval services that enforce {{ insert: param, ac-21.2_prm_1 }}.
      parameters:
        ac-21.2_prm_1:
          label: "organization-defined information sharing restrictions"
    ac-22: 
      label: AC-22
      title: Publicly Accessible Content
      statement: |
        a. Designate individuals authorized to make information publicly accessible;
        b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
        c. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and
        d. Review the content on the publicly accessible system for nonpublic information {{ insert: param, ac-22_prm_1 }} and remove such information, if discovered.
      parameters:
        ac-22_prm_1:
          label: "organization-defined frequency"
    ac-23: 
      label: AC-23
      title: Data Mining Protection
      statement: |
        Employ {{ insert: param, ac-23_prm_1 }} for {{ insert: param, ac-23_prm_2 }} to detect and protect against unauthorized data mining.
      parameters:
        ac-23_prm_1:
          label: "organization-defined data mining prevention and detection techniques"
        ac-23_prm_2:
          label: "organization-defined data storage objects"
    ac-24: 
      label: AC-24
      title: Access Control Decisions
      statement: |
         {{ insert: param, ac-24_prm_1 }} to ensure {{ insert: param, ac-24_prm_2 }} are applied to each access request prior to access enforcement.
      parameters:
        ac-24_prm_1:
          choice:
            - "Establish procedures"
            - "Implement mechanisms"
        ac-24_prm_2:
          label: "organization-defined access control decisions"
    ac-24.01:
      label: AC-24(1)
      parent_control: ac-24
      title: Transmit Access Authorization Information
      statement: |
        Transmit {{ insert: param, ac-24.1_prm_1 }} using {{ insert: param, ac-24.1_prm_2 }} to {{ insert: param, ac-24.1_prm_3 }} that enforce access control decisions.
      parameters:
        ac-24.1_prm_1:
          label: "organization-defined access authorization information"
        ac-24.1_prm_2:
          label: "organization-defined controls"
        ac-24.1_prm_3:
          label: "organization-defined systems"
    ac-24.02:
      label: AC-24(2)
      parent_control: ac-24
      title: No User or Process Identity
      statement: |
        Enforce access control decisions based on {{ insert: param, ac-24.2_prm_1 }} that do not include the identity of the user or process acting on behalf of the user.
      parameters:
        ac-24.2_prm_1:
          label: "organization-defined security or privacy attributes"
    ac-25: 
      label: AC-25
      title: Reference Monitor
      statement: |
        Implement a reference monitor for {{ insert: param, ac-25_prm_1 }} that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.
      parameters:
        ac-25_prm_1:
          label: "organization-defined access control policies"
at:
  title: Awareness and Training
  controls:
    at-01: 
      label: AT-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, at-1_prm_1 }}:
          1.  {{ insert: param, at-1_prm_2 }} awareness and training policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;
        b. Designate an {{ insert: param, at-1_prm_3 }} to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and
        c. Review and update the current awareness and training:
          1. Policy {{ insert: param, at-1_prm_4 }} and following {{ insert: param, at-1_prm_5 }}; and
          2. Procedures {{ insert: param, at-1_prm_6 }} and following {{ insert: param, at-1_prm_7 }}.
      parameters:
        at-1_prm_1:
          label: "organization-defined personnel or roles"
        at-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        at-1_prm_3:
          label: "organization-defined official"
        at-1_prm_4:
          label: "organization-defined frequency"
        at-1_prm_5:
          label: "organization-defined events"
        at-1_prm_6:
          label: "organization-defined frequency"
        at-1_prm_7:
          label: "organization-defined events"
    at-02: 
      label: AT-2
      title: Literacy Training and Awareness
      statement: |
        a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):
          1. As part of initial training for new users and {{ insert: param, at-2_prm_1 }} thereafter; and
          2. When required by system changes or following {{ insert: param, at-2_prm_2 }};
        b. Employ the following techniques to increase the security and privacy awareness of system users {{ insert: param, at-2_prm_3 }};
        c. Update literacy training and awareness content {{ insert: param, at-2_prm_4 }} and following {{ insert: param, at-2_prm_5 }}; and
        d. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.
      parameters:
        at-2_prm_1:
          label: "organization-defined frequency"
        at-2_prm_2:
          label: "organization-defined events"
        at-2_prm_3:
          label: "organization-defined awareness techniques"
        at-2_prm_4:
          label: "organization-defined frequency"
        at-2_prm_5:
          label: "organization-defined events"
    at-02.01:
      label: AT-2(1)
      parent_control: at-02
      title: Practical Exercises
      statement: |
        Provide practical exercises in literacy training that simulate events and incidents.
    at-02.02:
      label: AT-2(2)
      parent_control: at-02
      title: Insider Threat
      statement: |
        Provide literacy training on recognizing and reporting potential indicators of insider threat.
    at-02.03:
      label: AT-2(3)
      parent_control: at-02
      title: Social Engineering and Mining
      statement: |
        Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.
    at-02.04:
      label: AT-2(4)
      parent_control: at-02
      title: Suspicious Communications and Anomalous System Behavior
      statement: |
        Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using {{ insert: param, at-2.4_prm_1 }}.
      parameters:
        at-2.4_prm_1:
          label: "organization-defined indicators of malicious code"
    at-02.05:
      label: AT-2(5)
      parent_control: at-02
      title: Advanced Persistent Threat
      statement: |
        Provide literacy training on the advanced persistent threat.
    at-02.06:
      label: AT-2(6)
      parent_control: at-02
      title: Cyber Threat Environment
      statement: |
        (a) Provide literacy training on the cyber threat environment; and
        (b) Reflect current cyber threat information in system operations.
    at-03: 
      label: AT-3
      title: Role-based Training
      statement: |
        a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: {{ insert: param, at-3_prm_1 }}:
          1. Before authorizing access to the system, information, or performing assigned duties, and {{ insert: param, at-3_prm_2 }} thereafter; and
          2. When required by system changes;
        b. Update role-based training content {{ insert: param, at-3_prm_3 }} and following {{ insert: param, at-3_prm_4 }}; and
        c. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.
      parameters:
        at-3_prm_1:
          label: "organization-defined roles and responsibilities"
        at-3_prm_2:
          label: "organization-defined frequency"
        at-3_prm_3:
          label: "organization-defined frequency"
        at-3_prm_4:
          label: "organization-defined events"
    at-03.01:
      label: AT-3(1)
      parent_control: at-03
      title: Environmental Controls
      statement: |
        Provide {{ insert: param, at-3.1_prm_1 }} with initial and {{ insert: param, at-3.1_prm_2 }} training in the employment and operation of environmental controls.
      parameters:
        at-3.1_prm_1:
          label: "organization-defined personnel or roles"
        at-3.1_prm_2:
          label: "organization-defined frequency"
    at-03.02:
      label: AT-3(2)
      parent_control: at-03
      title: Physical Security Controls
      statement: |
        Provide {{ insert: param, at-3.2_prm_1 }} with initial and {{ insert: param, at-3.2_prm_2 }} training in the employment and operation of physical security controls.
      parameters:
        at-3.2_prm_1:
          label: "organization-defined personnel or roles"
        at-3.2_prm_2:
          label: "organization-defined frequency"
    at-03.03:
      label: AT-3(3)
      parent_control: at-03
      title: Practical Exercises
      statement: |
        Provide practical exercises in security and privacy training that reinforce training objectives.
    at-03.05:
      label: AT-3(5)
      parent_control: at-03
      title: Processing Personally Identifiable Information
      statement: |
        Provide {{ insert: param, at-3.5_prm_1 }} with initial and {{ insert: param, at-3.5_prm_2 }} training in the employment and operation of personally identifiable information processing and transparency controls. 
      parameters:
        at-3.5_prm_1:
          label: "organization-defined personnel or roles"
        at-3.5_prm_2:
          label: "organization-defined frequency"
    at-04: 
      label: AT-4
      title: Training Records
      statement: |
        a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and
        b. Retain individual training records for {{ insert: param, at-4_prm_1 }}.
      parameters:
        at-4_prm_1:
          label: "organization-defined time period"
    at-06: 
      label: AT-6
      title: Training Feedback
      statement: |
        Provide feedback on organizational training results to the following personnel {{ insert: param, at-6_prm_1 }}: {{ insert: param, at-6_prm_2 }}.
      parameters:
        at-6_prm_1:
          label: "organization-defined frequency"
        at-6_prm_2:
          label: "organization-defined personnel"
au:
  title: Audit and Accountability
  controls:
    au-01: 
      label: AU-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, au-1_prm_1 }}:
          1.  {{ insert: param, au-1_prm_2 }} audit and accountability policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;
        b. Designate an {{ insert: param, au-1_prm_3 }} to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and
        c. Review and update the current audit and accountability:
          1. Policy {{ insert: param, au-1_prm_4 }} and following {{ insert: param, au-1_prm_5 }}; and
          2. Procedures {{ insert: param, au-1_prm_6 }} and following {{ insert: param, au-1_prm_7 }}.
      parameters:
        au-1_prm_1:
          label: "organization-defined personnel or roles"
        au-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        au-1_prm_3:
          label: "organization-defined official"
        au-1_prm_4:
          label: "organization-defined frequency"
        au-1_prm_5:
          label: "organization-defined events"
        au-1_prm_6:
          label: "organization-defined frequency"
        au-1_prm_7:
          label: "organization-defined events"
    au-02: 
      label: AU-2
      title: Event Logging
      statement: |
        a. Identify the types of events that the system is capable of logging in support of the audit function: {{ insert: param, au-2_prm_1 }};
        b. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
        c. Specify the following event types for logging within the system: {{ insert: param, au-2_prm_2 }};
        d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and
        e. Review and update the event types selected for logging {{ insert: param, au-2_prm_3 }}.
      parameters:
        au-2_prm_1:
          label: "organization-defined event types that the system is capable of logging"
        au-2_prm_2:
          label: "organization-defined event types (subset of the event types defined in [AU-2a.](#au-2_smt.a)) along with the frequency of (or situation requiring) logging for each identified event type"
        au-2_prm_3:
          label: "organization-defined frequency"
    au-03: 
      label: AU-3
      title: Content of Audit Records
      statement: |
        Ensure that audit records contain information that establishes the following:
          a. What type of event occurred;
          b. When the event occurred;
          c. Where the event occurred;
          d. Source of the event;
          e. Outcome of the event; and 
          f. Identity of any individuals, subjects, or objects/entities associated with the event.
    au-03.01:
      label: AU-3(1)
      parent_control: au-03
      title: Additional Audit Information
      statement: |
        Generate audit records containing the following additional information: {{ insert: param, au-3.1_prm_1 }}.
      parameters:
        au-3.1_prm_1:
          label: "organization-defined additional information"
    au-03.03:
      label: AU-3(3)
      parent_control: au-03
      title: Limit Personally Identifiable Information Elements
      statement: |
        Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: {{ insert: param, au-3.3_prm_1 }}.
      parameters:
        au-3.3_prm_1:
          label: "organization-defined elements"
    au-04: 
      label: AU-4
      title: Audit Log Storage Capacity
      statement: |
        Allocate audit log storage capacity to accommodate {{ insert: param, au-4_prm_1 }}.
      parameters:
        au-4_prm_1:
          label: "organization-defined audit log retention requirements"
    au-04.01:
      label: AU-4(1)
      parent_control: au-04
      title: Transfer to Alternate Storage
      statement: |
        Transfer audit logs {{ insert: param, au-4.1_prm_1 }} to a different system, system component, or media other than the system or system component conducting the logging.
      parameters:
        au-4.1_prm_1:
          label: "organization-defined frequency"
    au-05: 
      label: AU-5
      title: Response to Audit Logging Process Failures
      statement: |
        a. Alert {{ insert: param, au-5_prm_1 }} within {{ insert: param, au-5_prm_2 }} in the event of an audit logging process failure; and
        b. Take the following additional actions: {{ insert: param, au-5_prm_3 }}.
      parameters:
        au-5_prm_1:
          label: "organization-defined personnel or roles"
        au-5_prm_2:
          label: "organization-defined time period"
        au-5_prm_3:
          label: "organization-defined additional actions"
    au-05.01:
      label: AU-5(1)
      parent_control: au-05
      title: Storage Capacity Warning
      statement: |
        Provide a warning to {{ insert: param, au-5.1_prm_1 }} within {{ insert: param, au-5.1_prm_2 }} when allocated audit log storage volume reaches {{ insert: param, au-5.1_prm_3 }} of repository maximum audit log storage capacity.
      parameters:
        au-5.1_prm_1:
          label: "organization-defined personnel, roles, and/or locations"
        au-5.1_prm_2:
          label: "organization-defined time period"
        au-5.1_prm_3:
          label: "organization-defined percentage"
    au-05.02:
      label: AU-5(2)
      parent_control: au-05
      title: Real-time Alerts
      statement: |
        Provide an alert within {{ insert: param, au-5.2_prm_1 }} to {{ insert: param, au-5.2_prm_2 }} when the following audit failure events occur: {{ insert: param, au-5.2_prm_3 }}.
      parameters:
        au-5.2_prm_1:
          label: "organization-defined real-time period"
        au-5.2_prm_2:
          label: "organization-defined personnel, roles, and/or locations"
        au-5.2_prm_3:
          label: "organization-defined audit logging failure events requiring real-time alerts"
    au-05.03:
      label: AU-5(3)
      parent_control: au-05
      title: Configurable Traffic Volume Thresholds
      statement: |
        Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and {{ insert: param, au-5.3_prm_1 }} network traffic above those thresholds.
      parameters:
        au-5.3_prm_1:
          choice:
            - "reject"
            - "delay"
    au-05.04:
      label: AU-5(4)
      parent_control: au-05
      title: Shutdown on Failure
      statement: |
        Invoke a {{ insert: param, au-5.4_prm_1 }} in the event of {{ insert: param, au-5.4_prm_2 }}, unless an alternate audit logging capability exists.
      parameters:
        au-5.4_prm_1:
          choice:
            - "full system shutdown"
            - "partial system shutdown"
            - "degraded operational mode with limited mission or business functionality available"
        au-5.4_prm_2:
          label: "organization-defined audit logging failures"
    au-05.05:
      label: AU-5(5)
      parent_control: au-05
      title: Alternate Audit Logging Capability
      statement: |
        Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements {{ insert: param, au-5.5_prm_1 }}.
      parameters:
        au-5.5_prm_1:
          label: "organization-defined alternate audit logging functionality"
    au-06: 
      label: AU-6
      title: Audit Record Review, Analysis, and Reporting
      statement: |
        a. Review and analyze system audit records {{ insert: param, au-6_prm_1 }} for indications of {{ insert: param, au-6_prm_2 }} and the potential impact of the inappropriate or unusual activity;
        b. Report findings to {{ insert: param, au-6_prm_3 }}; and
        c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
      parameters:
        au-6_prm_1:
          label: "organization-defined frequency"
        au-6_prm_2:
          label: "organization-defined inappropriate or unusual activity"
        au-6_prm_3:
          label: "organization-defined personnel or roles"
    au-06.01:
      label: AU-6(1)
      parent_control: au-06
      title: Automated Process Integration
      statement: |
        Integrate audit record review, analysis, and reporting processes using {{ insert: param, au-6.1_prm_1 }}.
      parameters:
        au-6.1_prm_1:
          label: "organization-defined automated mechanisms"
    au-06.03:
      label: AU-6(3)
      parent_control: au-06
      title: Correlate Audit Record Repositories
      statement: |
        Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
    au-06.04:
      label: AU-6(4)
      parent_control: au-06
      title: Central Review and Analysis
      statement: |
        Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
    au-06.05:
      label: AU-6(5)
      parent_control: au-06
      title: Integrated Analysis of Audit Records
      statement: |
        Integrate analysis of audit records with analysis of {{ insert: param, au-6.5_prm_1 }} to further enhance the ability to identify inappropriate or unusual activity.
      parameters:
        au-6.5_prm_1:
          how-many: one or more
          choice:
            - "vulnerability scanning information"
            - "performance data"
            - "system monitoring information"
            - " {{ insert: param, au-6.5_prm_2 }} "
        au-6.5_prm_2:
          label: "organization-defined data/information collected from other sources"
    au-06.06:
      label: AU-6(6)
      parent_control: au-06
      title: Correlation with Physical Monitoring
      statement: |
        Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
    au-06.07:
      label: AU-6(7)
      parent_control: au-06
      title: Permitted Actions
      statement: |
        Specify the permitted actions for each {{ insert: param, au-6.7_prm_1 }} associated with the review, analysis, and reporting of audit record information.
      parameters:
        au-6.7_prm_1:
          how-many: one or more
          choice:
            - "system process"
            - "role"
            - "user"
    au-06.08:
      label: AU-6(8)
      parent_control: au-06
      title: Full Text Analysis of Privileged Commands
      statement: |
        Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.
    au-06.09:
      label: AU-6(9)
      parent_control: au-06
      title: Correlation with Information from Nontechnical Sources
      statement: |
        Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.
    au-07: 
      label: AU-7
      title: Audit Record Reduction and Report Generation
      statement: |
        Provide and implement an audit record reduction and report generation capability that:
          a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and
          b. Does not alter the original content or time ordering of audit records.
    au-07.01:
      label: AU-7(1)
      parent_control: au-07
      title: Automatic Processing
      statement: |
        Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: {{ insert: param, au-7.1_prm_1 }}.
      parameters:
        au-7.1_prm_1:
          label: "organization-defined fields within audit records"
    au-08: 
      label: AU-8
      title: Time Stamps
      statement: |
        a. Use internal system clocks to generate time stamps for audit records; and
        b. Record time stamps for audit records that meet {{ insert: param, au-8_prm_1 }} and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
      parameters:
        au-8_prm_1:
          label: "organization-defined granularity of time measurement"
    au-09: 
      label: AU-9
      title: Protection of Audit Information
      statement: |
        a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and
        b. Alert {{ insert: param, au-9_prm_1 }} upon detection of unauthorized access, modification, or deletion of audit information.
      parameters:
        au-9_prm_1:
          label: "organization-defined personnel or roles"
    au-09.01:
      label: AU-9(1)
      parent_control: au-09
      title: Hardware Write-once Media
      statement: |
        Write audit trails to hardware-enforced, write-once media.
    au-09.02:
      label: AU-9(2)
      parent_control: au-09
      title: Store on Separate Physical Systems or Components
      statement: |
        Store audit records {{ insert: param, au-9.2_prm_1 }} in a repository that is part of a physically different system or system component than the system or component being audited.
      parameters:
        au-9.2_prm_1:
          label: "organization-defined frequency"
    au-09.03:
      label: AU-9(3)
      parent_control: au-09
      title: Cryptographic Protection
      statement: |
        Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.
    au-09.04:
      label: AU-9(4)
      parent_control: au-09
      title: Access by Subset of Privileged Users
      statement: |
        Authorize access to management of audit logging functionality to only {{ insert: param, au-9.4_prm_1 }}.
      parameters:
        au-9.4_prm_1:
          label: "organization-defined subset of privileged users or roles"
    au-09.05:
      label: AU-9(5)
      parent_control: au-09
      title: Dual Authorization
      statement: |
        Enforce dual authorization for {{ insert: param, au-9.5_prm_1 }} of {{ insert: param, au-9.5_prm_2 }}.
      parameters:
        au-9.5_prm_1:
          how-many: one or more
          choice:
            - "movement"
            - "deletion"
        au-9.5_prm_2:
          label: "organization-defined audit information"
    au-09.06:
      label: AU-9(6)
      parent_control: au-09
      title: Read-only Access
      statement: |
        Authorize read-only access to audit information to {{ insert: param, au-9.6_prm_1 }}.
      parameters:
        au-9.6_prm_1:
          label: "organization-defined subset of privileged users or roles"
    au-09.07:
      label: AU-9(7)
      parent_control: au-09
      title: Store on Component with Different Operating System
      statement: |
        Store audit information on a component running a different operating system than the system or component being audited.
    au-10: 
      label: AU-10
      title: Non-repudiation
      statement: |
        Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed {{ insert: param, au-10_prm_1 }}.
      parameters:
        au-10_prm_1:
          label: "organization-defined actions to be covered by non-repudiation"
    au-10.01:
      label: AU-10(1)
      parent_control: au-10
      title: Association of Identities
      statement: |
        (a) Bind the identity of the information producer with the information to {{ insert: param, au-10.1_prm_1 }}; and
        (b) Provide the means for authorized individuals to determine the identity of the producer of the information.
      parameters:
        au-10.1_prm_1:
          label: "organization-defined strength of binding"
    au-10.02:
      label: AU-10(2)
      parent_control: au-10
      title: Validate Binding of Information Producer Identity
      statement: |
        (a) Validate the binding of the information producer identity to the information at {{ insert: param, au-10.2_prm_1 }}; and
        (b) Perform {{ insert: param, au-10.2_prm_2 }} in the event of a validation error.
      parameters:
        au-10.2_prm_1:
          label: "organization-defined frequency"
        au-10.2_prm_2:
          label: "organization-defined actions"
    au-10.03:
      label: AU-10(3)
      parent_control: au-10
      title: Chain of Custody
      statement: |
        Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released.
    au-10.04:
      label: AU-10(4)
      parent_control: au-10
      title: Validate Binding of Information Reviewer Identity
      statement: |
        (a) Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between {{ insert: param, au-10.4_prm_1 }}; and
        (b) Perform {{ insert: param, au-10.4_prm_2 }} in the event of a validation error.
      parameters:
        au-10.4_prm_1:
          label: "organization-defined security domains"
        au-10.4_prm_2:
          label: "organization-defined actions"
    au-11: 
      label: AU-11
      title: Audit Record Retention
      statement: |
        Retain audit records for {{ insert: param, au-11_prm_1 }} to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
      parameters:
        au-11_prm_1:
          label: "organization-defined time period consistent with records retention policy"
    au-11.01:
      label: AU-11(1)
      parent_control: au-11
      title: Long-term Retrieval Capability
      statement: |
        Employ {{ insert: param, au-11.1_prm_1 }} to ensure that long-term audit records generated by the system can be retrieved.
      parameters:
        au-11.1_prm_1:
          label: "organization-defined measures"
    au-12: 
      label: AU-12
      title: Audit Record Generation
      statement: |
        a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on {{ insert: param, au-12_prm_1 }};
        b. Allow {{ insert: param, au-12_prm_2 }} to select the event types that are to be logged by specific components of the system; and
        c. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).
      parameters:
        au-12_prm_1:
          label: "organization-defined system components"
        au-12_prm_2:
          label: "organization-defined personnel or roles"
    au-12.01:
      label: AU-12(1)
      parent_control: au-12
      title: System-wide and Time-correlated Audit Trail
      statement: |
        Compile audit records from {{ insert: param, au-12.1_prm_1 }} into a system-wide (logical or physical) audit trail that is time-correlated to within {{ insert: param, au-12.1_prm_2 }}.
      parameters:
        au-12.1_prm_1:
          label: "organization-defined system components"
        au-12.1_prm_2:
          label: "organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail"
    au-12.02:
      label: AU-12(2)
      parent_control: au-12
      title: Standardized Formats
      statement: |
        Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
    au-12.03:
      label: AU-12(3)
      parent_control: au-12
      title: Changes by Authorized Individuals
      statement: |
        Provide and implement the capability for {{ insert: param, au-12.3_prm_1 }} to change the logging to be performed on {{ insert: param, au-12.3_prm_2 }} based on {{ insert: param, au-12.3_prm_3 }} within {{ insert: param, au-12.3_prm_4 }}.
      parameters:
        au-12.3_prm_1:
          label: "organization-defined individuals or roles"
        au-12.3_prm_2:
          label: "organization-defined system components"
        au-12.3_prm_3:
          label: "organization-defined selectable event criteria"
        au-12.3_prm_4:
          label: "organization-defined time thresholds"
    au-12.04:
      label: AU-12(4)
      parent_control: au-12
      title: Query Parameter Audits of Personally Identifiable Information
      statement: |
        Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
    au-13: 
      label: AU-13
      title: Monitoring for Information Disclosure
      statement: |
        a. Monitor {{ insert: param, au-13_prm_1 }} {{ insert: param, au-13_prm_2 }} for evidence of unauthorized disclosure of organizational information; and
        b. If an information disclosure is discovered:
          1. Notify {{ insert: param, au-13_prm_3 }}; and 
          2. Take the following additional actions: {{ insert: param, au-13_prm_4 }}.
      parameters:
        au-13_prm_1:
          label: "organization-defined open-source information and/or information sites"
        au-13_prm_2:
          label: "organization-defined frequency"
        au-13_prm_3:
          label: "organization-defined personnel or roles"
        au-13_prm_4:
          label: "organization-defined additional actions"
    au-13.01:
      label: AU-13(1)
      parent_control: au-13
      title: Use of Automated Tools
      statement: |
        Monitor open-source information and information sites using {{ insert: param, au-13.1_prm_1 }}.
      parameters:
        au-13.1_prm_1:
          label: "organization-defined automated mechanisms"
    au-13.02:
      label: AU-13(2)
      parent_control: au-13
      title: Review of Monitored Sites
      statement: |
        Review the list of open-source information sites being monitored {{ insert: param, au-13.2_prm_1 }}.
      parameters:
        au-13.2_prm_1:
          label: "organization-defined frequency"
    au-13.03:
      label: AU-13(3)
      parent_control: au-13
      title: Unauthorized Replication of Information
      statement: |
        Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.
    au-14: 
      label: AU-14
      title: Session Audit
      statement: |
        a. Provide and implement the capability for {{ insert: param, au-14_prm_1 }} to {{ insert: param, au-14_prm_2 }} the content of a user session under {{ insert: param, au-14_prm_3 }}; and
        b. Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
      parameters:
        au-14_prm_1:
          label: "organization-defined users or roles"
        au-14_prm_2:
          how-many: one or more
          choice:
            - "record"
            - "view"
            - "hear"
            - "log"
        au-14_prm_3:
          label: "organization-defined circumstances"
    au-14.01:
      label: AU-14(1)
      parent_control: au-14
      title: System Start-up
      statement: |
        Initiate session audits automatically at system start-up.
    au-14.03:
      label: AU-14(3)
      parent_control: au-14
      title: Remote Viewing and Listening
      statement: |
        Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.
    au-16: 
      label: AU-16
      title: Cross-organizational Audit Logging
      statement: |
        Employ {{ insert: param, au-16_prm_1 }} for coordinating {{ insert: param, au-16_prm_2 }} among external organizations when audit information is transmitted across organizational boundaries.
      parameters:
        au-16_prm_1:
          label: "organization-defined methods"
        au-16_prm_2:
          label: "organization-defined audit information"
    au-16.01:
      label: AU-16(1)
      parent_control: au-16
      title: Identity Preservation
      statement: |
        Preserve the identity of individuals in cross-organizational audit trails.
    au-16.02:
      label: AU-16(2)
      parent_control: au-16
      title: Sharing of Audit Information
      statement: |
        Provide cross-organizational audit information to {{ insert: param, au-16.2_prm_1 }} based on {{ insert: param, au-16.2_prm_2 }}.
      parameters:
        au-16.2_prm_1:
          label: "organization-defined organizations"
        au-16.2_prm_2:
          label: "organization-defined cross-organizational sharing agreements"
    au-16.03:
      label: AU-16(3)
      parent_control: au-16
      title: Disassociability
      statement: |
        Implement {{ insert: param, au-16.3_prm_1 }} to disassociate individuals from audit information transmitted across organizational boundaries.
      parameters:
        au-16.3_prm_1:
          label: "organization-defined measures"
ca:
  title: Assessment, Authorization, and Monitoring
  controls:
    ca-01: 
      label: CA-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, ca-1_prm_1 }}:
          1.  {{ insert: param, ca-1_prm_2 }} assessment, authorization, and monitoring policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;
        b. Designate an {{ insert: param, ca-1_prm_3 }} to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and
        c. Review and update the current assessment, authorization, and monitoring:
          1. Policy {{ insert: param, ca-1_prm_4 }} and following {{ insert: param, ca-1_prm_5 }}; and
          2. Procedures {{ insert: param, ca-1_prm_6 }} and following {{ insert: param, ca-1_prm_7 }}.
      parameters:
        ca-1_prm_1:
          label: "organization-defined personnel or roles"
        ca-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        ca-1_prm_3:
          label: "organization-defined official"
        ca-1_prm_4:
          label: "organization-defined frequency"
        ca-1_prm_5:
          label: "organization-defined events"
        ca-1_prm_6:
          label: "organization-defined frequency"
        ca-1_prm_7:
          label: "organization-defined events"
    ca-02: 
      label: CA-2
      title: Control Assessments
      statement: |
        a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;
        b. Develop a control assessment plan that describes the scope of the assessment including:
          1. Controls and control enhancements under assessment;
          2. Assessment procedures to be used to determine control effectiveness; and
          3. Assessment environment, assessment team, and assessment roles and responsibilities;
        c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
        d. Assess the controls in the system and its environment of operation {{ insert: param, ca-2_prm_1 }} to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
        e. Produce a control assessment report that document the results of the assessment; and
        f. Provide the results of the control assessment to {{ insert: param, ca-2_prm_2 }}.
      parameters:
        ca-2_prm_1:
          label: "organization-defined frequency"
        ca-2_prm_2:
          label: "organization-defined individuals or roles"
    ca-02.01:
      label: CA-2(1)
      parent_control: ca-02
      title: Independent Assessors
      statement: |
        Employ independent assessors or assessment teams to conduct control assessments.
    ca-02.02:
      label: CA-2(2)
      parent_control: ca-02
      title: Specialized Assessments
      statement: |
        Include as part of control assessments, {{ insert: param, ca-2.2_prm_1 }}, {{ insert: param, ca-2.2_prm_2 }}, {{ insert: param, ca-2.2_prm_3 }}.
      parameters:
        ca-2.2_prm_1:
          label: "organization-defined frequency"
        ca-2.2_prm_2:
          choice:
            - "announced"
            - "unannounced"
        ca-2.2_prm_3:
          how-many: one or more
          choice:
            - "in-depth monitoring"
            - "security instrumentation"
            - "automated security test cases"
            - "vulnerability scanning"
            - "malicious user testing"
            - "insider threat assessment"
            - "performance and load testing"
            - "data leakage or data loss assessment"
            - " {{ insert: param, ca-2.2_prm_4 }} "
        ca-2.2_prm_4:
          label: "organization-defined other forms of assessment"
    ca-02.03:
      label: CA-2(3)
      parent_control: ca-02
      title: Leveraging Results from External Organizations
      statement: |
        Leverage the results of control assessments performed by {{ insert: param, ca-2.3_prm_1 }} on {{ insert: param, ca-2.3_prm_2 }} when the assessment meets {{ insert: param, ca-2.3_prm_3 }}.
      parameters:
        ca-2.3_prm_1:
          label: "organization-defined external organization"
        ca-2.3_prm_2:
          label: "organization-defined system"
        ca-2.3_prm_3:
          label: "organization-defined requirements"
    ca-03: 
      label: CA-3
      title: Information Exchange
      statement: |
        a. Approve and manage the exchange of information between the system and other systems using {{ insert: param, ca-3_prm_1 }};
        b. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and
        c. Review and update the agreements {{ insert: param, ca-3_prm_3 }}.
      parameters:
        ca-3_prm_1:
          how-many: one or more
          choice:
            - "interconnection security agreements"
            - "information exchange security agreements"
            - "memoranda of understanding or agreement"
            - "service level agreements"
            - "user agreements"
            - "nondisclosure agreements"
            - " {{ insert: param, ca-3_prm_2 }} "
        ca-3_prm_2:
          label: "organization-defined type of agreement"
        ca-3_prm_3:
          label: "organization-defined frequency"
    ca-03.06:
      label: CA-3(6)
      parent_control: ca-03
      title: Transfer Authorizations
      statement: |
        Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
    ca-03.07:
      label: CA-3(7)
      parent_control: ca-03
      title: Transitive Information Exchanges
      statement: |
        (a) Identify transitive (downstream) information exchanges with other systems through the systems identified in [CA-3a](#ca-3_smt.a); and
        (b) Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated. 
    ca-05: 
      label: CA-5
      title: Plan of Action and Milestones
      statement: |
        a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
        b. Update existing plan of action and milestones {{ insert: param, ca-5_prm_1 }} based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
      parameters:
        ca-5_prm_1:
          label: "organization-defined frequency"
    ca-05.01:
      label: CA-5(1)
      parent_control: ca-05
      title: Automation Support for Accuracy and Currency
      statement: |
        Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using {{ insert: param, ca-5.1_prm_1 }}.
      parameters:
        ca-5.1_prm_1:
          label: "organization-defined automated mechanisms"
    ca-06: 
      label: CA-6
      title: Authorization
      statement: |
        a. Assign a senior official as the authorizing official for the system;
        b. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;
        c. Ensure that the authorizing official for the system, before commencing operations:
          1. Accepts the use of common controls inherited by the system; and
          2. Authorizes the system to operate;
        d. Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
        e. Update the authorizations {{ insert: param, ca-6_prm_1 }}.
      parameters:
        ca-6_prm_1:
          label: "organization-defined frequency"
    ca-06.01:
      label: CA-6(1)
      parent_control: ca-06
      title: Joint Authorization — Intra-organization
      statement: |
        Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.
    ca-06.02:
      label: CA-6(2)
      parent_control: ca-06
      title: Joint Authorization — Inter-organization
      statement: |
        Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.
    ca-07: 
      label: CA-7
      title: Continuous Monitoring
      statement: |
        Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:
          a. Establishing the following system-level metrics to be monitored: {{ insert: param, ca-7_prm_1 }};
          b. Establishing {{ insert: param, ca-7_prm_2 }} for monitoring and {{ insert: param, ca-7_prm_3 }} for assessment of control effectiveness;
          c. Ongoing control assessments in accordance with the continuous monitoring strategy;
          d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
          e. Correlation and analysis of information generated by control assessments and monitoring;
          f. Response actions to address results of the analysis of control assessment and monitoring information; and
          g. Reporting the security and privacy status of the system to {{ insert: param, ca-7_prm_4 }} {{ insert: param, ca-7_prm_5 }}.
      parameters:
        ca-7_prm_1:
          label: "organization-defined system-level metrics"
        ca-7_prm_2:
          label: "organization-defined frequencies"
        ca-7_prm_3:
          label: "organization-defined frequencies"
        ca-7_prm_4:
          label: "organization-defined personnel or roles"
        ca-7_prm_5:
          label: "organization-defined frequency"
    ca-07.01:
      label: CA-7(1)
      parent_control: ca-07
      title: Independent Assessment
      statement: |
        Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
    ca-07.03:
      label: CA-7(3)
      parent_control: ca-07
      title: Trend Analyses
      statement: |
        Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.
    ca-07.04:
      label: CA-7(4)
      parent_control: ca-07
      title: Risk Monitoring
      statement: |
        Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following:
          (a) Effectiveness monitoring;
          (b) Compliance monitoring; and
          (c) Change monitoring.
    ca-07.05:
      label: CA-7(5)
      parent_control: ca-07
      title: Consistency Analysis
      statement: |
        Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: {{ insert: param, ca-7.5_prm_1 }}.
      parameters:
        ca-7.5_prm_1:
          label: "organization-defined actions"
    ca-07.06:
      label: CA-7(6)
      parent_control: ca-07
      title: Automation Support for Monitoring
      statement: |
        Ensure the accuracy, currency, and availability of monitoring results for the system using {{ insert: param, ca-7.6_prm_1 }}.
      parameters:
        ca-7.6_prm_1:
          label: "organization-defined automated mechanisms"
    ca-08: 
      label: CA-8
      title: Penetration Testing
      statement: |
        Conduct penetration testing {{ insert: param, ca-8_prm_1 }} on {{ insert: param, ca-8_prm_2 }}.
      parameters:
        ca-8_prm_1:
          label: "organization-defined frequency"
        ca-8_prm_2:
          label: "organization-defined systems or system components"
    ca-08.01:
      label: CA-8(1)
      parent_control: ca-08
      title: Independent Penetration Testing Agent or Team
      statement: |
        Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.
    ca-08.02:
      label: CA-8(2)
      parent_control: ca-08
      title: Red Team Exercises
      statement: |
        Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: {{ insert: param, ca-8.2_prm_1 }}.
      parameters:
        ca-8.2_prm_1:
          label: "organization-defined red team exercises"
    ca-08.03:
      label: CA-8(3)
      parent_control: ca-08
      title: Facility Penetration Testing
      statement: |
        Employ a penetration testing process that includes {{ insert: param, ca-8.3_prm_1 }} {{ insert: param, ca-8.3_prm_2 }} attempts to bypass or circumvent controls associated with physical access points to the facility.
      parameters:
        ca-8.3_prm_1:
          label: "organization-defined frequency"
        ca-8.3_prm_2:
          choice:
            - "announced"
            - "unannounced"
    ca-09: 
      label: CA-9
      title: Internal System Connections
      statement: |
        a. Authorize internal connections of {{ insert: param, ca-9_prm_1 }} to the system;
        b. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;
        c. Terminate internal system connections after {{ insert: param, ca-9_prm_2 }}; and
        d. Review {{ insert: param, ca-9_prm_3 }} the continued need for each internal connection.
      parameters:
        ca-9_prm_1:
          label: "organization-defined system components or classes of components"
        ca-9_prm_2:
          label: "organization-defined conditions"
        ca-9_prm_3:
          label: "organization-defined frequency"
    ca-09.01:
      label: CA-9(1)
      parent_control: ca-09
      title: Compliance Checks
      statement: |
        Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection.
cm:
  title: Configuration Management
  controls:
    cm-01: 
      label: CM-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, cm-1_prm_1 }}:
          1.  {{ insert: param, cm-1_prm_2 }} configuration management policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the configuration management policy and the associated configuration management controls;
        b. Designate an {{ insert: param, cm-1_prm_3 }} to manage the development, documentation, and dissemination of the configuration management policy and procedures; and
        c. Review and update the current configuration management:
          1. Policy {{ insert: param, cm-1_prm_4 }} and following {{ insert: param, cm-1_prm_5 }}; and
          2. Procedures {{ insert: param, cm-1_prm_6 }} and following {{ insert: param, cm-1_prm_7 }}.
      parameters:
        cm-1_prm_1:
          label: "organization-defined personnel or roles"
        cm-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        cm-1_prm_3:
          label: "organization-defined official"
        cm-1_prm_4:
          label: "organization-defined frequency"
        cm-1_prm_5:
          label: "organization-defined events"
        cm-1_prm_6:
          label: "organization-defined frequency"
        cm-1_prm_7:
          label: "organization-defined events"
    cm-02: 
      label: CM-2
      title: Baseline Configuration
      statement: |
        a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and
        b. Review and update the baseline configuration of the system:
          1.  {{ insert: param, cm-2_prm_1 }};
          2. When required due to {{ insert: param, cm-2_prm_2 }}; and
          3. When system components are installed or upgraded.
      parameters:
        cm-2_prm_1:
          label: "organization-defined frequency"
        cm-2_prm_2:
          label: "organization-defined circumstances"
    cm-02.02:
      label: CM-2(2)
      parent_control: cm-02
      title: Automation Support for Accuracy and Currency
      statement: |
        Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using {{ insert: param, cm-2.2_prm_1 }}.
      parameters:
        cm-2.2_prm_1:
          label: "organization-defined automated mechanisms"
    cm-02.03:
      label: CM-2(3)
      parent_control: cm-02
      title: Retention of Previous Configurations
      statement: |
        Retain {{ insert: param, cm-2.3_prm_1 }} of previous versions of baseline configurations of the system to support rollback.
      parameters:
        cm-2.3_prm_1:
          label: "organization-defined number"
    cm-02.06:
      label: CM-2(6)
      parent_control: cm-02
      title: Development and Test Environments
      statement: |
        Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.
    cm-02.07:
      label: CM-2(7)
      parent_control: cm-02
      title: Configure Systems and Components for High-risk Areas
      statement: |
        (a) Issue {{ insert: param, cm-2.7_prm_1 }} with {{ insert: param, cm-2.7_prm_2 }} to individuals traveling to locations that the organization deems to be of significant risk; and
        (b) Apply the following controls to the systems or components when the individuals return from travel: {{ insert: param, cm-2.7_prm_3 }}.
      parameters:
        cm-2.7_prm_1:
          label: "organization-defined systems or system components"
        cm-2.7_prm_2:
          label: "organization-defined configurations"
        cm-2.7_prm_3:
          label: "organization-defined controls"
    cm-03: 
      label: CM-3
      title: Configuration Change Control
      statement: |
        a. Determine and document the types of changes to the system that are configuration-controlled;
        b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;
        c. Document configuration change decisions associated with the system;
        d. Implement approved configuration-controlled changes to the system;
        e. Retain records of configuration-controlled changes to the system for {{ insert: param, cm-3_prm_1 }};
        f. Monitor and review activities associated with configuration-controlled changes to the system; and
        g. Coordinate and provide oversight for configuration change control activities through {{ insert: param, cm-3_prm_2 }} that convenes {{ insert: param, cm-3_prm_3 }}.
      parameters:
        cm-3_prm_1:
          label: "organization-defined time period"
        cm-3_prm_2:
          label: "organization-defined configuration change control element"
        cm-3_prm_3:
          how-many: one or more
          choice:
            - " {{ insert: param, cm-3_prm_4 }} "
            - "when {{ insert: param, cm-3_prm_5 }} "
        cm-3_prm_4:
          label: "organization-defined frequency"
        cm-3_prm_5:
          label: "organization-defined configuration change conditions"
    cm-03.01:
      label: CM-3(1)
      parent_control: cm-03
      title: Automated Documentation, Notification, and Prohibition of Changes
      statement: |
        Use {{ insert: param, cm-3.1_prm_1 }} to:
          (a) Document proposed changes to the system;
          (b) Notify {{ insert: param, cm-3.1_prm_2 }} of proposed changes to the system and request change approval;
          (c) Highlight proposed changes to the system that have not been approved or disapproved within {{ insert: param, cm-3.1_prm_3 }};
          (d) Prohibit changes to the system until designated approvals are received;
          (e) Document all changes to the system; and
          (f) Notify {{ insert: param, cm-3.1_prm_4 }} when approved changes to the system are completed.
      parameters:
        cm-3.1_prm_1:
          label: "organization-defined automated mechanisms"
        cm-3.1_prm_2:
          label: "organization-defined approval authorities"
        cm-3.1_prm_3:
          label: "organization-defined time period"
        cm-3.1_prm_4:
          label: "organization-defined personnel"
    cm-03.02:
      label: CM-3(2)
      parent_control: cm-03
      title: Testing, Validation, and Documentation of Changes
      statement: |
        Test, validate, and document changes to the system before finalizing the implementation of the changes.
    cm-03.03:
      label: CM-3(3)
      parent_control: cm-03
      title: Automated Change Implementation
      statement: |
        Implement changes to the current system baseline and deploy the updated baseline across the installed base using {{ insert: param, cm-3.3_prm_1 }}.
      parameters:
        cm-3.3_prm_1:
          label: "organization-defined automated mechanisms"
    cm-03.04:
      label: CM-3(4)
      parent_control: cm-03
      title: Security and Privacy Representatives
      statement: |
        Require {{ insert: param, cm-3.4_prm_1 }} to be members of the {{ insert: param, cm-3.4_prm_2 }}.
      parameters:
        cm-3.4_prm_1:
          label: "organization-defined security and privacy representatives"
        cm-3.4_prm_2:
          label: "organization-defined configuration change control element"
    cm-03.05:
      label: CM-3(5)
      parent_control: cm-03
      title: Automated Security Response
      statement: |
        Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: {{ insert: param, cm-3.5_prm_1 }}.
      parameters:
        cm-3.5_prm_1:
          label: "organization-defined security responses"
    cm-03.06:
      label: CM-3(6)
      parent_control: cm-03
      title: Cryptography Management
      statement: |
        Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: {{ insert: param, cm-3.6_prm_1 }}.
      parameters:
        cm-3.6_prm_1:
          label: "organization-defined controls"
    cm-03.07:
      label: CM-3(7)
      parent_control: cm-03
      title: Review System Changes
      statement: |
        Review changes to the system {{ insert: param, cm-3.7_prm_1 }} or when {{ insert: param, cm-3.7_prm_2 }} to determine whether unauthorized changes have occurred.
      parameters:
        cm-3.7_prm_1:
          label: "organization-defined frequency"
        cm-3.7_prm_2:
          label: "organization-defined circumstances"
    cm-03.08:
      label: CM-3(8)
      parent_control: cm-03
      title: Prevent or Restrict Configuration Changes
      statement: |
        Prevent or restrict changes to the configuration of the system under the following circumstances: {{ insert: param, cm-3.8_prm_1 }}.
      parameters:
        cm-3.8_prm_1:
          label: "organization-defined circumstances"
    cm-04: 
      label: CM-4
      title: Impact Analyses
      statement: |
        Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.
    cm-04.01:
      label: CM-4(1)
      parent_control: cm-04
      title: Separate Test Environments
      statement: |
        Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.
    cm-04.02:
      label: CM-4(2)
      parent_control: cm-04
      title: Verification of Controls
      statement: |
        After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system.
    cm-05: 
      label: CM-5
      title: Access Restrictions for Change
      statement: |
        Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system. 
    cm-05.01:
      label: CM-5(1)
      parent_control: cm-05
      title: Automated Access Enforcement and Audit Records
      statement: |
        (a) Enforce access restrictions using {{ insert: param, cm-5.1_prm_1 }}; and 
        (b) Automatically generate audit records of the enforcement actions.
      parameters:
        cm-5.1_prm_1:
          label: "organization-defined automated mechanisms"
    cm-05.04:
      label: CM-5(4)
      parent_control: cm-05
      title: Dual Authorization
      statement: |
        Enforce dual authorization for implementing changes to {{ insert: param, cm-5.4_prm_1 }}.
      parameters:
        cm-5.4_prm_1:
          label: "organization-defined system components and system-level information"
    cm-05.05:
      label: CM-5(5)
      parent_control: cm-05
      title: Privilege Limitation for Production and Operation
      statement: |
        (a) Limit privileges to change system components and system-related information within a production or operational environment; and
        (b) Review and reevaluate privileges {{ insert: param, cm-5.5_prm_1 }}.
      parameters:
        cm-5.5_prm_1:
          label: "organization-defined frequency"
    cm-05.06:
      label: CM-5(6)
      parent_control: cm-05
      title: Limit Library Privileges
      statement: |
        Limit privileges to change software resident within software libraries.
    cm-06: 
      label: CM-6
      title: Configuration Settings
      statement: |
        a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using {{ insert: param, cm-6_prm_1 }};
        b. Implement the configuration settings;
        c. Identify, document, and approve any deviations from established configuration settings for {{ insert: param, cm-6_prm_2 }} based on {{ insert: param, cm-6_prm_3 }}; and
        d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.
      parameters:
        cm-6_prm_1:
          label: "organization-defined common secure configurations"
        cm-6_prm_2:
          label: "organization-defined system components"
        cm-6_prm_3:
          label: "organization-defined operational requirements"
    cm-06.01:
      label: CM-6(1)
      parent_control: cm-06
      title: Automated Management, Application, and Verification
      statement: |
        Manage, apply, and verify configuration settings for {{ insert: param, cm-6.1_prm_1 }} using {{ insert: param, cm-6.1_prm_2 }}.
      parameters:
        cm-6.1_prm_1:
          label: "organization-defined system components"
        cm-6.1_prm_2:
          label: "organization-defined automated mechanisms"
    cm-06.02:
      label: CM-6(2)
      parent_control: cm-06
      title: Respond to Unauthorized Changes
      statement: |
        Take the following actions in response to unauthorized changes to {{ insert: param, cm-6.2_prm_1 }}: {{ insert: param, cm-6.2_prm_2 }}.
      parameters:
        cm-6.2_prm_1:
          label: "organization-defined configuration settings"
        cm-6.2_prm_2:
          label: "organization-defined actions"
    cm-07: 
      label: CM-7
      title: Least Functionality
      statement: |
        a. Configure the system to provide only {{ insert: param, cm-7_prm_1 }}; and
        b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: {{ insert: param, cm-7_prm_2 }}.
      parameters:
        cm-7_prm_1:
          label: "organization-defined mission essential capabilities"
        cm-7_prm_2:
          label: "organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services"
    cm-07.01:
      label: CM-7(1)
      parent_control: cm-07
      title: Periodic Review
      statement: |
        (a) Review the system {{ insert: param, cm-7.1_prm_1 }} to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and
        (b) Disable or remove {{ insert: param, cm-7.1_prm_2 }}.
      parameters:
        cm-7.1_prm_1:
          label: "organization-defined frequency"
        cm-7.1_prm_2:
          label: "organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure"
    cm-07.02:
      label: CM-7(2)
      parent_control: cm-07
      title: Prevent Program Execution
      statement: |
        Prevent program execution in accordance with {{ insert: param, cm-7.2_prm_1 }}.
      parameters:
        cm-7.2_prm_1:
          how-many: one or more
          choice:
            - " {{ insert: param, cm-7.2_prm_2 }} "
            - "rules authorizing the terms and conditions of software program usage"
        cm-7.2_prm_2:
          label: "organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions"
    cm-07.03:
      label: CM-7(3)
      parent_control: cm-07
      title: Registration Compliance
      statement: |
        Ensure compliance with {{ insert: param, cm-7.3_prm_1 }}.
      parameters:
        cm-7.3_prm_1:
          label: "organization-defined registration requirements for functions, ports, protocols, and services"
    cm-07.04:
      label: CM-7(4)
      parent_control: cm-07
      title: Unauthorized Software — Deny-by-exception
      statement: |
        (a) Identify {{ insert: param, cm-7.4_prm_1 }};
        (b) Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and
        (c) Review and update the list of unauthorized software programs {{ insert: param, cm-7.4_prm_2 }}.
      parameters:
        cm-7.4_prm_1:
          label: "organization-defined software programs not authorized to execute on the system"
        cm-7.4_prm_2:
          label: "organization-defined frequency"
    cm-07.05:
      label: CM-7(5)
      parent_control: cm-07
      title: Authorized Software — Allow-by-exception
      statement: |
        (a) Identify {{ insert: param, cm-7.5_prm_1 }};
        (b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and
        (c) Review and update the list of authorized software programs {{ insert: param, cm-7.5_prm_2 }}.
      parameters:
        cm-7.5_prm_1:
          label: "organization-defined software programs authorized to execute on the system"
        cm-7.5_prm_2:
          label: "organization-defined frequency"
    cm-07.06:
      label: CM-7(6)
      parent_control: cm-07
      title: Confined Environments with Limited Privileges
      statement: |
        Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: {{ insert: param, cm-7.6_prm_1 }}. 
      parameters:
        cm-7.6_prm_1:
          label: "organization-defined user-installed software"
    cm-07.07:
      label: CM-7(7)
      parent_control: cm-07
      title: Code Execution in Protected Environments
      statement: |
        Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of {{ insert: param, cm-7.7_prm_1 }} when such code is:
          (a) Obtained from sources with limited or no warranty; and/or
          (b) Without the provision of source code.
      parameters:
        cm-7.7_prm_1:
          label: "organization-defined personnel or roles"
    cm-07.08:
      label: CM-7(8)
      parent_control: cm-07
      title: Binary or Machine Executable Code
      statement: |
        (a) Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and
        (b) Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.
    cm-07.09:
      label: CM-7(9)
      parent_control: cm-07
      title: Prohibiting The Use of Unauthorized Hardware
      statement: |
        (a) Identify {{ insert: param, cm-7.9_prm_1 }};
        (b) Prohibit the use or connection of unauthorized hardware components; 
        (c) Review and update the list of authorized hardware components {{ insert: param, cm-7.9_prm_2 }}.
      parameters:
        cm-7.9_prm_1:
          label: "organization-defined hardware components authorized for system use"
        cm-7.9_prm_2:
          label: "organization-defined frequency"
    cm-08: 
      label: CM-8
      title: System Component Inventory
      statement: |
        a. Develop and document an inventory of system components that:
          1. Accurately reflects the system;
          2. Includes all components within the system;
          3. Does not include duplicate accounting of components or components assigned to any other system;
          4. Is at the level of granularity deemed necessary for tracking and reporting; and
          5. Includes the following information to achieve system component accountability: {{ insert: param, cm-8_prm_1 }}; and
        b. Review and update the system component inventory {{ insert: param, cm-8_prm_2 }}.
      parameters:
        cm-8_prm_1:
          label: "organization-defined information deemed necessary to achieve effective system component accountability"
        cm-8_prm_2:
          label: "organization-defined frequency"
    cm-08.01:
      label: CM-8(1)
      parent_control: cm-08
      title: Updates During Installation and Removal
      statement: |
        Update the inventory of system components as part of component installations, removals, and system updates.
    cm-08.02:
      label: CM-8(2)
      parent_control: cm-08
      title: Automated Maintenance
      statement: |
        Maintain the currency, completeness, accuracy, and availability of the inventory of system components using {{ insert: param, cm-8.2_prm_1 }}.
      parameters:
        cm-8.2_prm_1:
          label: "organization-defined automated mechanisms"
    cm-08.03:
      label: CM-8(3)
      parent_control: cm-08
      title: Automated Unauthorized Component Detection
      statement: |
        (a) Detect the presence of unauthorized hardware, software, and firmware components within the system using {{ insert: param, cm-8.3_prm_1 }} {{ insert: param, cm-8.3_prm_2 }}; and
        (b) Take the following actions when unauthorized components are detected: {{ insert: param, cm-8.3_prm_3 }}.
      parameters:
        cm-8.3_prm_1:
          label: "organization-defined automated mechanisms"
        cm-8.3_prm_2:
          label: "organization-defined frequency"
        cm-8.3_prm_3:
          how-many: one or more
          choice:
            - "disable network access by such components"
            - "isolate the components"
            - "notify {{ insert: param, cm-8.3_prm_4 }} "
        cm-8.3_prm_4:
          label: "organization-defined personnel or roles"
    cm-08.04:
      label: CM-8(4)
      parent_control: cm-08
      title: Accountability Information
      statement: |
        Include in the system component inventory information, a means for identifying by {{ insert: param, cm-8.4_prm_1 }}, individuals responsible and accountable for administering those components.
      parameters:
        cm-8.4_prm_1:
          how-many: one or more
          choice:
            - "name"
            - "position"
            - "role"
    cm-08.06:
      label: CM-8(6)
      parent_control: cm-08
      title: Assessed Configurations and Approved Deviations
      statement: |
        Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.
    cm-08.07:
      label: CM-8(7)
      parent_control: cm-08
      title: Centralized Repository
      statement: |
        Provide a centralized repository for the inventory of system components.
    cm-08.08:
      label: CM-8(8)
      parent_control: cm-08
      title: Automated Location Tracking
      statement: |
        Support the tracking of system components by geographic location using {{ insert: param, cm-8.8_prm_1 }}.
      parameters:
        cm-8.8_prm_1:
          label: "organization-defined automated mechanisms"
    cm-08.09:
      label: CM-8(9)
      parent_control: cm-08
      title: Assignment of Components to Systems
      statement: |
        (a) Assign system components to a system; and 
        (b) Receive an acknowledgement from {{ insert: param, cm-8.9_prm_1 }} of this assignment.
      parameters:
        cm-8.9_prm_1:
          label: "organization-defined personnel or roles"
    cm-09: 
      label: CM-9
      title: Configuration Management Plan
      statement: |
        Develop, document, and implement a configuration management plan for the system that:
          a. Addresses roles, responsibilities, and configuration management processes and procedures;
          b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;
          c. Defines the configuration items for the system and places the configuration items under configuration management;
          d. Is reviewed and approved by {{ insert: param, cm-9_prm_1 }}; and
          e. Protects the configuration management plan from unauthorized disclosure and modification. 
      parameters:
        cm-9_prm_1:
          label: "organization-defined personnel or roles"
    cm-09.01:
      label: CM-9(1)
      parent_control: cm-09
      title: Assignment of Responsibility
      statement: |
        Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.
    cm-10: 
      label: CM-10
      title: Software Usage Restrictions
      statement: |
        a. Use software and associated documentation in accordance with contract agreements and copyright laws;
        b. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and
        c. Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
    cm-10.01:
      label: CM-10(1)
      parent_control: cm-10
      title: Open-source Software
      statement: |
        Establish the following restrictions on the use of open-source software: {{ insert: param, cm-10.1_prm_1 }}.
      parameters:
        cm-10.1_prm_1:
          label: "organization-defined restrictions"
    cm-11: 
      label: CM-11
      title: User-installed Software
      statement: |
        a. Establish {{ insert: param, cm-11_prm_1 }} governing the installation of software by users;
        b. Enforce software installation policies through the following methods: {{ insert: param, cm-11_prm_2 }}; and
        c. Monitor policy compliance {{ insert: param, cm-11_prm_3 }}.
      parameters:
        cm-11_prm_1:
          label: "organization-defined policies"
        cm-11_prm_2:
          label: "organization-defined methods"
        cm-11_prm_3:
          label: "organization-defined frequency"
    cm-11.02:
      label: CM-11(2)
      parent_control: cm-11
      title: Software Installation with Privileged Status
      statement: |
        Allow user installation of software only with explicit privileged status.
    cm-11.03:
      label: CM-11(3)
      parent_control: cm-11
      title: Automated Enforcement and Monitoring
      statement: |
        Enforce and monitor compliance with software installation policies using {{ insert: param, cm-11.3_prm_1 }}.
      parameters:
        cm-11.3_prm_1:
          label: "organization-defined automated mechanisms"
    cm-12: 
      label: CM-12
      title: Information Location
      statement: |
        a. Identify and document the location of {{ insert: param, cm-12_prm_1 }} and the specific system components on which the information is processed and stored;
        b. Identify and document the users who have access to the system and system components where the information is processed and stored; and
        c. Document changes to the location (i.e., system or system components) where the information is processed and stored.
      parameters:
        cm-12_prm_1:
          label: "organization-defined information"
    cm-12.01:
      label: CM-12(1)
      parent_control: cm-12
      title: Automated Tools to Support Information Location
      statement: |
        Use automated tools to identify {{ insert: param, cm-12.1_prm_1 }} on {{ insert: param, cm-12.1_prm_2 }} to ensure controls are in place to protect organizational information and individual privacy.
      parameters:
        cm-12.1_prm_1:
          label: "organization-defined information by information type"
        cm-12.1_prm_2:
          label: "organization-defined system components"
    cm-13: 
      label: CM-13
      title: Data Action Mapping
      statement: |
        Develop and document a map of system data actions.
    cm-14: 
      label: CM-14
      title: Signed Components
      statement: |
        Prevent the installation of {{ insert: param, cm-14_prm_1 }} without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
      parameters:
        cm-14_prm_1:
          label: "organization-defined software and firmware components"
cp:
  title: Contingency Planning
  controls:
    cp-01: 
      label: CP-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, cp-1_prm_1 }}:
          1.  {{ insert: param, cp-1_prm_2 }} contingency planning policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls;
        b. Designate an {{ insert: param, cp-1_prm_3 }} to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and
        c. Review and update the current contingency planning:
          1. Policy {{ insert: param, cp-1_prm_4 }} and following {{ insert: param, cp-1_prm_5 }}; and
          2. Procedures {{ insert: param, cp-1_prm_6 }} and following {{ insert: param, cp-1_prm_7 }}.
      parameters:
        cp-1_prm_1:
          label: "organization-defined personnel or roles"
        cp-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        cp-1_prm_3:
          label: "organization-defined official"
        cp-1_prm_4:
          label: "organization-defined frequency"
        cp-1_prm_5:
          label: "organization-defined events"
        cp-1_prm_6:
          label: "organization-defined frequency"
        cp-1_prm_7:
          label: "organization-defined events"
    cp-02: 
      label: CP-2
      title: Contingency Plan
      statement: |
        a. Develop a contingency plan for the system that:
          1. Identifies essential mission and business functions and associated contingency requirements;
          2. Provides recovery objectives, restoration priorities, and metrics;
          3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
          4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 
          5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;
          6. Addresses the sharing of contingency information; and
          7. Is reviewed and approved by {{ insert: param, cp-2_prm_1 }};
        b. Distribute copies of the contingency plan to {{ insert: param, cp-2_prm_2 }};
        c. Coordinate contingency planning activities with incident handling activities;
        d. Review the contingency plan for the system {{ insert: param, cp-2_prm_3 }};
        e. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
        f. Communicate contingency plan changes to {{ insert: param, cp-2_prm_4 }};
        g. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and
        h. Protect the contingency plan from unauthorized disclosure and modification.
      parameters:
        cp-2_prm_1:
          label: "organization-defined personnel or roles"
        cp-2_prm_2:
          label: "organization-defined key contingency personnel (identified by name and/or by role) and organizational elements"
        cp-2_prm_3:
          label: "organization-defined frequency"
        cp-2_prm_4:
          label: "organization-defined key contingency personnel (identified by name and/or by role) and organizational elements"
    cp-02.01:
      label: CP-2(1)
      parent_control: cp-02
      title: Coordinate with Related Plans
      statement: |
        Coordinate contingency plan development with organizational elements responsible for related plans.
    cp-02.02:
      label: CP-2(2)
      parent_control: cp-02
      title: Capacity Planning
      statement: |
        Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.
    cp-02.03:
      label: CP-2(3)
      parent_control: cp-02
      title: Resume Mission and Business Functions
      statement: |
        Plan for the resumption of {{ insert: param, cp-2.3_prm_1 }} mission and business functions within {{ insert: param, cp-2.3_prm_2 }} of contingency plan activation.
      parameters:
        cp-2.3_prm_1:
          choice:
            - "all"
            - "essential"
        cp-2.3_prm_2:
          label: "organization-defined time period"
    cp-02.05:
      label: CP-2(5)
      parent_control: cp-02
      title: Continue Mission and Business Functions
      statement: |
        Plan for the continuance of {{ insert: param, cp-2.5_prm_1 }} mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at primary processing and/or storage sites.
      parameters:
        cp-2.5_prm_1:
          choice:
            - "all"
            - "essential"
    cp-02.06:
      label: CP-2(6)
      parent_control: cp-02
      title: Alternate Processing and Storage Sites
      statement: |
        Plan for the transfer of {{ insert: param, cp-2.6_prm_1 }} mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to primary processing and/or storage sites.
      parameters:
        cp-2.6_prm_1:
          choice:
            - "all"
            - "essential"
    cp-02.07:
      label: CP-2(7)
      parent_control: cp-02
      title: Coordinate with External Service Providers
      statement: |
        Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.
    cp-02.08:
      label: CP-2(8)
      parent_control: cp-02
      title: Identify Critical Assets
      statement: |
        Identify critical system assets supporting {{ insert: param, cp-2.8_prm_1 }} mission and business functions.
      parameters:
        cp-2.8_prm_1:
          choice:
            - "all"
            - "essential"
    cp-03: 
      label: CP-3
      title: Contingency Training
      statement: |
        a. Provide contingency training to system users consistent with assigned roles and responsibilities: 
          1. Within {{ insert: param, cp-3_prm_1 }} of assuming a contingency role or responsibility;
          2. When required by system changes; and
          3.  {{ insert: param, cp-3_prm_2 }} thereafter; and
        b. Review and update contingency training content {{ insert: param, cp-3_prm_3 }} and following {{ insert: param, cp-3_prm_4 }}.
      parameters:
        cp-3_prm_1:
          label: "organization-defined time period"
        cp-3_prm_2:
          label: "organization-defined frequency"
        cp-3_prm_3:
          label: "organization-defined frequency"
        cp-3_prm_4:
          label: "organization-defined events"
    cp-03.01:
      label: CP-3(1)
      parent_control: cp-03
      title: Simulated Events
      statement: |
        Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations. 
    cp-03.02:
      label: CP-3(2)
      parent_control: cp-03
      title: Mechanisms Used in Training Environments
      statement: |
        Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment.
    cp-04: 
      label: CP-4
      title: Contingency Plan Testing
      statement: |
        a. Test the contingency plan for the system {{ insert: param, cp-4_prm_1 }} using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: {{ insert: param, cp-4_prm_2 }}.
        b. Review the contingency plan test results; and
        c. Initiate corrective actions, if needed.
      parameters:
        cp-4_prm_1:
          label: "organization-defined frequency"
        cp-4_prm_2:
          label: "organization-defined tests"
    cp-04.01:
      label: CP-4(1)
      parent_control: cp-04
      title: Coordinate with Related Plans
      statement: |
        Coordinate contingency plan testing with organizational elements responsible for related plans.
    cp-04.02:
      label: CP-4(2)
      parent_control: cp-04
      title: Alternate Processing Site
      statement: |
        Test the contingency plan at the alternate processing site:
          (a) To familiarize contingency personnel with the facility and available resources; and
          (b) To evaluate the capabilities of the alternate processing site to support contingency operations.
    cp-04.03:
      label: CP-4(3)
      parent_control: cp-04
      title: Automated Testing
      statement: |
        Test the contingency plan using {{ insert: param, cp-4.3_prm_1 }}.
      parameters:
        cp-4.3_prm_1:
          label: "organization-defined automated mechanisms"
    cp-04.04:
      label: CP-4(4)
      parent_control: cp-04
      title: Full Recovery and Reconstitution
      statement: |
        Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.
    cp-04.05:
      label: CP-4(5)
      parent_control: cp-04
      title: Self-challenge
      statement: |
        Employ {{ insert: param, cp-4.5_prm_1 }} to {{ insert: param, cp-4.5_prm_2 }} to disrupt and adversely affect the system or system component.
      parameters:
        cp-4.5_prm_1:
          label: "organization-defined mechanisms"
        cp-4.5_prm_2:
          label: "organization-defined system or system component"
    cp-06: 
      label: CP-6
      title: Alternate Storage Site
      statement: |
        a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and
        b. Ensure that the alternate storage site provides controls equivalent to that of the primary site.
    cp-06.01:
      label: CP-6(1)
      parent_control: cp-06
      title: Separation from Primary Site
      statement: |
        Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.
    cp-06.02:
      label: CP-6(2)
      parent_control: cp-06
      title: Recovery Time and Recovery Point Objectives
      statement: |
        Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.
    cp-06.03:
      label: CP-6(3)
      parent_control: cp-06
      title: Accessibility
      statement: |
        Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions.
    cp-07: 
      label: CP-7
      title: Alternate Processing Site
      statement: |
        a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of {{ insert: param, cp-7_prm_1 }} for essential mission and business functions within {{ insert: param, cp-7_prm_2 }} when the primary processing capabilities are unavailable;
        b. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and
        c. Provide controls at the alternate processing site that are equivalent to those at the primary site.
      parameters:
        cp-7_prm_1:
          label: "organization-defined system operations"
        cp-7_prm_2:
          label: "organization-defined time period consistent with recovery time and recovery point objectives"
    cp-07.01:
      label: CP-7(1)
      parent_control: cp-07
      title: Separation from Primary Site
      statement: |
        Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.
    cp-07.02:
      label: CP-7(2)
      parent_control: cp-07
      title: Accessibility
      statement: |
        Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
    cp-07.03:
      label: CP-7(3)
      parent_control: cp-07
      title: Priority of Service
      statement: |
        Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).
    cp-07.04:
      label: CP-7(4)
      parent_control: cp-07
      title: Preparation for Use
      statement: |
        Prepare the alternate processing site so that the site can serve as the operational site supporting essential mission and business functions.
    cp-07.06:
      label: CP-7(6)
      parent_control: cp-07
      title: Inability to Return to Primary Site
      statement: |
        Plan and prepare for circumstances that preclude returning to the primary processing site.
    cp-08: 
      label: CP-8
      title: Telecommunications Services
      statement: |
        Establish alternate telecommunications services, including necessary agreements to permit the resumption of {{ insert: param, cp-8_prm_1 }} for essential mission and business functions within {{ insert: param, cp-8_prm_2 }} when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
      parameters:
        cp-8_prm_1:
          label: "organization-defined system operations"
        cp-8_prm_2:
          label: "organization-defined time period"
    cp-08.01:
      label: CP-8(1)
      parent_control: cp-08
      title: Priority of Service Provisions
      statement: |
        (a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and
        (b) Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.
    cp-08.02:
      label: CP-8(2)
      parent_control: cp-08
      title: Single Points of Failure
      statement: |
        Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
    cp-08.03:
      label: CP-8(3)
      parent_control: cp-08
      title: Separation of Primary and Alternate Providers
      statement: |
        Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
    cp-08.04:
      label: CP-8(4)
      parent_control: cp-08
      title: Provider Contingency Plan
      statement: |
        (a) Require primary and alternate telecommunications service providers to have contingency plans;
        (b) Review provider contingency plans to ensure that the plans meet organizational contingency requirements; and
        (c) Obtain evidence of contingency testing and training by providers {{ insert: param, cp-8.4_prm_1 }}.
      parameters:
        cp-8.4_prm_1:
          label: "organization-defined frequency"
    cp-08.05:
      label: CP-8(5)
      parent_control: cp-08
      title: Alternate Telecommunication Service Testing
      statement: |
        Test alternate telecommunication services {{ insert: param, cp-8.5_prm_1 }}.
      parameters:
        cp-8.5_prm_1:
          label: "organization-defined frequency"
    cp-09: 
      label: CP-9
      title: System Backup
      statement: |
        a. Conduct backups of user-level information contained in {{ insert: param, cp-9_prm_1 }} {{ insert: param, cp-9_prm_2 }};
        b. Conduct backups of system-level information contained in the system {{ insert: param, cp-9_prm_3 }};
        c. Conduct backups of system documentation, including security- and privacy-related documentation {{ insert: param, cp-9_prm_4 }}; and 
        d. Protect the confidentiality, integrity, and availability of backup information.
      parameters:
        cp-9_prm_1:
          label: "organization-defined system components"
        cp-9_prm_2:
          label: "organization-defined frequency consistent with recovery time and recovery point objectives"
        cp-9_prm_3:
          label: "organization-defined frequency consistent with recovery time and recovery point objectives"
        cp-9_prm_4:
          label: "organization-defined frequency consistent with recovery time and recovery point objectives"
    cp-09.01:
      label: CP-9(1)
      parent_control: cp-09
      title: Testing for Reliability and Integrity
      statement: |
        Test backup information {{ insert: param, cp-9.1_prm_1 }} to verify media reliability and information integrity.
      parameters:
        cp-9.1_prm_1:
          label: "organization-defined frequency"
    cp-09.02:
      label: CP-9(2)
      parent_control: cp-09
      title: Test Restoration Using Sampling
      statement: |
        Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.
    cp-09.03:
      label: CP-9(3)
      parent_control: cp-09
      title: Separate Storage for Critical Information
      statement: |
        Store backup copies of {{ insert: param, cp-9.3_prm_1 }} in a separate facility or in a fire rated container that is not collocated with the operational system.
      parameters:
        cp-9.3_prm_1:
          label: "organization-defined critical system software and other security-related information"
    cp-09.05:
      label: CP-9(5)
      parent_control: cp-09
      title: Transfer to Alternate Storage Site
      statement: |
        Transfer system backup information to the alternate storage site {{ insert: param, cp-9.5_prm_1 }}.
      parameters:
        cp-9.5_prm_1:
          label: "organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives"
    cp-09.06:
      label: CP-9(6)
      parent_control: cp-09
      title: Redundant Secondary System
      statement: |
        Conduct system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations.
    cp-09.07:
      label: CP-9(7)
      parent_control: cp-09
      title: Dual Authorization for Deletion or Destruction
      statement: |
        Enforce dual authorization for the deletion or destruction of {{ insert: param, cp-9.7_prm_1 }}.
      parameters:
        cp-9.7_prm_1:
          label: "organization-defined backup information"
    cp-09.08:
      label: CP-9(8)
      parent_control: cp-09
      title: Cryptographic Protection
      statement: |
        Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of {{ insert: param, cp-9.8_prm_1 }}.
      parameters:
        cp-9.8_prm_1:
          label: "organization-defined backup information"
    cp-10: 
      label: CP-10
      title: System Recovery and Reconstitution
      statement: |
        Provide for the recovery and reconstitution of the system to a known state within {{ insert: param, cp-10_prm_1 }} after a disruption, compromise, or failure.
      parameters:
        cp-10_prm_1:
          label: "organization-defined time period consistent with recovery time and recovery point objectives"
    cp-10.02:
      label: CP-10(2)
      parent_control: cp-10
      title: Transaction Recovery
      statement: |
        Implement transaction recovery for systems that are transaction-based.
    cp-10.03:
      label: CP-10(3)
      parent_control: cp-10
      title: Compensating Security Controls
      statement: |
        Addressed through tailoring.
    cp-10.04:
      label: CP-10(4)
      parent_control: cp-10
      title: Restore Within Time Period
      statement: |
        Provide the capability to restore system components within {{ insert: param, cp-10.4_prm_1 }} from configuration-controlled and integrity-protected information representing a known, operational state for the components.
      parameters:
        cp-10.4_prm_1:
          label: "organization-defined restoration time periods"
    cp-10.06:
      label: CP-10(6)
      parent_control: cp-10
      title: Component Protection
      statement: |
        Protect system components used for recovery and reconstitution.
    cp-11: 
      label: CP-11
      title: Alternate Communications Protocols
      statement: |
        Provide the capability to employ {{ insert: param, cp-11_prm_1 }} in support of maintaining continuity of operations.
      parameters:
        cp-11_prm_1:
          label: "organization-defined alternative communications protocols"
    cp-12: 
      label: CP-12
      title: Safe Mode
      statement: |
        When {{ insert: param, cp-12_prm_1 }} are detected, enter a safe mode of operation with {{ insert: param, cp-12_prm_2 }}.
      parameters:
        cp-12_prm_1:
          label: "organization-defined conditions"
        cp-12_prm_2:
          label: "organization-defined restrictions of safe mode of operation"
    cp-13: 
      label: CP-13
      title: Alternative Security Mechanisms
      statement: |
        Employ {{ insert: param, cp-13_prm_1 }} for satisfying {{ insert: param, cp-13_prm_2 }} when the primary means of implementing the security function is unavailable or compromised.
      parameters:
        cp-13_prm_1:
          label: "organization-defined alternative or supplemental security mechanisms"
        cp-13_prm_2:
          label: "organization-defined security functions"
ia:
  title: Identification and Authentication
  controls:
    ia-01: 
      label: IA-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, ia-1_prm_1 }}:
          1.  {{ insert: param, ia-1_prm_2 }} identification and authentication policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the identification and authentication policy and the associated identification and authentication controls;
        b. Designate an {{ insert: param, ia-1_prm_3 }} to manage the development, documentation, and dissemination of the identification and authentication policy and procedures; and
        c. Review and update the current identification and authentication:
          1. Policy {{ insert: param, ia-1_prm_4 }} and following {{ insert: param, ia-1_prm_5 }}; and
          2. Procedures {{ insert: param, ia-1_prm_6 }} and following {{ insert: param, ia-1_prm_7 }}.
      parameters:
        ia-1_prm_1:
          label: "organization-defined personnel or roles"
        ia-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        ia-1_prm_3:
          label: "organization-defined official"
        ia-1_prm_4:
          label: "organization-defined frequency"
        ia-1_prm_5:
          label: "organization-defined events"
        ia-1_prm_6:
          label: "organization-defined frequency"
        ia-1_prm_7:
          label: "organization-defined events"
    ia-02: 
      label: IA-2
      title: Identification and Authentication (organizational Users)
      statement: |
        Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
    ia-02.01:
      label: IA-2(1)
      parent_control: ia-02
      title: Multi-factor Authentication to Privileged Accounts
      statement: |
        Implement multi-factor authentication for access to privileged accounts.
    ia-02.02:
      label: IA-2(2)
      parent_control: ia-02
      title: Multi-factor Authentication to Non-privileged Accounts
      statement: |
        Implement multi-factor authentication for access to non-privileged accounts.
    ia-02.05:
      label: IA-2(5)
      parent_control: ia-02
      title: Individual Authentication with Group Authentication
      statement: |
        When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.
    ia-02.06:
      label: IA-2(6)
      parent_control: ia-02
      title: Access to Accounts —separate Device
      statement: |
        Implement multi-factor authentication for {{ insert: param, ia-2.6_prm_1 }} access to {{ insert: param, ia-2.6_prm_2 }} such that:
          (a) One of the factors is provided by a device separate from the system gaining access; and
          (b) The device meets {{ insert: param, ia-2.6_prm_3 }}.
      parameters:
        ia-2.6_prm_1:
          how-many: one or more
          choice:
            - "local"
            - "network"
            - "remote"
        ia-2.6_prm_2:
          how-many: one or more
          choice:
            - "privileged accounts"
            - "non-privileged accounts"
        ia-2.6_prm_3:
          label: "organization-defined strength of mechanism requirements"
    ia-02.08:
      label: IA-2(8)
      parent_control: ia-02
      title: Access to Accounts — Replay Resistant
      statement: |
        Implement replay-resistant authentication mechanisms for access to {{ insert: param, ia-2.8_prm_1 }}.
      parameters:
        ia-2.8_prm_1:
          how-many: one or more
          choice:
            - "privileged accounts"
            - "non-privileged accounts"
    ia-02.10:
      label: IA-2(10)
      parent_control: ia-02
      title: Single Sign-on
      statement: |
        Provide a single sign-on capability for {{ insert: param, ia-2.10_prm_1 }}.
      parameters:
        ia-2.10_prm_1:
          label: "organization-defined system accounts and services"
    ia-02.12:
      label: IA-2(12)
      parent_control: ia-02
      title: Acceptance of PIV Credentials
      statement: |
        Accept and electronically verify Personal Identity Verification-compliant credentials.
    ia-02.13:
      label: IA-2(13)
      parent_control: ia-02
      title: Out-of-band Authentication
      statement: |
        Implement the following out-of-band authentication mechanisms under {{ insert: param, ia-2.13_prm_1 }}: {{ insert: param, ia-2.13_prm_2 }}.
      parameters:
        ia-2.13_prm_1:
          label: "organization-defined conditions"
        ia-2.13_prm_2:
          label: "organization-defined out-of-band authentication"
    ia-03: 
      label: IA-3
      title: Device Identification and Authentication
      statement: |
        Uniquely identify and authenticate {{ insert: param, ia-3_prm_1 }} before establishing a {{ insert: param, ia-3_prm_2 }} connection.
      parameters:
        ia-3_prm_1:
          label: "organization-defined devices and/or types of devices"
        ia-3_prm_2:
          how-many: one or more
          choice:
            - "local"
            - "remote"
            - "network"
    ia-03.01:
      label: IA-3(1)
      parent_control: ia-03
      title: Cryptographic Bidirectional Authentication
      statement: |
        Authenticate {{ insert: param, ia-3.1_prm_1 }} before establishing {{ insert: param, ia-3.1_prm_2 }} connection using bidirectional authentication that is cryptographically based.
      parameters:
        ia-3.1_prm_1:
          label: "organization-defined devices and/or types of devices"
        ia-3.1_prm_2:
          how-many: one or more
          choice:
            - "local"
            - "remote"
            - "network"
    ia-03.03:
      label: IA-3(3)
      parent_control: ia-03
      title: Dynamic Address Allocation
      statement: |
        (a) Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in accordance with {{ insert: param, ia-3.3_prm_1 }}; and
        (b) Audit lease information when assigned to a device.
      parameters:
        ia-3.3_prm_1:
          label: "organization-defined lease information and lease duration"
    ia-03.04:
      label: IA-3(4)
      parent_control: ia-03
      title: Device Attestation
      statement: |
        Handle device identification and authentication based on attestation by {{ insert: param, ia-3.4_prm_1 }}.
      parameters:
        ia-3.4_prm_1:
          label: "organization-defined configuration management process"
    ia-04: 
      label: IA-4
      title: Identifier Management
      statement: |
        Manage system identifiers by:
          a. Receiving authorization from {{ insert: param, ia-4_prm_1 }} to assign an individual, group, role, service, or device identifier;
          b. Selecting an identifier that identifies an individual, group, role, service, or device;
          c. Assigning the identifier to the intended individual, group, role, service, or device; and
          d. Preventing reuse of identifiers for {{ insert: param, ia-4_prm_2 }}.
      parameters:
        ia-4_prm_1:
          label: "organization-defined personnel or roles"
        ia-4_prm_2:
          label: "organization-defined time period"
    ia-04.01:
      label: IA-4(1)
      parent_control: ia-04
      title: Prohibit Account Identifiers as Public Identifiers
      statement: |
        Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.
    ia-04.04:
      label: IA-4(4)
      parent_control: ia-04
      title: Identify User Status
      statement: |
        Manage individual identifiers by uniquely identifying each individual as {{ insert: param, ia-4.4_prm_1 }}.
      parameters:
        ia-4.4_prm_1:
          label: "organization-defined characteristic identifying individual status"
    ia-04.05:
      label: IA-4(5)
      parent_control: ia-04
      title: Dynamic Management
      statement: |
        Manage individual identifiers dynamically in accordance with {{ insert: param, ia-4.5_prm_1 }}.
      parameters:
        ia-4.5_prm_1:
          label: "organization-defined dynamic identifier policy"
    ia-04.06:
      label: IA-4(6)
      parent_control: ia-04
      title: Cross-organization Management
      statement: |
        Coordinate with the following external organizations for cross-organization management of identifiers: {{ insert: param, ia-4.6_prm_1 }}.
      parameters:
        ia-4.6_prm_1:
          label: "organization-defined external organizations"
    ia-04.08:
      label: IA-4(8)
      parent_control: ia-04
      title: Pairwise Pseudonymous Identifiers
      statement: |
        Generate pairwise pseudonymous identifiers.
    ia-04.09:
      label: IA-4(9)
      parent_control: ia-04
      title: Attribute Maintenance and Protection
      statement: |
        Maintain the attributes for each uniquely identified individual, device, or service in {{ insert: param, ia-4.9_prm_1 }}.
      parameters:
        ia-4.9_prm_1:
          label: "organization-defined protected central storage"
    ia-05: 
      label: IA-5
      title: Authenticator Management
      statement: |
        Manage system authenticators by:
          a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;
          b. Establishing initial authenticator content for any authenticators issued by the organization;
          c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;
          d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;
          e. Changing default authenticators prior to first use;
          f. Changing or refreshing authenticators {{ insert: param, ia-5_prm_1 }} or when {{ insert: param, ia-5_prm_2 }} occur;
          g. Protecting authenticator content from unauthorized disclosure and modification;
          h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and
          i. Changing authenticators for group or role accounts when membership to those accounts changes.
      parameters:
        ia-5_prm_1:
          label: "organization-defined time period by authenticator type"
        ia-5_prm_2:
          label: "organization-defined events"
    ia-05.01:
      label: IA-5(1)
      parent_control: ia-05
      title: Password-based Authentication
      statement: |
        For password-based authentication:
          (a) Maintain a list of commonly-used, expected, or compromised passwords and update the list {{ insert: param, ia-5.1_prm_1 }} and when organizational passwords are suspected to have been compromised directly or indirectly;
          (b) Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);
          (c) Transmit passwords only over cryptographically-protected channels;
          (d) Store passwords using an approved salted key derivation function, preferably using a keyed hash;
          (e) Require immediate selection of a new password upon account recovery;
          (f) Allow user selection of long passwords and passphrases, including spaces and all printable characters;
          (g) Employ automated tools to assist the user in selecting strong password authenticators; and
          (h) Enforce the following composition and complexity rules: {{ insert: param, ia-5.1_prm_2 }}.
      parameters:
        ia-5.1_prm_1:
          label: "organization-defined frequency"
        ia-5.1_prm_2:
          label: "organization-defined composition and complexity rules"
    ia-05.02:
      label: IA-5(2)
      parent_control: ia-05
      title: Public Key-based Authentication
      statement: |
        (a) For public key-based authentication:
          (1) Enforce authorized access to the corresponding private key; and
          (2) Map the authenticated identity to the account of the individual or group; and
        (b) When public key infrastructure (PKI) is used:
          (1) Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and
          (2) Implement a local cache of revocation data to support path discovery and validation.
    ia-05.05:
      label: IA-5(5)
      parent_control: ia-05
      title: Change Authenticators Prior to Delivery
      statement: |
        Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.
    ia-05.06:
      label: IA-5(6)
      parent_control: ia-05
      title: Protection of Authenticators
      statement: |
        Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.
    ia-05.07:
      label: IA-5(7)
      parent_control: ia-05
      title: No Embedded Unencrypted Static Authenticators
      statement: |
        Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.
    ia-05.08:
      label: IA-5(8)
      parent_control: ia-05
      title: Multiple System Accounts
      statement: |
        Implement {{ insert: param, ia-5.8_prm_1 }} to manage the risk of compromise due to individuals having accounts on multiple systems.
      parameters:
        ia-5.8_prm_1:
          label: "organization-defined security controls"
    ia-05.09:
      label: IA-5(9)
      parent_control: ia-05
      title: Federated Credential Management
      statement: |
        Use the following external organizations to federate credentials: {{ insert: param, ia-5.9_prm_1 }}.
      parameters:
        ia-5.9_prm_1:
          label: "organization-defined external organizations"
    ia-05.10:
      label: IA-5(10)
      parent_control: ia-05
      title: Dynamic Credential Binding
      statement: |
        Bind identities and authenticators dynamically using the following rules: {{ insert: param, ia-5.10_prm_1 }}.
      parameters:
        ia-5.10_prm_1:
          label: "organization-defined binding rules"
    ia-05.12:
      label: IA-5(12)
      parent_control: ia-05
      title: Biometric Authentication Performance
      statement: |
        For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements {{ insert: param, ia-5.12_prm_1 }}.
      parameters:
        ia-5.12_prm_1:
          label: "organization-defined biometric quality requirements"
    ia-05.13:
      label: IA-5(13)
      parent_control: ia-05
      title: Expiration of Cached Authenticators
      statement: |
        Prohibit the use of cached authenticators after {{ insert: param, ia-5.13_prm_1 }}.
      parameters:
        ia-5.13_prm_1:
          label: "organization-defined time period"
    ia-05.14:
      label: IA-5(14)
      parent_control: ia-05
      title: Managing Content of PKI Trust Stores
      statement: |
        For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, including networks, operating systems, browsers, and applications. 
    ia-05.15:
      label: IA-5(15)
      parent_control: ia-05
      title: Gsa-approved Products and Services
      statement: |
        Use only General Services Administration-approved products and services for identity, credential, and access management.
    ia-05.16:
      label: IA-5(16)
      parent_control: ia-05
      title: In-person or Trusted External Party Authenticator Issuance
      statement: |
        Require that the issuance of {{ insert: param, ia-5.16_prm_1 }} be conducted {{ insert: param, ia-5.16_prm_2 }} before {{ insert: param, ia-5.16_prm_3 }} with authorization by {{ insert: param, ia-5.16_prm_4 }}.
      parameters:
        ia-5.16_prm_1:
          label: "organization-defined types of and/or specific authenticators"
        ia-5.16_prm_2:
          choice:
            - "in person"
            - "by a trusted external party"
        ia-5.16_prm_3:
          label: "organization-defined registration authority"
        ia-5.16_prm_4:
          label: "organization-defined personnel or roles"
    ia-05.17:
      label: IA-5(17)
      parent_control: ia-05
      title: Presentation Attack Detection for Biometric Authenticators
      statement: |
        Employ presentation attack detection mechanisms for biometric-based authentication.
    ia-05.18:
      label: IA-5(18)
      parent_control: ia-05
      title: Password Managers
      statement: |
        (a) Employ {{ insert: param, ia-5.18_prm_1 }} to generate and manage passwords; and
        (b) Protect the passwords using {{ insert: param, ia-5.18_prm_2 }}.
      parameters:
        ia-5.18_prm_1:
          label: "organization-defined password managers"
        ia-5.18_prm_2:
          label: "organization-defined controls"
    ia-06: 
      label: IA-6
      title: Authentication Feedback
      statement: |
        Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
    ia-07: 
      label: IA-7
      title: Cryptographic Module Authentication
      statement: |
        Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
    ia-08: 
      label: IA-8
      title: Identification and Authentication (non-organizational Users)
      statement: |
        Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
    ia-08.01:
      label: IA-8(1)
      parent_control: ia-08
      title: Acceptance of PIV Credentials from Other Agencies
      statement: |
        Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
    ia-08.02:
      label: IA-8(2)
      parent_control: ia-08
      title: Acceptance of External Authenticators
      statement: |
        (a) Accept only external authenticators that are NIST-compliant; and
        (b) Document and maintain a list of accepted external authenticators.
    ia-08.04:
      label: IA-8(4)
      parent_control: ia-08
      title: Use of Defined Profiles
      statement: |
        Conform to the following profiles for identity management {{ insert: param, ia-8.4_prm_1 }}.
      parameters:
        ia-8.4_prm_1:
          label: "organization-defined identity management profiles"
    ia-08.05:
      label: IA-8(5)
      parent_control: ia-08
      title: Acceptance of PIV-I Credentials
      statement: |
        Accept and verify federated or PKI credentials that meet {{ insert: param, ia-8.5_prm_1 }}. 
      parameters:
        ia-8.5_prm_1:
          label: "organization-defined policy"
    ia-08.06:
      label: IA-8(6)
      parent_control: ia-08
      title: Disassociability
      statement: |
        Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: {{ insert: param, ia-8.6_prm_1 }}.
      parameters:
        ia-8.6_prm_1:
          label: "organization-defined measures"
    ia-09: 
      label: IA-9
      title: Service Identification and Authentication
      statement: |
        Uniquely identify and authenticate {{ insert: param, ia-9_prm_1 }} before establishing communications with devices, users, or other services or applications. 
      parameters:
        ia-9_prm_1:
          label: "organization-defined system services and applications"
    ia-10: 
      label: IA-10
      title: Adaptive Authentication
      statement: |
        Require individuals accessing the system to employ {{ insert: param, ia-10_prm_1 }} under specific {{ insert: param, ia-10_prm_2 }}. 
      parameters:
        ia-10_prm_1:
          label: "organization-defined supplemental authentication techniques or mechanisms"
        ia-10_prm_2:
          label: "organization-defined circumstances or situations"
    ia-11: 
      label: IA-11
      title: Re-authentication
      statement: |
        Require users to re-authenticate when {{ insert: param, ia-11_prm_1 }}. 
      parameters:
        ia-11_prm_1:
          label: "organization-defined circumstances or situations requiring re-authentication"
    ia-12: 
      label: IA-12
      title: Identity Proofing
      statement: |
        a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; 
        b. Resolve user identities to a unique individual; and
        c. Collect, validate, and verify identity evidence.
    ia-12.01:
      label: IA-12(1)
      parent_control: ia-12
      title: Supervisor Authorization
      statement: |
        Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.
    ia-12.02:
      label: IA-12(2)
      parent_control: ia-12
      title: Identity Evidence
      statement: |
        Require evidence of individual identification be presented to the registration authority.
    ia-12.03:
      label: IA-12(3)
      parent_control: ia-12
      title: Identity Evidence Validation and Verification
      statement: |
        Require that the presented identity evidence be validated and verified through {{ insert: param, ia-12.3_prm_1 }}.
      parameters:
        ia-12.3_prm_1:
          label: "organizational defined methods of validation and verification"
    ia-12.04:
      label: IA-12(4)
      parent_control: ia-12
      title: In-person Validation and Verification
      statement: |
        Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.
    ia-12.05:
      label: IA-12(5)
      parent_control: ia-12
      title: Address Confirmation
      statement: |
        Require that a {{ insert: param, ia-12.5_prm_1 }} be delivered through an out-of-band channel to verify the users address (physical or digital) of record.
      parameters:
        ia-12.5_prm_1:
          choice:
            - "registration code"
            - "notice of proofing"
    ia-12.06:
      label: IA-12(6)
      parent_control: ia-12
      title: Accept Externally-proofed Identities
      statement: |
        Accept externally-proofed identities at {{ insert: param, ia-12.6_prm_1 }}.
      parameters:
        ia-12.6_prm_1:
          label: "organization-defined identity assurance level"
ir:
  title: Incident Response
  controls:
    ir-01: 
      label: IR-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, ir-1_prm_1 }}:
          1.  {{ insert: param, ir-1_prm_2 }} incident response policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;
        b. Designate an {{ insert: param, ir-1_prm_3 }} to manage the development, documentation, and dissemination of the incident response policy and procedures; and
        c. Review and update the current incident response:
          1. Policy {{ insert: param, ir-1_prm_4 }} and following {{ insert: param, ir-1_prm_5 }}; and
          2. Procedures {{ insert: param, ir-1_prm_6 }} and following {{ insert: param, ir-1_prm_7 }}.
      parameters:
        ir-1_prm_1:
          label: "organization-defined personnel or roles"
        ir-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        ir-1_prm_3:
          label: "organization-defined official"
        ir-1_prm_4:
          label: "organization-defined frequency"
        ir-1_prm_5:
          label: "organization-defined events"
        ir-1_prm_6:
          label: "organization-defined frequency"
        ir-1_prm_7:
          label: "organization-defined events"
    ir-02: 
      label: IR-2
      title: Incident Response Training
      statement: |
        a. Provide incident response training to system users consistent with assigned roles and responsibilities:
          1. Within {{ insert: param, ir-2_prm_1 }} of assuming an incident response role or responsibility or acquiring system access;
          2. When required by system changes; and
          3.  {{ insert: param, ir-2_prm_2 }} thereafter; and
        b. Review and update incident response training content {{ insert: param, ir-2_prm_3 }} and following {{ insert: param, ir-2_prm_4 }}.
      parameters:
        ir-2_prm_1:
          label: "organization-defined time period"
        ir-2_prm_2:
          label: "organization-defined frequency"
        ir-2_prm_3:
          label: "organization-defined frequency"
        ir-2_prm_4:
          label: "organization-defined events"
    ir-02.01:
      label: IR-2(1)
      parent_control: ir-02
      title: Simulated Events
      statement: |
        Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.
    ir-02.02:
      label: IR-2(2)
      parent_control: ir-02
      title: Automated Training Environments
      statement: |
        Provide an incident response training environment using {{ insert: param, ir-2.2_prm_1 }}.
      parameters:
        ir-2.2_prm_1:
          label: "organization-defined automated mechanisms"
    ir-02.03:
      label: IR-2(3)
      parent_control: ir-02
      title: Breach
      statement: |
        Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.
    ir-03: 
      label: IR-3
      title: Incident Response Testing
      statement: |
        Test the effectiveness of the incident response capability for the system {{ insert: param, ir-3_prm_1 }} using the following tests: {{ insert: param, ir-3_prm_2 }}.
      parameters:
        ir-3_prm_1:
          label: "organization-defined frequency"
        ir-3_prm_2:
          label: "organization-defined tests"
    ir-03.01:
      label: IR-3(1)
      parent_control: ir-03
      title: Automated Testing
      statement: |
        Test the incident response capability using {{ insert: param, ir-3.1_prm_1 }}.
      parameters:
        ir-3.1_prm_1:
          label: "organization-defined automated mechanisms"
    ir-03.02:
      label: IR-3(2)
      parent_control: ir-03
      title: Coordination with Related Plans
      statement: |
        Coordinate incident response testing with organizational elements responsible for related plans.
    ir-03.03:
      label: IR-3(3)
      parent_control: ir-03
      title: Continuous Improvement
      statement: |
        Use qualitative and quantitative data from testing to:
          (a) Determine the effectiveness of incident response processes;
          (b) Continuously improve incident response processes; and
          (c) Provide incident response measures and metrics that are accurate, consistent, and in a reproducible format.
    ir-04: 
      label: IR-4
      title: Incident Handling
      statement: |
        a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
        b. Coordinate incident handling activities with contingency planning activities;
        c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
        d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.
    ir-04.01:
      label: IR-4(1)
      parent_control: ir-04
      title: Automated Incident Handling Processes
      statement: |
        Support the incident handling process using {{ insert: param, ir-4.1_prm_1 }}.
      parameters:
        ir-4.1_prm_1:
          label: "organization-defined automated mechanisms"
    ir-04.02:
      label: IR-4(2)
      parent_control: ir-04
      title: Dynamic Reconfiguration
      statement: |
        Include the following types of dynamic reconfiguration for {{ insert: param, ir-4.2_prm_1 }} as part of the incident response capability: {{ insert: param, ir-4.2_prm_2 }}.
      parameters:
        ir-4.2_prm_1:
          label: "organization-defined system components"
        ir-4.2_prm_2:
          label: "organization-defined types of dynamic reconfiguration"
    ir-04.03:
      label: IR-4(3)
      parent_control: ir-04
      title: Continuity of Operations
      statement: |
        Identify {{ insert: param, ir-4.3_prm_1 }} and take the following actions in response to those incidents to ensure continuation of organizational mission and business functions: {{ insert: param, ir-4.3_prm_2 }}. 
      parameters:
        ir-4.3_prm_1:
          label: "organization-defined classes of incidents"
        ir-4.3_prm_2:
          label: "organization-defined actions to take in response to classes of incidents"
    ir-04.04:
      label: IR-4(4)
      parent_control: ir-04
      title: Information Correlation
      statement: |
        Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
    ir-04.05:
      label: IR-4(5)
      parent_control: ir-04
      title: Automatic Disabling of System
      statement: |
        Implement a configurable capability to automatically disable the system if {{ insert: param, ir-4.5_prm_1 }} are detected.
      parameters:
        ir-4.5_prm_1:
          label: "organization-defined security violations"
    ir-04.06:
      label: IR-4(6)
      parent_control: ir-04
      title: Insider Threats
      statement: |
        Implement an incident handling capability for incidents involving insider threats.
    ir-04.07:
      label: IR-4(7)
      parent_control: ir-04
      title: Insider Threats — Intra-organization Coordination
      statement: |
        Coordinate an incident handling capability for insider threats that includes the following organizational entities {{ insert: param, ir-4.7_prm_1 }}.
      parameters:
        ir-4.7_prm_1:
          label: "organization-defined entities"
    ir-04.08:
      label: IR-4(8)
      parent_control: ir-04
      title: Correlation with External Organizations
      statement: |
        Coordinate with {{ insert: param, ir-4.8_prm_1 }} to correlate and share {{ insert: param, ir-4.8_prm_2 }} to achieve a cross-organization perspective on incident awareness and more effective incident responses.
      parameters:
        ir-4.8_prm_1:
          label: "organization-defined external organizations"
        ir-4.8_prm_2:
          label: "organization-defined incident information"
    ir-04.09:
      label: IR-4(9)
      parent_control: ir-04
      title: Dynamic Response Capability
      statement: |
        Employ {{ insert: param, ir-4.9_prm_1 }} to respond to incidents.
      parameters:
        ir-4.9_prm_1:
          label: "organization-defined dynamic response capabilities"
    ir-04.10:
      label: IR-4(10)
      parent_control: ir-04
      title: Supply Chain Coordination
      statement: |
        Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.
    ir-04.11:
      label: IR-4(11)
      parent_control: ir-04
      title: Integrated Incident Response Team
      statement: |
        Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in {{ insert: param, ir-4.11_prm_1 }}.
      parameters:
        ir-4.11_prm_1:
          label: "organization-defined time period"
    ir-04.12:
      label: IR-4(12)
      parent_control: ir-04
      title: Malicious Code and Forensic Analysis
      statement: |
        Analyze malicious code and/or other residual artifacts remaining in the system after the incident.
    ir-04.13:
      label: IR-4(13)
      parent_control: ir-04
      title: Behavior Analysis
      statement: |
        Analyze anomalous or suspected adversarial behavior in or related to {{ insert: param, ir-4.13_prm_1 }}.
      parameters:
        ir-4.13_prm_1:
          label: "organization-defined environments or resources"
    ir-04.14:
      label: IR-4(14)
      parent_control: ir-04
      title: Security Operations Center
      statement: |
        Establish and maintain a security operations center.
    ir-04.15:
      label: IR-4(15)
      parent_control: ir-04
      title: Public Relations and Reputation Repair
      statement: |
        (a) Manage public relations associated with an incident; and
        (b) Employ measures to repair the reputation of the organization.
    ir-05: 
      label: IR-5
      title: Incident Monitoring
      statement: |
        Track and document incidents.
    ir-05.01:
      label: IR-5(1)
      parent_control: ir-05
      title: Automated Tracking, Data Collection, and Analysis
      statement: |
        Track incidents and collect and analyze incident information using {{ insert: param, ir-5.1_prm_1 }}.
      parameters:
        ir-5.1_prm_1:
          label: "organization-defined automated mechanisms"
    ir-06: 
      label: IR-6
      title: Incident Reporting
      statement: |
        a. Require personnel to report suspected incidents to the organizational incident response capability within {{ insert: param, ir-6_prm_1 }}; and
        b. Report incident information to {{ insert: param, ir-6_prm_2 }}.
      parameters:
        ir-6_prm_1:
          label: "organization-defined time period"
        ir-6_prm_2:
          label: "organization-defined authorities"
    ir-06.01:
      label: IR-6(1)
      parent_control: ir-06
      title: Automated Reporting
      statement: |
        Report incidents using {{ insert: param, ir-6.1_prm_1 }}.
      parameters:
        ir-6.1_prm_1:
          label: "organization-defined automated mechanisms"
    ir-06.02:
      label: IR-6(2)
      parent_control: ir-06
      title: Vulnerabilities Related to Incidents
      statement: |
        Report system vulnerabilities associated with reported incidents to {{ insert: param, ir-6.2_prm_1 }}.
      parameters:
        ir-6.2_prm_1:
          label: "organization-defined personnel or roles"
    ir-06.03:
      label: IR-6(3)
      parent_control: ir-06
      title: Supply Chain Coordination
      statement: |
        Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.
    ir-07: 
      label: IR-7
      title: Incident Response Assistance
      statement: |
        Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents. 
    ir-07.01:
      label: IR-7(1)
      parent_control: ir-07
      title: Automation Support for Availability of Information and Support
      statement: |
        Increase the availability of incident response information and support using {{ insert: param, ir-7.1_prm_1 }}.
      parameters:
        ir-7.1_prm_1:
          label: "organization-defined automated mechanisms"
    ir-07.02:
      label: IR-7(2)
      parent_control: ir-07
      title: Coordination with External Providers
      statement: |
        (a) Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability; and
        (b) Identify organizational incident response team members to the external providers.
    ir-08: 
      label: IR-8
      title: Incident Response Plan
      statement: |
        a. Develop an incident response plan that:
          1. Provides the organization with a roadmap for implementing its incident response capability;
          2. Describes the structure and organization of the incident response capability;
          3. Provides a high-level approach for how the incident response capability fits into the overall organization;
          4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
          5. Defines reportable incidents;
          6. Provides metrics for measuring the incident response capability within the organization;
          7. Defines the resources and management support needed to effectively maintain and mature an incident response capability;
          8. Addresses the sharing of incident information;
          9. Is reviewed and approved by {{ insert: param, ir-8_prm_1 }} {{ insert: param, ir-8_prm_2 }}; and
          10. Explicitly designates responsibility for incident response to {{ insert: param, ir-8_prm_3 }}.
        b. Distribute copies of the incident response plan to {{ insert: param, ir-8_prm_4 }};
        c. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
        d. Communicate incident response plan changes to {{ insert: param, ir-8_prm_5 }}; and
        e. Protect the incident response plan from unauthorized disclosure and modification.
      parameters:
        ir-8_prm_1:
          label: "organization-defined personnel or roles"
        ir-8_prm_2:
          label: "organization-defined frequency"
        ir-8_prm_3:
          label: "organization-defined entities, personnel, or roles"
        ir-8_prm_4:
          label: "organization-defined incident response personnel (identified by name and/or by role) and organizational elements"
        ir-8_prm_5:
          label: "organization-defined incident response personnel (identified by name and/or by role) and organizational elements"
    ir-08.01:
      label: IR-8(1)
      parent_control: ir-08
      title: Breaches
      statement: |
        Include the following in the Incident Response Plan for breaches involving personally identifiable information:
          (a) A process to determine if notice to individuals or other organizations, including oversight organizations, is needed;
          (b) An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and
          (c) Identification of applicable privacy requirements. 
    ir-09: 
      label: IR-9
      title: Information Spillage Response
      statement: |
        Respond to information spills by:
          a. Assigning {{ insert: param, ir-9_prm_1 }} with responsibility for responding to information spills;
          b. Identifying the specific information involved in the system contamination;
          c. Alerting {{ insert: param, ir-9_prm_2 }} of the information spill using a method of communication not associated with the spill;
          d. Isolating the contaminated system or system component;
          e. Eradicating the information from the contaminated system or component;
          f. Identifying other systems or system components that may have been subsequently contaminated; and
          g. Performing the following additional actions: {{ insert: param, ir-9_prm_3 }}.
      parameters:
        ir-9_prm_1:
          label: "organization-defined personnel or roles"
        ir-9_prm_2:
          label: "organization-defined personnel or roles"
        ir-9_prm_3:
          label: "organization-defined actions"
    ir-09.02:
      label: IR-9(2)
      parent_control: ir-09
      title: Training
      statement: |
        Provide information spillage response training {{ insert: param, ir-9.2_prm_1 }}.
      parameters:
        ir-9.2_prm_1:
          label: "organization-defined frequency"
    ir-09.03:
      label: IR-9(3)
      parent_control: ir-09
      title: Post-spill Operations
      statement: |
        Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: {{ insert: param, ir-9.3_prm_1 }}.
      parameters:
        ir-9.3_prm_1:
          label: "organization-defined procedures"
    ir-09.04:
      label: IR-9(4)
      parent_control: ir-09
      title: Exposure to Unauthorized Personnel
      statement: |
        Employ the following controls for personnel exposed to information not within assigned access authorizations: {{ insert: param, ir-9.4_prm_1 }}.
      parameters:
        ir-9.4_prm_1:
          label: "organization-defined controls"
ma:
  title: Maintenance
  controls:
    ma-01: 
      label: MA-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, ma-1_prm_1 }}:
          1.  {{ insert: param, ma-1_prm_2 }} maintenance policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;
        b. Designate an {{ insert: param, ma-1_prm_3 }} to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
        c. Review and update the current maintenance:
          1. Policy {{ insert: param, ma-1_prm_4 }} and following {{ insert: param, ma-1_prm_5 }}; and
          2. Procedures {{ insert: param, ma-1_prm_6 }} and following {{ insert: param, ma-1_prm_7 }}.
      parameters:
        ma-1_prm_1:
          label: "organization-defined personnel or roles"
        ma-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        ma-1_prm_3:
          label: "organization-defined official"
        ma-1_prm_4:
          label: "organization-defined frequency"
        ma-1_prm_5:
          label: "organization-defined events"
        ma-1_prm_6:
          label: "organization-defined frequency"
        ma-1_prm_7:
          label: "organization-defined events"
    ma-02: 
      label: MA-2
      title: Controlled Maintenance
      statement: |
        a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
        b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
        c. Require that {{ insert: param, ma-2_prm_1 }} explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
        d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: {{ insert: param, ma-2_prm_2 }};
        e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
        f. Include the following information in organizational maintenance records: {{ insert: param, ma-2_prm_3 }}.
      parameters:
        ma-2_prm_1:
          label: "organization-defined personnel or roles"
        ma-2_prm_2:
          label: "organization-defined information"
        ma-2_prm_3:
          label: "organization-defined information"
    ma-02.02:
      label: MA-2(2)
      parent_control: ma-02
      title: Automated Maintenance Activities
      statement: |
        (a) Schedule, conduct, and document maintenance, repair, and replacement actions for the system using {{ insert: param, ma-2.2_prm_1 }}; and
        (b) Produce up-to date, accurate, and complete records of all maintenance, repair, and replacement actions requested, scheduled, in process, and completed.
      parameters:
        ma-2.2_prm_1:
          label: "organization-defined automated mechanisms"
    ma-03: 
      label: MA-3
      title: Maintenance Tools
      statement: |
        a. Approve, control, and monitor the use of system maintenance tools; and
        b. Review previously approved system maintenance tools {{ insert: param, ma-3_prm_1 }}.
      parameters:
        ma-3_prm_1:
          label: "organization-defined frequency"
    ma-03.01:
      label: MA-3(1)
      parent_control: ma-03
      title: Inspect Tools
      statement: |
        Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.
    ma-03.02:
      label: MA-3(2)
      parent_control: ma-03
      title: Inspect Media
      statement: |
        Check media containing diagnostic and test programs for malicious code before the media are used in the system.
    ma-03.03:
      label: MA-3(3)
      parent_control: ma-03
      title: Prevent Unauthorized Removal
      statement: |
        Prevent the removal of maintenance equipment containing organizational information by:
          (a) Verifying that there is no organizational information contained on the equipment;
          (b) Sanitizing or destroying the equipment;
          (c) Retaining the equipment within the facility; or
          (d) Obtaining an exemption from {{ insert: param, ma-3.3_prm_1 }} explicitly authorizing removal of the equipment from the facility.
      parameters:
        ma-3.3_prm_1:
          label: "organization-defined personnel or roles"
    ma-03.04:
      label: MA-3(4)
      parent_control: ma-03
      title: Restricted Tool Use
      statement: |
        Restrict the use of maintenance tools to authorized personnel only.
    ma-03.05:
      label: MA-3(5)
      parent_control: ma-03
      title: Execution with Privilege
      statement: |
        Monitor the use of maintenance tools that execute with increased privilege.
    ma-03.06:
      label: MA-3(6)
      parent_control: ma-03
      title: Software Updates and Patches
      statement: |
        Inspect maintenance tools to ensure the latest software updates and patches are installed.
    ma-04: 
      label: MA-4
      title: Nonlocal Maintenance
      statement: |
        a. Approve and monitor nonlocal maintenance and diagnostic activities;
        b. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
        c. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
        d. Maintain records for nonlocal maintenance and diagnostic activities; and
        e. Terminate session and network connections when nonlocal maintenance is completed. 
    ma-04.01:
      label: MA-4(1)
      parent_control: ma-04
      title: Logging and Review
      statement: |
        (a) Log {{ insert: param, ma-4.1_prm_1 }} for nonlocal maintenance and diagnostic sessions; and
        (b) Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.
      parameters:
        ma-4.1_prm_1:
          label: "organization-defined audit events"
    ma-04.03:
      label: MA-4(3)
      parent_control: ma-04
      title: Comparable Security and Sanitization
      statement: |
        (a) Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or
        (b) Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information); and after the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.
    ma-04.04:
      label: MA-4(4)
      parent_control: ma-04
      title: Authentication and Separation of Maintenance Sessions
      statement: |
        Protect nonlocal maintenance sessions by:
          (a) Employing {{ insert: param, ma-4.4_prm_1 }}; and
          (b) Separating the maintenance sessions from other network sessions with the system by either:
            (1) Physically separated communications paths; or
            (2) Logically separated communications paths.
      parameters:
        ma-4.4_prm_1:
          label: "organization-defined authenticators that are replay resistant"
    ma-04.05:
      label: MA-4(5)
      parent_control: ma-04
      title: Approvals and Notifications
      statement: |
        (a) Require the approval of each nonlocal maintenance session by {{ insert: param, ma-4.5_prm_1 }}; and
        (b) Notify the following personnel or roles of the date and time of planned nonlocal maintenance: {{ insert: param, ma-4.5_prm_2 }}.
      parameters:
        ma-4.5_prm_1:
          label: "organization-defined personnel or roles"
        ma-4.5_prm_2:
          label: "organization-defined personnel or roles"
    ma-04.06:
      label: MA-4(6)
      parent_control: ma-04
      title: Cryptographic Protection
      statement: |
        Implement the following cryptographic mechanisms to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications: {{ insert: param, ma-4.6_prm_1 }}.
      parameters:
        ma-4.6_prm_1:
          label: "organization-defined cryptographic mechanisms"
    ma-04.07:
      label: MA-4(7)
      parent_control: ma-04
      title: Disconnect Verification
      statement: |
        Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.
    ma-05: 
      label: MA-5
      title: Maintenance Personnel
      statement: |
        a. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
        b. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
        c. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations. 
    ma-05.01:
      label: MA-5(1)
      parent_control: ma-05
      title: Individuals Without Appropriate Access
      statement: |
        (a) Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:
          (1) Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified; and
          (2) Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and
        (b) Develop and implement {{ insert: param, ma-5.1_prm_1 }} in the event a system component cannot be sanitized, removed, or disconnected from the system.
      parameters:
        ma-5.1_prm_1:
          label: "organization-defined alternate controls"
    ma-05.02:
      label: MA-5(2)
      parent_control: ma-05
      title: Security Clearances for Classified Systems
      statement: |
        Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for compartments of information on the system.
    ma-05.03:
      label: MA-5(3)
      parent_control: ma-05
      title: Citizenship Requirements for Classified Systems
      statement: |
        Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.
    ma-05.04:
      label: MA-5(4)
      parent_control: ma-05
      title: Foreign Nationals
      statement: |
        Ensure that:
          (a) Foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments; and
          (b) Approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.
    ma-05.05:
      label: MA-5(5)
      parent_control: ma-05
      title: Non-system Maintenance
      statement: |
        Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorizations.
    ma-06: 
      label: MA-6
      title: Timely Maintenance
      statement: |
        Obtain maintenance support and/or spare parts for {{ insert: param, ma-6_prm_1 }} within {{ insert: param, ma-6_prm_2 }} of failure.
      parameters:
        ma-6_prm_1:
          label: "organization-defined system components"
        ma-6_prm_2:
          label: "organization-defined time period"
    ma-06.01:
      label: MA-6(1)
      parent_control: ma-06
      title: Preventive Maintenance
      statement: |
        Perform preventive maintenance on {{ insert: param, ma-6.1_prm_1 }} at {{ insert: param, ma-6.1_prm_2 }}.
      parameters:
        ma-6.1_prm_1:
          label: "organization-defined system components"
        ma-6.1_prm_2:
          label: "organization-defined time intervals"
    ma-06.02:
      label: MA-6(2)
      parent_control: ma-06
      title: Predictive Maintenance
      statement: |
        Perform predictive maintenance on {{ insert: param, ma-6.2_prm_1 }} at {{ insert: param, ma-6.2_prm_2 }}.
      parameters:
        ma-6.2_prm_1:
          label: "organization-defined system components"
        ma-6.2_prm_2:
          label: "organization-defined time intervals"
    ma-06.03:
      label: MA-6(3)
      parent_control: ma-06
      title: Automated Support for Predictive Maintenance
      statement: |
        Transfer predictive maintenance data to a maintenance management system using {{ insert: param, ma-6.3_prm_1 }}.
      parameters:
        ma-6.3_prm_1:
          label: "organization-defined automated mechanisms"
    ma-07: 
      label: MA-7
      title: Field Maintenance
      statement: |
        Restrict or prohibit field maintenance on {{ insert: param, ma-7_prm_1 }} to {{ insert: param, ma-7_prm_2 }}.
      parameters:
        ma-7_prm_1:
          label: "organization-defined systems or system components"
        ma-7_prm_2:
          label: "organization-defined trusted maintenance facilities"
mp:
  title: Media Protection
  controls:
    mp-01: 
      label: MP-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, mp-1_prm_1 }}:
          1.  {{ insert: param, mp-1_prm_2 }} media protection policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;
        b. Designate an {{ insert: param, mp-1_prm_3 }} to manage the development, documentation, and dissemination of the media protection policy and procedures; and
        c. Review and update the current media protection:
          1. Policy {{ insert: param, mp-1_prm_4 }} and following {{ insert: param, mp-1_prm_5 }}; and
          2. Procedures {{ insert: param, mp-1_prm_6 }} and following {{ insert: param, mp-1_prm_7 }}.
      parameters:
        mp-1_prm_1:
          label: "organization-defined personnel or roles"
        mp-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        mp-1_prm_3:
          label: "organization-defined official"
        mp-1_prm_4:
          label: "organization-defined frequency"
        mp-1_prm_5:
          label: "organization-defined events"
        mp-1_prm_6:
          label: "organization-defined frequency"
        mp-1_prm_7:
          label: "organization-defined events"
    mp-02: 
      label: MP-2
      title: Media Access
      statement: |
        Restrict access to {{ insert: param, mp-2_prm_1 }} to {{ insert: param, mp-2_prm_2 }}.
      parameters:
        mp-2_prm_1:
          label: "organization-defined types of digital and/or non-digital media"
        mp-2_prm_2:
          label: "organization-defined personnel or roles"
    mp-03: 
      label: MP-3
      title: Media Marking
      statement: |
        a. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
        b. Exempt {{ insert: param, mp-3_prm_1 }} from marking if the media remain within {{ insert: param, mp-3_prm_2 }}. 
      parameters:
        mp-3_prm_1:
          label: "organization-defined types of system media"
        mp-3_prm_2:
          label: "organization-defined controlled areas"
    mp-04: 
      label: MP-4
      title: Media Storage
      statement: |
        a. Physically control and securely store {{ insert: param, mp-4_prm_1 }} within {{ insert: param, mp-4_prm_2 }}; and
        b. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
      parameters:
        mp-4_prm_1:
          label: "organization-defined types of digital and/or non-digital media"
        mp-4_prm_2:
          label: "organization-defined controlled areas"
    mp-04.02:
      label: MP-4(2)
      parent_control: mp-04
      title: Automated Restricted Access
      statement: |
        Restrict access to media storage areas and log access attempts and access granted using {{ insert: param, mp-4.2_prm_1 }}.
      parameters:
        mp-4.2_prm_1:
          label: "organization-defined automated mechanisms"
    mp-05: 
      label: MP-5
      title: Media Transport
      statement: |
        a. Protect and control {{ insert: param, mp-5_prm_1 }} during transport outside of controlled areas using {{ insert: param, mp-5_prm_2 }};
        b. Maintain accountability for system media during transport outside of controlled areas;
        c. Document activities associated with the transport of system media; and
        d. Restrict the activities associated with the transport of system media to authorized personnel.
      parameters:
        mp-5_prm_1:
          label: "organization-defined types of system media"
        mp-5_prm_2:
          label: "organization-defined controls"
    mp-05.03:
      label: MP-5(3)
      parent_control: mp-05
      title: Custodians
      statement: |
        Employ an identified custodian during transport of system media outside of controlled areas.
    mp-06: 
      label: MP-6
      title: Media Sanitization
      statement: |
        a. Sanitize {{ insert: param, mp-6_prm_1 }} prior to disposal, release out of organizational control, or release for reuse using {{ insert: param, mp-6_prm_2 }}; and
        b. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
      parameters:
        mp-6_prm_1:
          label: "organization-defined system media"
        mp-6_prm_2:
          label: "organization-defined sanitization techniques and procedures"
    mp-06.01:
      label: MP-6(1)
      parent_control: mp-06
      title: Review, Approve, Track, Document, and Verify
      statement: |
        Review, approve, track, document, and verify media sanitization and disposal actions.
    mp-06.02:
      label: MP-6(2)
      parent_control: mp-06
      title: Equipment Testing
      statement: |
        Test sanitization equipment and procedures {{ insert: param, mp-6.2_prm_1 }} to ensure that the intended sanitization is being achieved.
      parameters:
        mp-6.2_prm_1:
          label: "organization-defined frequency"
    mp-06.03:
      label: MP-6(3)
      parent_control: mp-06
      title: Nondestructive Techniques
      statement: |
        Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system under the following circumstances: {{ insert: param, mp-6.3_prm_1 }}.
      parameters:
        mp-6.3_prm_1:
          label: "organization-defined circumstances requiring sanitization of portable storage devices"
    mp-06.07:
      label: MP-6(7)
      parent_control: mp-06
      title: Dual Authorization
      statement: |
        Enforce dual authorization for the sanitization of {{ insert: param, mp-6.7_prm_1 }}.
      parameters:
        mp-6.7_prm_1:
          label: "organization-defined system media"
    mp-06.08:
      label: MP-6(8)
      parent_control: mp-06
      title: Remote Purging or Wiping of Information
      statement: |
        Provide the capability to purge or wipe information from {{ insert: param, mp-6.8_prm_1 }} {{ insert: param, mp-6.8_prm_2 }}.
      parameters:
        mp-6.8_prm_1:
          label: "organization-defined systems or system components"
        mp-6.8_prm_2:
          choice:
            - "remotely"
            - "under the following conditions: {{ insert: param, mp-6.8_prm_3 }} "
        mp-6.8_prm_3:
          label: "organization-defined conditions"
    mp-07: 
      label: MP-7
      title: Media Use
      statement: |
        a.  {{ insert: param, mp-7_prm_1 }} the use of {{ insert: param, mp-7_prm_2 }} on {{ insert: param, mp-7_prm_3 }} using {{ insert: param, mp-7_prm_4 }}; and
        b. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.
      parameters:
        mp-7_prm_1:
          choice:
            - "Restrict"
            - "Prohibit"
        mp-7_prm_2:
          label: "organization-defined types of system media"
        mp-7_prm_3:
          label: "organization-defined systems or system components"
        mp-7_prm_4:
          label: "organization-defined controls"
    mp-07.02:
      label: MP-7(2)
      parent_control: mp-07
      title: Prohibit Use of Sanitization-resistant Media
      statement: |
        Prohibit the use of sanitization-resistant media in organizational systems.
    mp-08: 
      label: MP-8
      title: Media Downgrading
      statement: |
        a. Establish {{ insert: param, mp-8_prm_1 }} that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;
        b. Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;
        c. Identify {{ insert: param, mp-8_prm_2 }}; and
        d. Downgrade the identified system media using the established process.
      parameters:
        mp-8_prm_1:
          label: "organization-defined system media downgrading process"
        mp-8_prm_2:
          label: "organization-defined system media requiring downgrading"
    mp-08.01:
      label: MP-8(1)
      parent_control: mp-08
      title: Documentation of Process
      statement: |
        Document system media downgrading actions.
    mp-08.02:
      label: MP-8(2)
      parent_control: mp-08
      title: Equipment Testing
      statement: |
        Test downgrading equipment and procedures {{ insert: param, mp-8.2_prm_1 }} to ensure that downgrading actions are being achieved.
      parameters:
        mp-8.2_prm_1:
          label: "organization-defined frequency"
    mp-08.03:
      label: MP-8(3)
      parent_control: mp-08
      title: Controlled Unclassified Information
      statement: |
        Downgrade system media containing controlled unclassified information prior to public release.
    mp-08.04:
      label: MP-8(4)
      parent_control: mp-08
      title: Classified Information
      statement: |
        Downgrade system media containing classified information prior to release to individuals without required access authorizations.
pe:
  title: Physical and Environmental Protection
  controls:
    pe-01: 
      label: PE-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, pe-1_prm_1 }}:
          1.  {{ insert: param, pe-1_prm_2 }} physical and environmental protection policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls;
        b. Designate an {{ insert: param, pe-1_prm_3 }} to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; and
        c. Review and update the current physical and environmental protection:
          1. Policy {{ insert: param, pe-1_prm_4 }} and following {{ insert: param, pe-1_prm_5 }}; and
          2. Procedures {{ insert: param, pe-1_prm_6 }} and following {{ insert: param, pe-1_prm_7 }}.
      parameters:
        pe-1_prm_1:
          label: "organization-defined personnel or roles"
        pe-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        pe-1_prm_3:
          label: "organization-defined official"
        pe-1_prm_4:
          label: "organization-defined frequency"
        pe-1_prm_5:
          label: "organization-defined events"
        pe-1_prm_6:
          label: "organization-defined frequency"
        pe-1_prm_7:
          label: "organization-defined events"
    pe-02: 
      label: PE-2
      title: Physical Access Authorizations
      statement: |
        a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides;
        b. Issue authorization credentials for facility access;
        c. Review the access list detailing authorized facility access by individuals {{ insert: param, pe-2_prm_1 }}; and
        d. Remove individuals from the facility access list when access is no longer required.
      parameters:
        pe-2_prm_1:
          label: "organization-defined frequency"
    pe-02.01:
      label: PE-2(1)
      parent_control: pe-02
      title: Access by Position or Role
      statement: |
        Authorize physical access to the facility where the system resides based on position or role.
    pe-02.02:
      label: PE-2(2)
      parent_control: pe-02
      title: Two Forms of Identification
      statement: |
        Require two forms of identification from the following forms of identification for visitor access to the facility where the system resides: {{ insert: param, pe-2.2_prm_1 }}.
      parameters:
        pe-2.2_prm_1:
          label: "organization-defined list of acceptable forms of identification"
    pe-02.03:
      label: PE-2(3)
      parent_control: pe-02
      title: Restrict Unescorted Access
      statement: |
        Restrict unescorted access to the facility where the system resides to personnel with {{ insert: param, pe-2.3_prm_1 }}. 
      parameters:
        pe-2.3_prm_1:
          how-many: one or more
          choice:
            - "security clearances for all information contained within the system"
            - "formal access authorizations for all information contained within the system"
            - "need for access to all information contained within the system"
            - " {{ insert: param, pe-2.3_prm_2 }} "
        pe-2.3_prm_2:
          label: "organization-defined physical access authorizations"
    pe-03: 
      label: PE-3
      title: Physical Access Control
      statement: |
        a. Enforce physical access authorizations at {{ insert: param, pe-3_prm_1 }} by:
          1. Verifying individual access authorizations before granting access to the facility; and
          2. Controlling ingress and egress to the facility using {{ insert: param, pe-3_prm_2 }};
        b. Maintain physical access audit logs for {{ insert: param, pe-3_prm_4 }};
        c. Control access to areas within the facility designated as publicly accessible by implementing the following controls: {{ insert: param, pe-3_prm_5 }};
        d. Escort visitors and control visitor activity {{ insert: param, pe-3_prm_6 }};
        e. Secure keys, combinations, and other physical access devices;
        f. Inventory {{ insert: param, pe-3_prm_7 }} every {{ insert: param, pe-3_prm_8 }}; and
        g. Change combinations and keys {{ insert: param, pe-3_prm_9 }} and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
      parameters:
        pe-3_prm_1:
          label: "organization-defined entry and exit points to the facility where the system resides"
        pe-3_prm_2:
          how-many: one or more
          choice:
            - " {{ insert: param, pe-3_prm_3 }} "
            - "guards"
        pe-3_prm_3:
          label: "organization-defined physical access control systems or devices"
        pe-3_prm_4:
          label: "organization-defined entry or exit points"
        pe-3_prm_5:
          label: "organization-defined physical access controls"
        pe-3_prm_6:
          label: "organization-defined circumstances requiring visitor escorts and control of visitor activity"
        pe-3_prm_7:
          label: "organization-defined physical access devices"
        pe-3_prm_8:
          label: "organization-defined frequency"
        pe-3_prm_9:
          label: "organization-defined frequency"
    pe-03.01:
      label: PE-3(1)
      parent_control: pe-03
      title: System Access
      statement: |
        Enforce physical access authorizations to the system in addition to the physical access controls for the facility at {{ insert: param, pe-3.1_prm_1 }}.
      parameters:
        pe-3.1_prm_1:
          label: "organization-defined physical spaces containing one or more components of the system"
    pe-03.02:
      label: PE-3(2)
      parent_control: pe-03
      title: Facility and Systems
      statement: |
        Perform security checks {{ insert: param, pe-3.2_prm_1 }} at the physical perimeter of the facility or system for exfiltration of information or removal of system components.
      parameters:
        pe-3.2_prm_1:
          label: "organization-defined frequency"
    pe-03.03:
      label: PE-3(3)
      parent_control: pe-03
      title: Continuous Guards
      statement: |
        Employ guards to control {{ insert: param, pe-3.3_prm_1 }} to the facility where the system resides 24 hours per day, 7 days per week.
      parameters:
        pe-3.3_prm_1:
          label: "organization-defined physical access points"
    pe-03.04:
      label: PE-3(4)
      parent_control: pe-03
      title: Lockable Casings
      statement: |
        Use lockable physical casings to protect {{ insert: param, pe-3.4_prm_1 }} from unauthorized physical access.
      parameters:
        pe-3.4_prm_1:
          label: "organization-defined system components"
    pe-03.05:
      label: PE-3(5)
      parent_control: pe-03
      title: Tamper Protection
      statement: |
        Employ {{ insert: param, pe-3.5_prm_1 }} to {{ insert: param, pe-3.5_prm_2 }} physical tampering or alteration of {{ insert: param, pe-3.5_prm_3 }} within the system.
      parameters:
        pe-3.5_prm_1:
          label: "organization-defined anti-tamper technologies"
        pe-3.5_prm_2:
          how-many: one or more
          choice:
            - "detect"
            - "prevent"
        pe-3.5_prm_3:
          label: "organization-defined hardware components"
    pe-03.07:
      label: PE-3(7)
      parent_control: pe-03
      title: Physical Barriers
      statement: |
        Limit access using physical barriers. 
    pe-03.08:
      label: PE-3(8)
      parent_control: pe-03
      title: Access Control Vestibules
      statement: |
        Employ access control vestibules at {{ insert: param, pe-3.8_prm_1 }}.
      parameters:
        pe-3.8_prm_1:
          label: "organization-defined locations within the facility"
    pe-04: 
      label: PE-4
      title: Access Control for Transmission
      statement: |
        Control physical access to {{ insert: param, pe-4_prm_1 }} within organizational facilities using {{ insert: param, pe-4_prm_2 }}.
      parameters:
        pe-4_prm_1:
          label: "organization-defined system distribution and transmission lines"
        pe-4_prm_2:
          label: "organization-defined security controls"
    pe-05: 
      label: PE-5
      title: Access Control for Output Devices
      statement: |
        Control physical access to output from {{ insert: param, pe-5_prm_1 }} to prevent unauthorized individuals from obtaining the output.
      parameters:
        pe-5_prm_1:
          label: "organization-defined output devices"
    pe-05.02:
      label: PE-5(2)
      parent_control: pe-05
      title: Link to Individual Identity
      statement: |
        Link individual identity to receipt of output from output devices.
    pe-06: 
      label: PE-6
      title: Monitoring Physical Access
      statement: |
        a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents;
        b. Review physical access logs {{ insert: param, pe-6_prm_1 }} and upon occurrence of {{ insert: param, pe-6_prm_2 }}; and
        c. Coordinate results of reviews and investigations with the organizational incident response capability.
      parameters:
        pe-6_prm_1:
          label: "organization-defined frequency"
        pe-6_prm_2:
          label: "organization-defined events or potential indications of events"
    pe-06.01:
      label: PE-6(1)
      parent_control: pe-06
      title: Intrusion Alarms and Surveillance Equipment
      statement: |
        Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.
    pe-06.02:
      label: PE-6(2)
      parent_control: pe-06
      title: Automated Intrusion Recognition and Responses
      statement: |
        Recognize {{ insert: param, pe-6.2_prm_1 }} and initiate {{ insert: param, pe-6.2_prm_2 }} using {{ insert: param, pe-6.2_prm_3 }}.
      parameters:
        pe-6.2_prm_1:
          label: "organization-defined classes or types of intrusions"
        pe-6.2_prm_2:
          label: "organization-defined response actions"
        pe-6.2_prm_3:
          label: "organization-defined automated mechanisms"
    pe-06.03:
      label: PE-6(3)
      parent_control: pe-06
      title: Video Surveillance
      statement: |
        (a) Employ video surveillance of {{ insert: param, pe-6.3_prm_1 }};
        (b) Review video recordings {{ insert: param, pe-6.3_prm_2 }}; and
        (c) Retain video recordings for {{ insert: param, pe-6.3_prm_3 }}.
      parameters:
        pe-6.3_prm_1:
          label: "organization-defined operational areas"
        pe-6.3_prm_2:
          label: "organization-defined frequency"
        pe-6.3_prm_3:
          label: "organization-defined time period"
    pe-06.04:
      label: PE-6(4)
      parent_control: pe-06
      title: Monitoring Physical Access to Systems
      statement: |
        Monitor physical access to the system in addition to the physical access monitoring of the facility at {{ insert: param, pe-6.4_prm_1 }}.
      parameters:
        pe-6.4_prm_1:
          label: "organization-defined physical spaces containing one or more components of the system"
    pe-08: 
      label: PE-8
      title: Visitor Access Records
      statement: |
        a. Maintain visitor access records to the facility where the system resides for {{ insert: param, pe-8_prm_1 }};
        b. Review visitor access records {{ insert: param, pe-8_prm_2 }}; and
        c. Report anomalies in visitor access records to {{ insert: param, pe-8_prm_3 }}.
      parameters:
        pe-8_prm_1:
          label: "organization-defined time period"
        pe-8_prm_2:
          label: "organization-defined frequency"
        pe-8_prm_3:
          label: "organization-defined personnel"
    pe-08.01:
      label: PE-8(1)
      parent_control: pe-08
      title: Automated Records Maintenance and Review
      statement: |
        Maintain and review visitor access records using {{ insert: param, pe-8.1_prm_1 }}.
      parameters:
        pe-8.1_prm_1:
          label: "organization-defined automated mechanisms"
    pe-08.03:
      label: PE-8(3)
      parent_control: pe-08
      title: Limit Personally Identifiable Information Elements
      statement: |
        Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: {{ insert: param, pe-8.3_prm_1 }}.
      parameters:
        pe-8.3_prm_1:
          label: "organization-defined elements"
    pe-09: 
      label: PE-9
      title: Power Equipment and Cabling
      statement: |
        Protect power equipment and power cabling for the system from damage and destruction.
    pe-09.01:
      label: PE-9(1)
      parent_control: pe-09
      title: Redundant Cabling
      statement: |
        Employ redundant power cabling paths that are physically separated by {{ insert: param, pe-9.1_prm_1 }}.
      parameters:
        pe-9.1_prm_1:
          label: "organization-defined distance"
    pe-09.02:
      label: PE-9(2)
      parent_control: pe-09
      title: Automatic Voltage Controls
      statement: |
        Employ automatic voltage controls for {{ insert: param, pe-9.2_prm_1 }}.
      parameters:
        pe-9.2_prm_1:
          label: "organization-defined critical system components"
    pe-10: 
      label: PE-10
      title: Emergency Shutoff
      statement: |
        a. Provide the capability of shutting off power to {{ insert: param, pe-10_prm_1 }} in emergency situations;
        b. Place emergency shutoff switches or devices in {{ insert: param, pe-10_prm_2 }} to facilitate access for authorized personnel; and
        c. Protect emergency power shutoff capability from unauthorized activation.
      parameters:
        pe-10_prm_1:
          label: "organization-defined system or individual system components"
        pe-10_prm_2:
          label: "organization-defined location by system or system component"
    pe-11: 
      label: PE-11
      title: Emergency Power
      statement: |
        Provide an uninterruptible power supply to facilitate {{ insert: param, pe-11_prm_1 }} in the event of a primary power source loss.
      parameters:
        pe-11_prm_1:
          how-many: one or more
          choice:
            - "an orderly shutdown of the system"
            - "transition of the system to long-term alternate power"
    pe-11.01:
      label: PE-11(1)
      parent_control: pe-11
      title: Alternate Power Supply — Minimal Operational Capability
      statement: |
        Provide an alternate power supply for the system that is activated {{ insert: param, pe-11.1_prm_1 }} and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.
      parameters:
        pe-11.1_prm_1:
          choice:
            - "manually"
            - "automatically"
    pe-11.02:
      label: PE-11(2)
      parent_control: pe-11
      title: Alternate Power Supply — Self-contained
      statement: |
        Provide an alternate power supply for the system that is activated {{ insert: param, pe-11.2_prm_1 }} and that is:
          (a) Self-contained;
          (b) Not reliant on external power generation; and
          (c) Capable of maintaining {{ insert: param, pe-11.2_prm_2 }} in the event of an extended loss of the primary power source.
      parameters:
        pe-11.2_prm_1:
          choice:
            - "manually"
            - "automatically"
        pe-11.2_prm_2:
          choice:
            - "minimally required operational capability"
            - "full operational capability"
    pe-12: 
      label: PE-12
      title: Emergency Lighting
      statement: |
        Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.
    pe-12.01:
      label: PE-12(1)
      parent_control: pe-12
      title: Essential Mission and Business Functions
      statement: |
        Provide emergency lighting for all areas within the facility supporting essential mission and business functions.
    pe-13: 
      label: PE-13
      title: Fire Protection
      statement: |
        Employ and maintain fire detection and suppression systems that are supported by an independent energy source.
    pe-13.01:
      label: PE-13(1)
      parent_control: pe-13
      title: Detection Systems — Automatic Activation and Notification
      statement: |
        Employ fire detection systems that activate automatically and notify {{ insert: param, pe-13.1_prm_1 }} and {{ insert: param, pe-13.1_prm_2 }} in the event of a fire.
      parameters:
        pe-13.1_prm_1:
          label: "organization-defined personnel or roles"
        pe-13.1_prm_2:
          label: "organization-defined emergency responders"
    pe-13.02:
      label: PE-13(2)
      parent_control: pe-13
      title: Suppression Systems — Automatic Activation and Notification
      statement: |
        (a) Employ fire suppression systems that activate automatically and notify {{ insert: param, pe-13.2_prm_1 }} and {{ insert: param, pe-13.2_prm_2 }}; and
        (b) Employ an automatic fire suppression capability when the facility is not staffed on a continuous basis.
      parameters:
        pe-13.2_prm_1:
          label: "organization-defined personnel or roles"
        pe-13.2_prm_2:
          label: "organization-defined emergency responders"
    pe-13.04:
      label: PE-13(4)
      parent_control: pe-13
      title: Inspections
      statement: |
        Ensure that the facility undergoes {{ insert: param, pe-13.4_prm_1 }} fire protection inspections by authorized and qualified inspectors and identified deficiencies are resolved within {{ insert: param, pe-13.4_prm_2 }}.
      parameters:
        pe-13.4_prm_1:
          label: "organization-defined frequency"
        pe-13.4_prm_2:
          label: "organization-defined time period"
    pe-14: 
      label: PE-14
      title: Environmental Controls
      statement: |
        a. Maintain {{ insert: param, pe-14_prm_1 }} levels within the facility where the system resides at {{ insert: param, pe-14_prm_3 }}; and
        b. Monitor environmental control levels {{ insert: param, pe-14_prm_4 }}.
      parameters:
        pe-14_prm_1:
          how-many: one or more
          choice:
            - "temperature"
            - "humidity"
            - "pressure"
            - "radiation"
            - " {{ insert: param, pe-14_prm_2 }} "
        pe-14_prm_2:
          label: "organization-defined environmental control"
        pe-14_prm_3:
          label: "organization-defined acceptable levels"
        pe-14_prm_4:
          label: "organization-defined frequency"
    pe-14.01:
      label: PE-14(1)
      parent_control: pe-14
      title: Automatic Controls
      statement: |
        Employ the following automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system: {{ insert: param, pe-14.1_prm_1 }}.
      parameters:
        pe-14.1_prm_1:
          label: "organization-defined automatic environmental controls"
    pe-14.02:
      label: PE-14(2)
      parent_control: pe-14
      title: Monitoring with Alarms and Notifications
      statement: |
        Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to {{ insert: param, pe-14.2_prm_1 }}.
      parameters:
        pe-14.2_prm_1:
          label: "organization-defined personnel or roles"
    pe-15: 
      label: PE-15
      title: Water Damage Protection
      statement: |
        Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.
    pe-15.01:
      label: PE-15(1)
      parent_control: pe-15
      title: Automation Support
      statement: |
        Detect the presence of water near the system and alert {{ insert: param, pe-15.1_prm_1 }} using {{ insert: param, pe-15.1_prm_2 }}.
      parameters:
        pe-15.1_prm_1:
          label: "organization-defined personnel or roles"
        pe-15.1_prm_2:
          label: "organization-defined automated mechanisms"
    pe-16: 
      label: PE-16
      title: Delivery and Removal
      statement: |
        a. Authorize and control {{ insert: param, pe-16_prm_1 }} entering and exiting the facility; and
        b. Maintain records of the system components.
      parameters:
        pe-16_prm_1:
          label: "organization-defined types of system components"
    pe-17: 
      label: PE-17
      title: Alternate Work Site
      statement: |
        a. Determine and document the {{ insert: param, pe-17_prm_1 }} allowed for use by employees;
        b. Employ the following controls at alternate work sites: {{ insert: param, pe-17_prm_2 }};
        c. Assess the effectiveness of controls at alternate work sites; and
        d. Provide a means for employees to communicate with information security and privacy personnel in case of incidents.
      parameters:
        pe-17_prm_1:
          label: "organization-defined alternate work sites"
        pe-17_prm_2:
          label: "organization-defined controls"
    pe-18: 
      label: PE-18
      title: Location of System Components
      statement: |
        Position system components within the facility to minimize potential damage from {{ insert: param, pe-18_prm_1 }} and to minimize the opportunity for unauthorized access.
      parameters:
        pe-18_prm_1:
          label: "organization-defined physical and environmental hazards"
    pe-19: 
      label: PE-19
      title: Information Leakage
      statement: |
        Protect the system from information leakage due to electromagnetic signals emanations.
    pe-19.01:
      label: PE-19(1)
      parent_control: pe-19
      title: National Emissions Policies and Procedures
      statement: |
        Protect system components, associated data communications, and networks in accordance with national Emissions Security policies and procedures based on the security category or classification of the information.
    pe-20: 
      label: PE-20
      title: Asset Monitoring and Tracking
      statement: |
        Employ {{ insert: param, pe-20_prm_1 }} to track and monitor the location and movement of {{ insert: param, pe-20_prm_2 }} within {{ insert: param, pe-20_prm_3 }}.
      parameters:
        pe-20_prm_1:
          label: "organization-defined asset location technologies"
        pe-20_prm_2:
          label: "organization-defined assets"
        pe-20_prm_3:
          label: "organization-defined controlled areas"
    pe-21: 
      label: PE-21
      title: Electromagnetic Pulse Protection
      statement: |
        Employ {{ insert: param, pe-21_prm_1 }} against electromagnetic pulse damage for {{ insert: param, pe-21_prm_2 }}. 
      parameters:
        pe-21_prm_1:
          label: "organization-defined protective measures"
        pe-21_prm_2:
          label: "organization-defined systems and system components"
    pe-22: 
      label: PE-22
      title: Component Marking
      statement: |
        Mark {{ insert: param, pe-22_prm_1 }} indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component. 
      parameters:
        pe-22_prm_1:
          label: "organization-defined system hardware components"
    pe-23: 
      label: PE-23
      title: Facility Location
      statement: |
        a. Plan the location or site of the facility where the system resides considering physical and environmental hazards; and
        b. For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy.
pl:
  title: Planning
  controls:
    pl-01: 
      label: PL-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, pl-1_prm_1 }}:
          1.  {{ insert: param, pl-1_prm_2 }} planning policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the planning policy and the associated planning controls;
        b. Designate an {{ insert: param, pl-1_prm_3 }} to manage the development, documentation, and dissemination of the planning policy and procedures; and
        c. Review and update the current planning:
          1. Policy {{ insert: param, pl-1_prm_4 }} and following {{ insert: param, pl-1_prm_5 }}; and
          2. Procedures {{ insert: param, pl-1_prm_6 }} and following {{ insert: param, pl-1_prm_7 }}.
      parameters:
        pl-1_prm_1:
          label: "organization-defined personnel or roles"
        pl-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        pl-1_prm_3:
          label: "organization-defined official"
        pl-1_prm_4:
          label: "organization-defined frequency"
        pl-1_prm_5:
          label: "organization-defined events"
        pl-1_prm_6:
          label: "organization-defined frequency"
        pl-1_prm_7:
          label: "organization-defined events"
    pl-02: 
      label: PL-2
      title: System Security and Privacy Plans
      statement: |
        a. Develop security and privacy plans for the system that:
          1. Are consistent with the organization’s enterprise architecture;
          2. Explicitly define the constituent system components;
          3. Describe the operational context of the system in terms of mission and business processes;
          4. Identify the individuals that fulfill system roles and responsibilities;
          5. Identify the information types processed, stored, and transmitted by the system;
          6. Provide the security categorization of the system, including supporting rationale;
          7. Describe any specific threats to the system that are of concern to the organization; 
          8. Provide the results of a privacy risk assessment for systems processing personally identifiable information;
          9. Describe the operational environment for the system and any dependencies on or connections to other systems or system components;
          10. Provide an overview of the security and privacy requirements for the system;
          11. Identify any relevant control baselines or overlays, if applicable;
          12. Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions;
          13. Include risk determinations for security and privacy architecture and design decisions;
          14. Include security- and privacy-related activities affecting the system that require planning and coordination with {{ insert: param, pl-2_prm_1 }}; and
          15. Are reviewed and approved by the authorizing official or designated representative prior to plan implementation.
        b. Distribute copies of the plans and communicate subsequent changes to the plans to {{ insert: param, pl-2_prm_2 }};
        c. Review the plans {{ insert: param, pl-2_prm_3 }}; 
        d. Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments; and
        e. Protect the plans from unauthorized disclosure and modification.
      parameters:
        pl-2_prm_1:
          label: "organization-defined individuals or groups"
        pl-2_prm_2:
          label: "organization-defined personnel or roles"
        pl-2_prm_3:
          label: "organization-defined frequency"
    pl-04: 
      label: PL-4
      title: Rules of Behavior
      statement: |
        a. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;
        b. Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;
        c. Review and update the rules of behavior {{ insert: param, pl-4_prm_1 }}; and
        d. Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge {{ insert: param, pl-4_prm_2 }}.
      parameters:
        pl-4_prm_1:
          label: "organization-defined frequency"
        pl-4_prm_2:
          how-many: one or more
          choice:
            - " {{ insert: param, pl-4_prm_3 }} "
            - "when the rules are revised or updated"
        pl-4_prm_3:
          label: "organization-defined frequency"
    pl-04.01:
      label: PL-4(1)
      parent_control: pl-04
      title: Social Media and External Site/application Usage Restrictions
      statement: |
        Include in the rules of behavior, restrictions on:
          (a) Use of social media, social networking sites, and external sites/applications;
          (b) Posting organizational information on public websites; and
          (c) Use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
    pl-07: 
      label: PL-7
      title: Concept of Operations
      statement: |
        a. Develop a Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security and privacy; and
        b. Review and update the CONOPS {{ insert: param, pl-7_prm_1 }}.
      parameters:
        pl-7_prm_1:
          label: "organization-defined frequency"
    pl-08: 
      label: PL-8
      title: Security and Privacy Architectures
      statement: |
        a. Develop security and privacy architectures for the system that:
          1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;
          2. Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;
          3. Describe how the architectures are integrated into and support the enterprise architecture; and
          4. Describe any assumptions about, and dependencies on, external systems and services;
        b. Review and update the architectures {{ insert: param, pl-8_prm_1 }} to reflect changes in the enterprise architecture; and
        c. Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.
      parameters:
        pl-8_prm_1:
          label: "organization-defined frequency"
    pl-08.01:
      label: PL-8(1)
      parent_control: pl-08
      title: Defense in Depth
      statement: |
        Design the security and privacy architectures for the system using a defense-in-depth approach that:
          (a) Allocates {{ insert: param, pl-8.1_prm_1 }} to {{ insert: param, pl-8.1_prm_2 }}; and
          (b) Ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.
      parameters:
        pl-8.1_prm_1:
          label: "organization-defined controls"
        pl-8.1_prm_2:
          label: "organization-defined locations and architectural layers"
    pl-08.02:
      label: PL-8(2)
      parent_control: pl-08
      title: Supplier Diversity
      statement: |
        Require that {{ insert: param, pl-8.2_prm_1 }} allocated to {{ insert: param, pl-8.2_prm_2 }} are obtained from different suppliers.
      parameters:
        pl-8.2_prm_1:
          label: "organization-defined controls"
        pl-8.2_prm_2:
          label: "organization-defined locations and architectural layers"
    pl-09: 
      label: PL-9
      title: Central Management
      statement: |
        Centrally manage {{ insert: param, pl-9_prm_1 }}.
      parameters:
        pl-9_prm_1:
          label: "organization-defined controls and related processes"
    pl-10: 
      label: PL-10
      title: Baseline Selection
      statement: |
        Select a control baseline for the system.
    pl-11: 
      label: PL-11
      title: Baseline Tailoring
      statement: |
        Tailor the selected control baseline by applying specified tailoring actions. 
pm:
  title: Program Management
  controls:
    pm-01: 
      label: PM-1
      title: Information Security Program Plan
      statement: |
        a. Develop and disseminate an organization-wide information security program plan that:
          1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
          2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
          3. Reflects the coordination among organizational entities responsible for information security; and
          4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
        b. Review and update the organization-wide information security program plan {{ insert: param, pm-1_prm_1 }} and following {{ insert: param, pm-1_prm_2 }}; and
        c. Protect the information security program plan from unauthorized disclosure and modification.
      parameters:
        pm-1_prm_1:
          label: "organization-defined frequency"
        pm-1_prm_2:
          label: "organization-defined events"
    pm-02: 
      label: PM-2
      title: Information Security Program Leadership Role
      statement: |
        Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.
    pm-03: 
      label: PM-3
      title: Information Security and Privacy Resources
      statement: |
        a. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;
        b. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and
        c. Make available for expenditure, the planned information security and privacy resources.
    pm-04: 
      label: PM-4
      title: Plan of Action and Milestones Process
      statement: |
        a. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:
          1. Are developed and maintained;
          2. Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
          3. Are reported in accordance with established reporting requirements.
        b. Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
    pm-05: 
      label: PM-5
      title: System Inventory
      statement: |
        Develop and update {{ insert: param, pm-5_prm_1 }} an inventory of organizational systems. 
      parameters:
        pm-5_prm_1:
          label: "organization-defined frequency"
    pm-05.01:
      label: PM-5(1)
      parent_control: pm-05
      title: Inventory of Personally Identifiable Information
      statement: |
        Establish, maintain, and update {{ insert: param, pm-5.1_prm_1 }} an inventory of all systems, applications, and projects that process personally identifiable information.
      parameters:
        pm-5.1_prm_1:
          label: "organization-defined frequency"
    pm-06: 
      label: PM-6
      title: Measures of Performance
      statement: |
        Develop, monitor, and report on the results of information security and privacy measures of performance.
    pm-07: 
      label: PM-7
      title: Enterprise Architecture
      statement: |
        Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation. 
    pm-07.01:
      label: PM-7(1)
      parent_control: pm-07
      title: Offloading
      statement: |
        Offload {{ insert: param, pm-7.1_prm_1 }} to other systems, system components, or an external provider.
      parameters:
        pm-7.1_prm_1:
          label: "organization-defined non-essential functions or services"
    pm-08: 
      label: PM-8
      title: Critical Infrastructure Plan
      statement: |
        Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan. 
    pm-09: 
      label: PM-9
      title: Risk Management Strategy
      statement: |
        a. Develops a comprehensive strategy to manage:
          1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
          2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;
        b. Implement the risk management strategy consistently across the organization; and
        c. Review and update the risk management strategy {{ insert: param, pm-9_prm_1 }} or as required, to address organizational changes.
      parameters:
        pm-9_prm_1:
          label: "organization-defined frequency"
    pm-10: 
      label: PM-10
      title: Authorization Process
      statement: |
        a. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;
        b. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
        c. Integrate the authorization processes into an organization-wide risk management program.
    pm-11: 
      label: PM-11
      title: Mission and Business Process Definition
      statement: |
        a. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
        b. Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
        c. Review and revise the mission and business processes {{ insert: param, pm-11_prm_1 }}.
      parameters:
        pm-11_prm_1:
          label: "organization-defined frequency"
    pm-12: 
      label: PM-12
      title: Insider Threat Program
      statement: |
        Implement an insider threat program that includes a cross-discipline insider threat incident handling team.
    pm-13: 
      label: PM-13
      title: Security and Privacy Workforce
      statement: |
        Establish a security and privacy workforce development and improvement program.
    pm-14: 
      label: PM-14
      title: Testing, Training, and Monitoring
      statement: |
        a. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:
          1. Are developed and maintained; and
          2. Continue to be executed; and
        b. Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
    pm-15: 
      label: PM-15
      title: Security and Privacy Groups and Associations
      statement: |
        Establish and institutionalize contact with selected groups and associations within the security and privacy communities:
          a. To facilitate ongoing security and privacy education and training for organizational personnel;
          b. To maintain currency with recommended security and privacy practices, techniques, and technologies; and
          c. To share current security and privacy information, including threats, vulnerabilities, and incidents.
    pm-16: 
      label: PM-16
      title: Threat Awareness Program
      statement: |
        Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.
    pm-16.01:
      label: PM-16(1)
      parent_control: pm-16
      title: Automated Means for Sharing Threat Intelligence
      statement: |
        Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.
    pm-17: 
      label: PM-17
      title: Protecting Controlled Unclassified Information on External Systems
      statement: |
        a. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
        b. Review and update the policy and procedures {{ insert: param, pm-17_prm_1 }}.
      parameters:
        pm-17_prm_1:
          label: "organization-defined frequency"
    pm-18: 
      label: PM-18
      title: Privacy Program Plan
      statement: |
        a. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:
          1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
          2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
          3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
          4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
          5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and
          6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and 
        b. Update the plan {{ insert: param, pm-18_prm_1 }} and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.
      parameters:
        pm-18_prm_1:
          label: "organization-defined frequency"
    pm-19: 
      label: PM-19
      title: Privacy Program Leadership Role
      statement: |
        Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.
    pm-20: 
      label: PM-20
      title: Dissemination of Privacy Program Information
      statement: |
        Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that:
          a. Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy;
          b. Ensures that organizational privacy practices and reports are publicly available; and
          c. Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.
    pm-20.01:
      label: PM-20(1)
      parent_control: pm-20
      title: Privacy Policies on Websites, Applications, and Digital Services
      statement: |
        Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:
          (a) Are written in plain language and organized in a way that is easy to understand and navigate;
          (b) Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and
          (c) Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes. 
    pm-21: 
      label: PM-21
      title: Accounting of Disclosures
      statement: |
        a. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:
          1. Date, nature, and purpose of each disclosure; and
          2. Name and address, or other contact information of the individual or organization to which the disclosure was made;
        b. Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and
        c. Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.
    pm-22: 
      label: PM-22
      title: Personally Identifiable Information Quality Management
      statement: |
        Develop and document organization-wide policies and procedures for:
          a. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; 
          b. Correcting or deleting inaccurate or outdated personally identifiable information;
          c. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and
          d. Appeals of adverse decisions on correction or deletion requests.
    pm-23: 
      label: PM-23
      title: Data Governance Body
      statement: |
        Establish a Data Governance Body consisting of {{ insert: param, pm-23_prm_1 }} with {{ insert: param, pm-23_prm_2 }}.
      parameters:
        pm-23_prm_1:
          label: "organization-defined roles"
        pm-23_prm_2:
          label: "organization-defined responsibilities"
    pm-24: 
      label: PM-24
      title: Data Integrity Board
      statement: |
        Establish a Data Integrity Board to:
          a. Review proposals to conduct or participate in a matching program; and
          b. Conduct an annual review of all matching programs in which the agency has participated.
    pm-25: 
      label: PM-25
      title: Minimization of Personally Identifiable Information Used in Testing, Training, and Research
      statement: |
        a. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;
        b. Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;
        c. Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and
        d. Review and update policies and procedures {{ insert: param, pm-25_prm_1 }}.
      parameters:
        pm-25_prm_1:
          label: "organization-defined frequency"
    pm-26: 
      label: PM-26
      title: Complaint Management
      statement: |
        Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes:
          a. Mechanisms that are easy to use and readily accessible by the public;
          b. All information necessary for successfully filing complaints;
          c. Tracking mechanisms to ensure all complaints received are reviewed and addressed within {{ insert: param, pm-26_prm_1 }};
          d. Acknowledgement of receipt of complaints, concerns, or questions from individuals within {{ insert: param, pm-26_prm_2 }}; and
          e. Response to complaints, concerns, or questions from individuals within {{ insert: param, pm-26_prm_3 }}.
      parameters:
        pm-26_prm_1:
          label: "organization-defined time period"
        pm-26_prm_2:
          label: "organization-defined time period"
        pm-26_prm_3:
          label: "organization-defined time period"
    pm-27: 
      label: PM-27
      title: Privacy Reporting
      statement: |
        a. Develop {{ insert: param, pm-27_prm_1 }} and disseminate to:
          1.  {{ insert: param, pm-27_prm_2 }} to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and
          2.  {{ insert: param, pm-27_prm_3 }} and other personnel with responsibility for monitoring privacy program compliance; and
        b. Review and update privacy reports {{ insert: param, pm-27_prm_4 }}.
      parameters:
        pm-27_prm_1:
          label: "organization-defined privacy reports"
        pm-27_prm_2:
          label: "organization-defined oversight bodies"
        pm-27_prm_3:
          label: "organization-defined officials"
        pm-27_prm_4:
          label: "organization-defined frequency"
    pm-28: 
      label: PM-28
      title: Risk Framing
      statement: |
        a. Identify and document:
          1. Assumptions affecting risk assessments, risk responses, and risk monitoring;
          2. Constraints affecting risk assessments, risk responses, and risk monitoring;
          3. Priorities and trade-offs considered by the organization for managing risk; and
          4. Organizational risk tolerance;
        b. Distribute the results of risk framing activities to {{ insert: param, pm-28_prm_1 }}; and
        c. Review and update risk framing considerations {{ insert: param, pm-28_prm_2 }}.
      parameters:
        pm-28_prm_1:
          label: "organization-defined personnel"
        pm-28_prm_2:
          label: "organization-defined frequency"
    pm-29: 
      label: PM-29
      title: Risk Management Program Leadership Roles
      statement: |
        a. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and
        b. Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.
    pm-30: 
      label: PM-30
      title: Supply Chain Risk Management Strategy
      statement: |
        a. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;
        b. Implement the supply chain risk management strategy consistently across the organization; and
        c. Review and update the supply chain risk management strategy on {{ insert: param, pm-30_prm_1 }} or as required, to address organizational changes.
      parameters:
        pm-30_prm_1:
          label: "organization-defined frequency"
    pm-30.01:
      label: PM-30(1)
      parent_control: pm-30
      title: Suppliers of Critical or Mission-essential Items
      statement: |
        Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services. 
    pm-31: 
      label: PM-31
      title: Continuous Monitoring Strategy
      statement: |
        Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include:
          a. Establishing the following organization-wide metrics to be monitored: {{ insert: param, pm-31_prm_1 }};
          b. Establishing {{ insert: param, pm-31_prm_2 }} for monitoring and {{ insert: param, pm-31_prm_3 }} for assessment of control effectiveness;
          c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy;
          d. Correlation and analysis of information generated by control assessments and monitoring;
          e. Response actions to address results of the analysis of control assessment and monitoring information; and
          f. Reporting the security and privacy status of organizational systems to {{ insert: param, pm-31_prm_4 }} {{ insert: param, pm-31_prm_5 }}.
      parameters:
        pm-31_prm_1:
          label: "organization-defined metrics"
        pm-31_prm_2:
          label: "organization-defined frequencies"
        pm-31_prm_3:
          label: "organization-defined frequencies"
        pm-31_prm_4:
          label: "organization-defined personnel or roles"
        pm-31_prm_5:
          label: "organization-defined frequency"
    pm-32: 
      label: PM-32
      title: Purposing
      statement: |
        Analyze {{ insert: param, pm-32_prm_1 }} supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.
      parameters:
        pm-32_prm_1:
          label: "organization-defined systems or systems components"
ps:
  title: Personnel Security
  controls:
    ps-01: 
      label: PS-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, ps-1_prm_1 }}:
          1.  {{ insert: param, ps-1_prm_2 }} personnel security policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the personnel security policy and the associated personnel security controls;
        b. Designate an {{ insert: param, ps-1_prm_3 }} to manage the development, documentation, and dissemination of the personnel security policy and procedures; and
        c. Review and update the current personnel security:
          1. Policy {{ insert: param, ps-1_prm_4 }} and following {{ insert: param, ps-1_prm_5 }}; and
          2. Procedures {{ insert: param, ps-1_prm_6 }} and following {{ insert: param, ps-1_prm_7 }}.
      parameters:
        ps-1_prm_1:
          label: "organization-defined personnel or roles"
        ps-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        ps-1_prm_3:
          label: "organization-defined official"
        ps-1_prm_4:
          label: "organization-defined frequency"
        ps-1_prm_5:
          label: "organization-defined events"
        ps-1_prm_6:
          label: "organization-defined frequency"
        ps-1_prm_7:
          label: "organization-defined events"
    ps-02: 
      label: PS-2
      title: Position Risk Designation
      statement: |
        a. Assign a risk designation to all organizational positions;
        b. Establish screening criteria for individuals filling those positions; and
        c. Review and update position risk designations {{ insert: param, ps-2_prm_1 }}.
      parameters:
        ps-2_prm_1:
          label: "organization-defined frequency"
    ps-03: 
      label: PS-3
      title: Personnel Screening
      statement: |
        a. Screen individuals prior to authorizing access to the system; and
        b. Rescreen individuals in accordance with {{ insert: param, ps-3_prm_1 }}.
      parameters:
        ps-3_prm_1:
          label: "organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening"
    ps-03.01:
      label: PS-3(1)
      parent_control: ps-03
      title: Classified Information
      statement: |
        Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.
    ps-03.02:
      label: PS-3(2)
      parent_control: ps-03
      title: Formal Indoctrination
      statement: |
        Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, are formally indoctrinated for all the relevant types of information to which they have access on the system.
    ps-03.03:
      label: PS-3(3)
      parent_control: ps-03
      title: Information Requiring Special Protective Measures
      statement: |
        Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection:
          (a) Have valid access authorizations that are demonstrated by assigned official government duties; and
          (b) Satisfy {{ insert: param, ps-3.3_prm_1 }}.
      parameters:
        ps-3.3_prm_1:
          label: "organization-defined additional personnel screening criteria"
    ps-03.04:
      label: PS-3(4)
      parent_control: ps-03
      title: Citizenship Requirements
      statement: |
        Verify that individuals accessing a system processing, storing, or transmitting {{ insert: param, ps-3.4_prm_1 }} meet {{ insert: param, ps-3.4_prm_2 }}.
      parameters:
        ps-3.4_prm_1:
          label: "organization-defined information types"
        ps-3.4_prm_2:
          label: "organization-defined citizenship requirements"
    ps-04: 
      label: PS-4
      title: Personnel Termination
      statement: |
        Upon termination of individual employment:
          a. Disable system access within {{ insert: param, ps-4_prm_1 }};
          b. Terminate or revoke any authenticators and credentials associated with the individual;
          c. Conduct exit interviews that include a discussion of {{ insert: param, ps-4_prm_2 }};
          d. Retrieve all security-related organizational system-related property; and
          e. Retain access to organizational information and systems formerly controlled by terminated individual.
      parameters:
        ps-4_prm_1:
          label: "organization-defined time period"
        ps-4_prm_2:
          label: "organization-defined information security topics"
    ps-04.01:
      label: PS-4(1)
      parent_control: ps-04
      title: Post-employment Requirements
      statement: |
        (a) Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information; and
        (b) Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.
    ps-04.02:
      label: PS-4(2)
      parent_control: ps-04
      title: Automated Actions
      statement: |
        Use {{ insert: param, ps-4.2_prm_1 }} to {{ insert: param, ps-4.2_prm_2 }}.
      parameters:
        ps-4.2_prm_1:
          label: "organization-defined automated mechanisms"
        ps-4.2_prm_2:
          how-many: one or more
          choice:
            - "notify {{ insert: param, ps-4.2_prm_3 }} of individual termination actions"
            - "disable access to system resources"
        ps-4.2_prm_3:
          label: "organization-defined personnel or roles"
    ps-05: 
      label: PS-5
      title: Personnel Transfer
      statement: |
        a. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization;
        b. Initiate {{ insert: param, ps-5_prm_1 }} within {{ insert: param, ps-5_prm_2 }};
        c. Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and
        d. Notify {{ insert: param, ps-5_prm_3 }} within {{ insert: param, ps-5_prm_4 }}.
      parameters:
        ps-5_prm_1:
          label: "organization-defined transfer or reassignment actions"
        ps-5_prm_2:
          label: "organization-defined time period following the formal transfer action"
        ps-5_prm_3:
          label: "organization-defined personnel or roles"
        ps-5_prm_4:
          label: "organization-defined time period"
    ps-06: 
      label: PS-6
      title: Access Agreements
      statement: |
        a. Develop and document access agreements for organizational systems;
        b. Review and update the access agreements {{ insert: param, ps-6_prm_1 }}; and
        c. Verify that individuals requiring access to organizational information and systems: 
          1. Sign appropriate access agreements prior to being granted access; and
          2. Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or {{ insert: param, ps-6_prm_2 }}.
      parameters:
        ps-6_prm_1:
          label: "organization-defined frequency"
        ps-6_prm_2:
          label: "organization-defined frequency"
    ps-06.02:
      label: PS-6(2)
      parent_control: ps-06
      title: Classified Information Requiring Special Protection
      statement: |
        Verify that access to classified information requiring special protection is granted only to individuals who:
          (a) Have a valid access authorization that is demonstrated by assigned official government duties;
          (b) Satisfy associated personnel security criteria; and
          (c) Have read, understood, and signed a nondisclosure agreement.
    ps-06.03:
      label: PS-6(3)
      parent_control: ps-06
      title: Post-employment Requirements
      statement: |
        (a) Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information; and
        (b) Require individuals to sign an acknowledgment of these requirements, if applicable, as part of granting initial access to covered information.
    ps-07: 
      label: PS-7
      title: External Personnel Security
      statement: |
        a. Establish personnel security requirements, including security roles and responsibilities for external providers;
        b. Require external providers to comply with personnel security policies and procedures established by the organization;
        c. Document personnel security requirements;
        d. Require external providers to notify {{ insert: param, ps-7_prm_1 }} of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within {{ insert: param, ps-7_prm_2 }}; and
        e. Monitor provider compliance with personnel security requirements.
      parameters:
        ps-7_prm_1:
          label: "organization-defined personnel or roles"
        ps-7_prm_2:
          label: "organization-defined time period"
    ps-08: 
      label: PS-8
      title: Personnel Sanctions
      statement: |
        a. Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and
        b. Notify {{ insert: param, ps-8_prm_1 }} within {{ insert: param, ps-8_prm_2 }} when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
      parameters:
        ps-8_prm_1:
          label: "organization-defined personnel or roles"
        ps-8_prm_2:
          label: "organization-defined time period"
    ps-09: 
      label: PS-9
      title: Position Descriptions
      statement: |
        Incorporate security and privacy roles and responsibilities into organizational position descriptions.
pt:
  title: Personally Identifiable Information Processing and Transparency
  controls:
    pt-01: 
      label: PT-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, pt-1_prm_1 }}:
          1.  {{ insert: param, pt-1_prm_2 }} personally identifiable information processing and transparency policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls;
        b. Designate an {{ insert: param, pt-1_prm_3 }} to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and
        c. Review and update the current personally identifiable information processing and transparency:
          1. Policy {{ insert: param, pt-1_prm_4 }} and following {{ insert: param, pt-1_prm_5 }}; and
          2. Procedures {{ insert: param, pt-1_prm_6 }} and following {{ insert: param, pt-1_prm_7 }}.
      parameters:
        pt-1_prm_1:
          label: "organization-defined personnel or roles"
        pt-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        pt-1_prm_3:
          label: "organization-defined official"
        pt-1_prm_4:
          label: "organization-defined frequency"
        pt-1_prm_5:
          label: "organization-defined events"
        pt-1_prm_6:
          label: "organization-defined frequency"
        pt-1_prm_7:
          label: "organization-defined events"
    pt-02: 
      label: PT-2
      title: Authority to Process Personally Identifiable Information
      statement: |
        a. Determine and document the {{ insert: param, pt-2_prm_1 }} that permits the {{ insert: param, pt-2_prm_2 }} of personally identifiable information; and
        b. Restrict the {{ insert: param, pt-2_prm_3 }} of personally identifiable information to only that which is authorized.
      parameters:
        pt-2_prm_1:
          label: "organization-defined authority"
        pt-2_prm_2:
          label: "organization-defined processing"
        pt-2_prm_3:
          label: "organization-defined processing"
    pt-02.01:
      label: PT-2(1)
      parent_control: pt-02
      title: Data Tagging
      statement: |
        Attach data tags containing {{ insert: param, pt-2.1_prm_1 }} to {{ insert: param, pt-2.1_prm_2 }}.
      parameters:
        pt-2.1_prm_1:
          label: "organization-defined authorized processing"
        pt-2.1_prm_2:
          label: "organization-defined elements of personally identifiable information"
    pt-02.02:
      label: PT-2(2)
      parent_control: pt-02
      title: Automation
      statement: |
        Manage enforcement of the authorized processing of personally identifiable information using {{ insert: param, pt-2.2_prm_1 }}.
      parameters:
        pt-2.2_prm_1:
          label: "organization-defined automated mechanisms"
    pt-03: 
      label: PT-3
      title: Personally Identifiable Information Processing Purposes
      statement: |
        a. Identify and document the {{ insert: param, pt-3_prm_1 }} for processing personally identifiable information;
        b. Describe the purpose(s) in the public privacy notices and policies of the organization; 
        c. Restrict the {{ insert: param, pt-3_prm_2 }} of personally identifiable information to only that which is compatible with the identified purpose(s); and 
        d. Monitor changes in processing personally identifiable information and implement {{ insert: param, pt-3_prm_3 }} to ensure that any changes are made in accordance with {{ insert: param, pt-3_prm_4 }}.
      parameters:
        pt-3_prm_1:
          label: "organization-defined purpose(s)"
        pt-3_prm_2:
          label: "organization-defined processing"
        pt-3_prm_3:
          label: "organization-defined mechanisms"
        pt-3_prm_4:
          label: "organization-defined requirements"
    pt-03.01:
      label: PT-3(1)
      parent_control: pt-03
      title: Data Tagging
      statement: |
        Attach data tags containing the following purposes to {{ insert: param, pt-3.1_prm_1 }}: {{ insert: param, pt-3.1_prm_2 }}.
      parameters:
        pt-3.1_prm_1:
          label: "organization-defined elements of personally identifiable information"
        pt-3.1_prm_2:
          label: "organization-defined processing purposes"
    pt-03.02:
      label: PT-3(2)
      parent_control: pt-03
      title: Automation
      statement: |
        Track processing purposes of personally identifiable information using {{ insert: param, pt-3.2_prm_1 }}.
      parameters:
        pt-3.2_prm_1:
          label: "organization-defined automated mechanisms"
    pt-04: 
      label: PT-4
      title: Consent
      statement: |
        Implement {{ insert: param, pt-4_prm_1 }} for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
      parameters:
        pt-4_prm_1:
          label: "organization-defined tools or mechanisms"
    pt-04.01:
      label: PT-4(1)
      parent_control: pt-04
      title: Tailored Consent
      statement: |
        Provide {{ insert: param, pt-4.1_prm_1 }} to allow individuals to tailor processing permissions to selected elements of personally identifiable information.
      parameters:
        pt-4.1_prm_1:
          label: "organization-defined mechanisms"
    pt-04.02:
      label: PT-4(2)
      parent_control: pt-04
      title: Just-in-time Consent
      statement: |
        Present {{ insert: param, pt-4.2_prm_1 }} to individuals at {{ insert: param, pt-4.2_prm_2 }} and in conjunction with {{ insert: param, pt-4.2_prm_3 }}.
      parameters:
        pt-4.2_prm_1:
          label: "organization-defined consent mechanisms"
        pt-4.2_prm_2:
          label: "organization-defined frequency"
        pt-4.2_prm_3:
          label: "organization-defined personally identifiable information processing"
    pt-04.03:
      label: PT-4(3)
      parent_control: pt-04
      title: Revocation
      statement: |
        Implement {{ insert: param, pt-4.3_prm_1 }} for individuals to revoke consent to the processing of their personally identifiable information. 
      parameters:
        pt-4.3_prm_1:
          label: "organization-defined tools or mechanisms"
    pt-05: 
      label: PT-5
      title: Privacy Notice
      statement: |
        Provide notice to individuals about the processing of personally identifiable information that:
          a. Is available to individuals upon first interacting with an organization, and subsequently at {{ insert: param, pt-5_prm_1 }};
          b. Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language;
          c. Identifies the authority that authorizes the processing of personally identifiable information;
          d. Identifies the purposes for which personally identifiable information is to be processed; and
          e. Includes {{ insert: param, pt-5_prm_2 }}.
      parameters:
        pt-5_prm_1:
          label: "organization-defined frequency"
        pt-5_prm_2:
          label: "organization-defined information"
    pt-05.01:
      label: PT-5(1)
      parent_control: pt-05
      title: Just-in-time Notice
      statement: |
        Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action, or {{ insert: param, pt-5.1_prm_1 }}.
      parameters:
        pt-5.1_prm_1:
          label: "organization-defined frequency"
    pt-05.02:
      label: PT-5(2)
      parent_control: pt-05
      title: Privacy Act Statements
      statement: |
        Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.
    pt-06: 
      label: PT-6
      title: System of Records Notice
      statement: |
        For systems that process information that will be maintained in a Privacy Act system of records:
          a. Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the OMB and appropriate congressional committees for advance review;
          b. Publish system of records notices in the Federal Register; and
          c. Keep system of records notices accurate, up-to-date, and scoped in accordance with policy.
    pt-06.01:
      label: PT-6(1)
      parent_control: pt-06
      title: Routine Uses
      statement: |
        Review all routine uses published in the system of records notice at {{ insert: param, pt-6.1_prm_1 }} to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.
      parameters:
        pt-6.1_prm_1:
          label: "organization-defined frequency"
    pt-06.02:
      label: PT-6(2)
      parent_control: pt-06
      title: Exemption Rules
      statement: |
        Review all Privacy Act exemptions claimed for the system of records at {{ insert: param, pt-6.2_prm_1 }} to ensure they remain appropriate and necessary in accordance with law, that they have been promulgated as regulations, and that they are accurately described in the system of records notice.
      parameters:
        pt-6.2_prm_1:
          label: "organization-defined frequency"
    pt-07: 
      label: PT-7
      title: Specific Categories of Personally Identifiable Information
      statement: |
        Apply {{ insert: param, pt-7_prm_1 }} for specific categories of personally identifiable information. 
      parameters:
        pt-7_prm_1:
          label: "organization-defined processing conditions"
    pt-07.01:
      label: PT-7(1)
      parent_control: pt-07
      title: Social Security Numbers
      statement: |
        When a system processes Social Security numbers:
          (a) Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier;
          (b) Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and
          (c) Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.
    pt-07.02:
      label: PT-7(2)
      parent_control: pt-07
      title: First Amendment Information
      statement: |
        Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.
    pt-08: 
      label: PT-8
      title: Computer Matching Requirements
      statement: |
        When a system or organization processes information for the purpose of conducting a matching program:
          a. Obtain approval from the Data Integrity Board to conduct the matching program;
          b. Develop and enter into a computer matching agreement;
          c. Publish a matching notice in the Federal Register;
          d. Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and
          e. Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.
ra:
  title: Risk Assessment
  controls:
    ra-01: 
      label: RA-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, ra-1_prm_1 }}:
          1.  {{ insert: param, ra-1_prm_2 }} risk assessment policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls;
        b. Designate an {{ insert: param, ra-1_prm_3 }} to manage the development, documentation, and dissemination of the risk assessment policy and procedures; and
        c. Review and update the current risk assessment:
          1. Policy {{ insert: param, ra-1_prm_4 }} and following {{ insert: param, ra-1_prm_5 }}; and
          2. Procedures {{ insert: param, ra-1_prm_6 }} and following {{ insert: param, ra-1_prm_7 }}.
      parameters:
        ra-1_prm_1:
          label: "organization-defined personnel or roles"
        ra-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        ra-1_prm_3:
          label: "organization-defined official"
        ra-1_prm_4:
          label: "organization-defined frequency"
        ra-1_prm_5:
          label: "organization-defined events"
        ra-1_prm_6:
          label: "organization-defined frequency"
        ra-1_prm_7:
          label: "organization-defined events"
    ra-02: 
      label: RA-2
      title: Security Categorization
      statement: |
        a. Categorize the system and information it processes, stores, and transmits;
        b. Document the security categorization results, including supporting rationale, in the security plan for the system; and
        c. Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
    ra-02.01:
      label: RA-2(1)
      parent_control: ra-02
      title: Impact-level Prioritization
      statement: |
        Conduct an impact-level prioritization of organizational systems to obtain additional granularity on system impact levels.
    ra-03: 
      label: RA-3
      title: Risk Assessment
      statement: |
        a. Conduct a risk assessment, including:
          1. Identifying threats to and vulnerabilities in the system;
          2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and
          3. Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
        b. Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;
        c. Document risk assessment results in {{ insert: param, ra-3_prm_1 }};
        d. Review risk assessment results {{ insert: param, ra-3_prm_3 }};
        e. Disseminate risk assessment results to {{ insert: param, ra-3_prm_4 }}; and
        f. Update the risk assessment {{ insert: param, ra-3_prm_5 }} or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.
      parameters:
        ra-3_prm_1:
          choice:
            - "security and privacy plans"
            - "risk assessment report"
            - " {{ insert: param, ra-3_prm_2 }} "
        ra-3_prm_2:
          label: "organization-defined document"
        ra-3_prm_3:
          label: "organization-defined frequency"
        ra-3_prm_4:
          label: "organization-defined personnel or roles"
        ra-3_prm_5:
          label: "organization-defined frequency"
    ra-03.01:
      label: RA-3(1)
      parent_control: ra-03
      title: Supply Chain Risk Assessment
      statement: |
        (a) Assess supply chain risks associated with {{ insert: param, ra-3.1_prm_1 }}; and
        (b) Update the supply chain risk assessment {{ insert: param, ra-3.1_prm_2 }}, when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.
      parameters:
        ra-3.1_prm_1:
          label: "organization-defined systems, system components, and system services"
        ra-3.1_prm_2:
          label: "organization-defined frequency"
    ra-03.02:
      label: RA-3(2)
      parent_control: ra-03
      title: Use of All-source Intelligence
      statement: |
        Use all-source intelligence to assist in the analysis of risk.
    ra-03.03:
      label: RA-3(3)
      parent_control: ra-03
      title: Dynamic Threat Awareness
      statement: |
        Determine the current cyber threat environment on an ongoing basis using {{ insert: param, ra-3.3_prm_1 }}.
      parameters:
        ra-3.3_prm_1:
          label: "organization-defined means"
    ra-03.04:
      label: RA-3(4)
      parent_control: ra-03
      title: Predictive Cyber Analytics
      statement: |
        Employ the following advanced automation and analytics capabilities to predict and identify risks to {{ insert: param, ra-3.4_prm_1 }}: {{ insert: param, ra-3.4_prm_2 }}.
      parameters:
        ra-3.4_prm_1:
          label: "organization-defined systems or system components"
        ra-3.4_prm_2:
          label: "organization-defined advanced automation and analytics capabilities"
    ra-05: 
      label: RA-5
      title: Vulnerability Monitoring and Scanning
      statement: |
        a. Monitor and scan for vulnerabilities in the system and hosted applications {{ insert: param, ra-5_prm_1 }} and when new vulnerabilities potentially affecting the system are identified and reported;
        b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
          1. Enumerating platforms, software flaws, and improper configurations;
          2. Formatting checklists and test procedures; and
          3. Measuring vulnerability impact; 
        c. Analyze vulnerability scan reports and results from vulnerability monitoring;
        d. Remediate legitimate vulnerabilities {{ insert: param, ra-5_prm_2 }} in accordance with an organizational assessment of risk;
        e. Share information obtained from the vulnerability monitoring process and control assessments with {{ insert: param, ra-5_prm_3 }} to help eliminate similar vulnerabilities in other systems; and
        f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.
      parameters:
        ra-5_prm_1:
          label: "organization-defined frequency and/or randomly in accordance with organization-defined process"
        ra-5_prm_2:
          label: "organization-defined response times"
        ra-5_prm_3:
          label: "organization-defined personnel or roles"
    ra-05.02:
      label: RA-5(2)
      parent_control: ra-05
      title: Update Vulnerabilities to Be Scanned
      statement: |
        Update the system vulnerabilities to be scanned {{ insert: param, ra-5.2_prm_1 }}.
      parameters:
        ra-5.2_prm_1:
          how-many: one or more
          choice:
            - " {{ insert: param, ra-5.2_prm_2 }} "
            - "prior to a new scan"
            - "when new vulnerabilities are identified and reported"
        ra-5.2_prm_2:
          label: "organization-defined frequency"
    ra-05.03:
      label: RA-5(3)
      parent_control: ra-05
      title: Breadth and Depth of Coverage
      statement: |
        Define the breadth and depth of vulnerability scanning coverage.
    ra-05.04:
      label: RA-5(4)
      parent_control: ra-05
      title: Discoverable Information
      statement: |
        Determine information about the system that is discoverable and take {{ insert: param, ra-5.4_prm_1 }}.
      parameters:
        ra-5.4_prm_1:
          label: "organization-defined corrective actions"
    ra-05.05:
      label: RA-5(5)
      parent_control: ra-05
      title: Privileged Access
      statement: |
        Implement privileged access authorization to {{ insert: param, ra-5.5_prm_1 }} for {{ insert: param, ra-5.5_prm_2 }}.
      parameters:
        ra-5.5_prm_1:
          label: "organization-defined system components"
        ra-5.5_prm_2:
          label: "organization-defined vulnerability scanning activities"
    ra-05.06:
      label: RA-5(6)
      parent_control: ra-05
      title: Automated Trend Analyses
      statement: |
        Compare the results of multiple vulnerability scans using {{ insert: param, ra-5.6_prm_1 }}.
      parameters:
        ra-5.6_prm_1:
          label: "organization-defined automated mechanisms"
    ra-05.08:
      label: RA-5(8)
      parent_control: ra-05
      title: Review Historic Audit Logs
      statement: |
        Review historic audit logs to determine if a vulnerability identified in a {{ insert: param, ra-5.8_prm_1 }} has been previously exploited within an {{ insert: param, ra-5.8_prm_2 }}.
      parameters:
        ra-5.8_prm_1:
          label: "organization-defined system"
        ra-5.8_prm_2:
          label: "organization-defined time period"
    ra-05.10:
      label: RA-5(10)
      parent_control: ra-05
      title: Correlate Scanning Information
      statement: |
        Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.
    ra-05.11:
      label: RA-5(11)
      parent_control: ra-05
      title: Public Disclosure Program
      statement: |
        Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.
    ra-06: 
      label: RA-6
      title: Technical Surveillance Countermeasures Survey
      statement: |
        Employ a technical surveillance countermeasures survey at {{ insert: param, ra-6_prm_1 }} {{ insert: param, ra-6_prm_2 }}.
      parameters:
        ra-6_prm_1:
          label: "organization-defined locations"
        ra-6_prm_2:
          how-many: one or more
          choice:
            - " {{ insert: param, ra-6_prm_3 }} "
            - "when the following events or indicators occur: {{ insert: param, ra-6_prm_4 }} "
        ra-6_prm_3:
          label: "organization-defined frequency"
        ra-6_prm_4:
          label: "organization-defined events or indicators"
    ra-07: 
      label: RA-7
      title: Risk Response
      statement: |
        Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.
    ra-08: 
      label: RA-8
      title: Privacy Impact Assessments
      statement: |
        Conduct privacy impact assessments for systems, programs, or other activities before:
          a. Developing or procuring information technology that processes personally identifiable information; and
          b. Initiating a new collection of personally identifiable information that:
            1. Will be processed using information technology; and
            2. Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.
    ra-09: 
      label: RA-9
      title: Criticality Analysis
      statement: |
        Identify critical system components and functions by performing a criticality analysis for {{ insert: param, ra-9_prm_1 }} at {{ insert: param, ra-9_prm_2 }}.
      parameters:
        ra-9_prm_1:
          label: "organization-defined systems, system components, or system services"
        ra-9_prm_2:
          label: "organization-defined decision points in the system development life cycle"
    ra-10: 
      label: RA-10
      title: Threat Hunting
      statement: |
        a. Establish and maintain a cyber threat hunting capability to:
          1. Search for indicators of compromise in organizational systems; and
          2. Detect, track, and disrupt threats that evade existing controls; and
        b. Employ the threat hunting capability {{ insert: param, ra-10_prm_1 }}.
      parameters:
        ra-10_prm_1:
          label: "organization-defined frequency"
sa:
  title: System and Services Acquisition
  controls:
    sa-01: 
      label: SA-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, sa-1_prm_1 }}:
          1.  {{ insert: param, sa-1_prm_2 }} system and services acquisition policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the system and services acquisition policy and the associated system and services acquisition controls;
        b. Designate an {{ insert: param, sa-1_prm_3 }} to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; and
        c. Review and update the current system and services acquisition:
          1. Policy {{ insert: param, sa-1_prm_4 }} and following {{ insert: param, sa-1_prm_5 }}; and
          2. Procedures {{ insert: param, sa-1_prm_6 }} and following {{ insert: param, sa-1_prm_7 }}.
      parameters:
        sa-1_prm_1:
          label: "organization-defined personnel or roles"
        sa-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        sa-1_prm_3:
          label: "organization-defined official"
        sa-1_prm_4:
          label: "organization-defined frequency"
        sa-1_prm_5:
          label: "organization-defined events"
        sa-1_prm_6:
          label: "organization-defined frequency"
        sa-1_prm_7:
          label: "organization-defined events"
    sa-02: 
      label: SA-2
      title: Allocation of Resources
      statement: |
        a. Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning;
        b. Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and
        c. Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.
    sa-03: 
      label: SA-3
      title: System Development Life Cycle
      statement: |
        a. Acquire, develop, and manage the system using {{ insert: param, sa-3_prm_1 }} that incorporates information security and privacy considerations;
        b. Define and document information security and privacy roles and responsibilities throughout the system development life cycle;
        c. Identify individuals having information security and privacy roles and responsibilities; and
        d. Integrate the organizational information security and privacy risk management process into system development life cycle activities.
      parameters:
        sa-3_prm_1:
          label: "organization-defined system development life cycle"
    sa-03.01:
      label: SA-3(1)
      parent_control: sa-03
      title: Manage Preproduction Environment
      statement: |
        Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service.
    sa-03.02:
      label: SA-3(2)
      parent_control: sa-03
      title: Use of Live or Operational Data
      statement: |
        (a) Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service; and
        (b) Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments. 
    sa-03.03:
      label: SA-3(3)
      parent_control: sa-03
      title: Technology Refresh
      statement: |
        Plan for and implement a technology refresh schedule for the system throughout the system development life cycle.
    sa-04: 
      label: SA-4
      title: Acquisition Process
      statement: |
        Include the following requirements, descriptions, and criteria, explicitly or by reference, using {{ insert: param, sa-4_prm_1 }} in the acquisition contract for the system, system component, or system service:
          a. Security and privacy functional requirements;
          b. Strength of mechanism requirements;
          c. Security and privacy assurance requirements;
          d. Controls needed to satisfy the security and privacy requirements.
          e. Security and privacy documentation requirements;
          f. Requirements for protecting security and privacy documentation;
          g. Description of the system development environment and environment in which the system is intended to operate;
          h. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and
          i. Acceptance criteria.
      parameters:
        sa-4_prm_1:
          how-many: one or more
          choice:
            - "standardized contract language"
            - " {{ insert: param, sa-4_prm_2 }} "
        sa-4_prm_2:
          label: "organization-defined contract language"
    sa-04.01:
      label: SA-4(1)
      parent_control: sa-04
      title: Functional Properties of Controls
      statement: |
        Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.
    sa-04.02:
      label: SA-4(2)
      parent_control: sa-04
      title: Design and Implementation Information for Controls
      statement: |
        Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: {{ insert: param, sa-4.2_prm_1 }} at {{ insert: param, sa-4.2_prm_3 }}.
      parameters:
        sa-4.2_prm_1:
          how-many: one or more
          choice:
            - "security-relevant external system interfaces"
            - "high-level design"
            - "low-level design"
            - "source code or hardware schematics"
            - " {{ insert: param, sa-4.2_prm_2 }} "
        sa-4.2_prm_2:
          label: "organization-defined design and implementation information"
        sa-4.2_prm_3:
          label: "organization-defined level of detail"
    sa-04.03:
      label: SA-4(3)
      parent_control: sa-04
      title: Development Methods, Techniques, and Practices
      statement: |
        Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes:
          (a)  {{ insert: param, sa-4.3_prm_1 }};
          (b)  {{ insert: param, sa-4.3_prm_2 }}; and
          (c)  {{ insert: param, sa-4.3_prm_3 }}.
      parameters:
        sa-4.3_prm_1:
          label: "organization-defined systems engineering methods"
        sa-4.3_prm_2:
          label: "organization-defined [Selection (one or more): systems security; privacy] engineering methods"
        sa-4.3_prm_3:
          label: "organization-defined software development methods; testing, evaluation, assessment, verification, and validation methods; and quality control processes"
    sa-04.05:
      label: SA-4(5)
      parent_control: sa-04
      title: System, Component, and Service Configurations
      statement: |
        Require the developer of the system, system component, or system service to:
          (a) Deliver the system, component, or service with {{ insert: param, sa-4.5_prm_1 }} implemented; and
          (b) Use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade.
      parameters:
        sa-4.5_prm_1:
          label: "organization-defined security configurations"
    sa-04.06:
      label: SA-4(6)
      parent_control: sa-04
      title: Use of Information Assurance Products
      statement: |
        (a) Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted; and
        (b) Ensure that these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.
    sa-04.07:
      label: SA-4(7)
      parent_control: sa-04
      title: Niap-approved Protection Profiles
      statement: |
        (a) Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists; and
        (b) Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.
    sa-04.08:
      label: SA-4(8)
      parent_control: sa-04
      title: Continuous Monitoring Plan for Controls
      statement: |
        Require the developer of the system, system component, or system service to produce a plan for continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.
    sa-04.09:
      label: SA-4(9)
      parent_control: sa-04
      title: Functions, Ports, Protocols, and Services in Use
      statement: |
        Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.
    sa-04.10:
      label: SA-4(10)
      parent_control: sa-04
      title: Use of Approved PIV Products
      statement: |
        Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.
    sa-04.11:
      label: SA-4(11)
      parent_control: sa-04
      title: System of Records
      statement: |
        Include {{ insert: param, sa-4.11_prm_1 }} in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.
      parameters:
        sa-4.11_prm_1:
          label: "organization-defined Privacy Act requirements"
    sa-04.12:
      label: SA-4(12)
      parent_control: sa-04
      title: Data Ownership
      statement: |
        (a) Include organizational data ownership requirements in the acquisition contract; and
        (b) Require all data to be removed from the contractor’s system and returned to the organization within {{ insert: param, sa-4.12_prm_1 }}.
      parameters:
        sa-4.12_prm_1:
          label: "organization-defined time frame"
    sa-05: 
      label: SA-5
      title: System Documentation
      statement: |
        a. Obtain or develop administrator documentation for the system, system component, or system service that describes:
          1. Secure configuration, installation, and operation of the system, component, or service; 
          2. Effective use and maintenance of security and privacy functions and mechanisms; and
          3. Known vulnerabilities regarding configuration and use of administrative or privileged functions;
        b. Obtain or develop user documentation for the system, system component, or system service that describes:
          1. User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms;
          2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and
          3. User responsibilities in maintaining the security of the system, component, or service and privacy of individuals;
        c. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take {{ insert: param, sa-5_prm_1 }} in response; and
        d. Distribute documentation to {{ insert: param, sa-5_prm_2 }}.
      parameters:
        sa-5_prm_1:
          label: "organization-defined actions"
        sa-5_prm_2:
          label: "organization-defined personnel or roles"
    sa-08: 
      label: SA-8
      title: Security and Privacy Engineering Principles
      statement: |
        Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: {{ insert: param, sa-8_prm_1 }}.
      parameters:
        sa-8_prm_1:
          label: "organization-defined systems security and privacy engineering principles"
    sa-08.01:
      label: SA-8(1)
      parent_control: sa-08
      title: Clear Abstractions
      statement: |
        Implement the security design principle of clear abstractions.
    sa-08.02:
      label: SA-8(2)
      parent_control: sa-08
      title: Least Common Mechanism
      statement: |
        Implement the security design principle of least common mechanism in {{ insert: param, sa-8.2_prm_1 }}.
      parameters:
        sa-8.2_prm_1:
          label: "organization-defined systems or system components"
    sa-08.03:
      label: SA-8(3)
      parent_control: sa-08
      title: Modularity and Layering
      statement: |
        Implement the security design principles of modularity and layering in {{ insert: param, sa-8.3_prm_1 }}.
      parameters:
        sa-8.3_prm_1:
          label: "organization-defined systems or system components"
    sa-08.04:
      label: SA-8(4)
      parent_control: sa-08
      title: Partially Ordered Dependencies
      statement: |
        Implement the security design principle of partially ordered dependencies in {{ insert: param, sa-8.4_prm_1 }}.
      parameters:
        sa-8.4_prm_1:
          label: "organization-defined systems or system components"
    sa-08.05:
      label: SA-8(5)
      parent_control: sa-08
      title: Efficiently Mediated Access
      statement: |
        Implement the security design principle of efficiently mediated access in {{ insert: param, sa-8.5_prm_1 }}.
      parameters:
        sa-8.5_prm_1:
          label: "organization-defined systems or system components"
    sa-08.06:
      label: SA-8(6)
      parent_control: sa-08
      title: Minimized Sharing
      statement: |
        Implement the security design principle of minimized sharing in {{ insert: param, sa-8.6_prm_1 }}.
      parameters:
        sa-8.6_prm_1:
          label: "organization-defined systems or system components"
    sa-08.07:
      label: SA-8(7)
      parent_control: sa-08
      title: Reduced Complexity
      statement: |
        Implement the security design principle of reduced complexity in {{ insert: param, sa-8.7_prm_1 }}.
      parameters:
        sa-8.7_prm_1:
          label: "organization-defined systems or system components"
    sa-08.08:
      label: SA-8(8)
      parent_control: sa-08
      title: Secure Evolvability
      statement: |
        Implement the security design principle of secure evolvability in {{ insert: param, sa-8.8_prm_1 }}.
      parameters:
        sa-8.8_prm_1:
          label: "organization-defined systems or system components"
    sa-08.09:
      label: SA-8(9)
      parent_control: sa-08
      title: Trusted Components
      statement: |
        Implement the security design principle of trusted components in {{ insert: param, sa-8.9_prm_1 }}.
      parameters:
        sa-8.9_prm_1:
          label: "organization-defined systems or system components"
    sa-08.10:
      label: SA-8(10)
      parent_control: sa-08
      title: Hierarchical Trust
      statement: |
        Implement the security design principle of hierarchical trust in {{ insert: param, sa-8.10_prm_1 }}.
      parameters:
        sa-8.10_prm_1:
          label: "organization-defined systems or system components"
    sa-08.11:
      label: SA-8(11)
      parent_control: sa-08
      title: Inverse Modification Threshold
      statement: |
        Implement the security design principle of inverse modification threshold in {{ insert: param, sa-8.11_prm_1 }}.
      parameters:
        sa-8.11_prm_1:
          label: "organization-defined systems or system components"
    sa-08.12:
      label: SA-8(12)
      parent_control: sa-08
      title: Hierarchical Protection
      statement: |
        Implement the security design principle of hierarchical protection in {{ insert: param, sa-8.12_prm_1 }}.
      parameters:
        sa-8.12_prm_1:
          label: "organization-defined systems or system components"
    sa-08.13:
      label: SA-8(13)
      parent_control: sa-08
      title: Minimized Security Elements
      statement: |
        Implement the security design principle of minimized security elements in {{ insert: param, sa-8.13_prm_1 }}.
      parameters:
        sa-8.13_prm_1:
          label: "organization-defined systems or system components"
    sa-08.14:
      label: SA-8(14)
      parent_control: sa-08
      title: Least Privilege
      statement: |
        Implement the security design principle of least privilege in {{ insert: param, sa-8.14_prm_1 }}.
      parameters:
        sa-8.14_prm_1:
          label: "organization-defined systems or system components"
    sa-08.15:
      label: SA-8(15)
      parent_control: sa-08
      title: Predicate Permission
      statement: |
        Implement the security design principle of predicate permission in {{ insert: param, sa-8.15_prm_1 }}.
      parameters:
        sa-8.15_prm_1:
          label: "organization-defined systems or system components"
    sa-08.16:
      label: SA-8(16)
      parent_control: sa-08
      title: Self-reliant Trustworthiness
      statement: |
        Implement the security design principle of self-reliant trustworthiness in {{ insert: param, sa-8.16_prm_1 }}.
      parameters:
        sa-8.16_prm_1:
          label: "organization-defined systems or system components"
    sa-08.17:
      label: SA-8(17)
      parent_control: sa-08
      title: Secure Distributed Composition
      statement: |
        Implement the security design principle of secure distributed composition in {{ insert: param, sa-8.17_prm_1 }}.
      parameters:
        sa-8.17_prm_1:
          label: "organization-defined systems or system components"
    sa-08.18:
      label: SA-8(18)
      parent_control: sa-08
      title: Trusted Communications Channels
      statement: |
        Implement the security design principle of trusted communications channels in {{ insert: param, sa-8.18_prm_1 }}.
      parameters:
        sa-8.18_prm_1:
          label: "organization-defined systems or system components"
    sa-08.19:
      label: SA-8(19)
      parent_control: sa-08
      title: Continuous Protection
      statement: |
        Implement the security design principle of continuous protection in {{ insert: param, sa-8.19_prm_1 }}.
      parameters:
        sa-8.19_prm_1:
          label: "organization-defined systems or system components"
    sa-08.20:
      label: SA-8(20)
      parent_control: sa-08
      title: Secure Metadata Management
      statement: |
        Implement the security design principle of secure metadata management in {{ insert: param, sa-8.20_prm_1 }}.
      parameters:
        sa-8.20_prm_1:
          label: "organization-defined systems or system components"
    sa-08.21:
      label: SA-8(21)
      parent_control: sa-08
      title: Self-analysis
      statement: |
        Implement the security design principle of self-analysis in {{ insert: param, sa-8.21_prm_1 }}.
      parameters:
        sa-8.21_prm_1:
          label: "organization-defined systems or system components"
    sa-08.22:
      label: SA-8(22)
      parent_control: sa-08
      title: Accountability and Traceability
      statement: |
        Implement the security design principle of accountability and traceability in {{ insert: param, sa-8.22_prm_1 }}.
      parameters:
        sa-8.22_prm_1:
          label: "organization-defined systems or system components"
    sa-08.23:
      label: SA-8(23)
      parent_control: sa-08
      title: Secure Defaults
      statement: |
        Implement the security design principle of secure defaults in {{ insert: param, sa-8.23_prm_1 }}.
      parameters:
        sa-8.23_prm_1:
          label: "organization-defined systems or system components"
    sa-08.24:
      label: SA-8(24)
      parent_control: sa-08
      title: Secure Failure and Recovery
      statement: |
        Implement the security design principle of secure failure and recovery in {{ insert: param, sa-8.24_prm_1 }}.
      parameters:
        sa-8.24_prm_1:
          label: "organization-defined systems or system components"
    sa-08.25:
      label: SA-8(25)
      parent_control: sa-08
      title: Economic Security
      statement: |
        Implement the security design principle of economic security in {{ insert: param, sa-8.25_prm_1 }}.
      parameters:
        sa-8.25_prm_1:
          label: "organization-defined systems or system components"
    sa-08.26:
      label: SA-8(26)
      parent_control: sa-08
      title: Performance Security
      statement: |
        Implement the security design principle of performance security in {{ insert: param, sa-8.26_prm_1 }}.
      parameters:
        sa-8.26_prm_1:
          label: "organization-defined systems or system components"
    sa-08.27:
      label: SA-8(27)
      parent_control: sa-08
      title: Human Factored Security
      statement: |
        Implement the security design principle of human factored security in {{ insert: param, sa-8.27_prm_1 }}.
      parameters:
        sa-8.27_prm_1:
          label: "organization-defined systems or system components"
    sa-08.28:
      label: SA-8(28)
      parent_control: sa-08
      title: Acceptable Security
      statement: |
        Implement the security design principle of acceptable security in {{ insert: param, sa-8.28_prm_1 }}.
      parameters:
        sa-8.28_prm_1:
          label: "organization-defined systems or system components"
    sa-08.29:
      label: SA-8(29)
      parent_control: sa-08
      title: Repeatable and Documented Procedures
      statement: |
        Implement the security design principle of repeatable and documented procedures in {{ insert: param, sa-8.29_prm_1 }}.
      parameters:
        sa-8.29_prm_1:
          label: "organization-defined systems or system components"
    sa-08.30:
      label: SA-8(30)
      parent_control: sa-08
      title: Procedural Rigor
      statement: |
        Implement the security design principle of procedural rigor in {{ insert: param, sa-8.30_prm_1 }}.
      parameters:
        sa-8.30_prm_1:
          label: "organization-defined systems or system components"
    sa-08.31:
      label: SA-8(31)
      parent_control: sa-08
      title: Secure System Modification
      statement: |
        Implement the security design principle of secure system modification in {{ insert: param, sa-8.31_prm_1 }}.
      parameters:
        sa-8.31_prm_1:
          label: "organization-defined systems or system components"
    sa-08.32:
      label: SA-8(32)
      parent_control: sa-08
      title: Sufficient Documentation
      statement: |
        Implement the security design principle of sufficient documentation in {{ insert: param, sa-8.32_prm_1 }}.
      parameters:
        sa-8.32_prm_1:
          label: "organization-defined systems or system components"
    sa-08.33:
      label: SA-8(33)
      parent_control: sa-08
      title: Minimization
      statement: |
        Implement the privacy principle of minimization using {{ insert: param, sa-8.33_prm_1 }}.
      parameters:
        sa-8.33_prm_1:
          label: "organization-defined processes"
    sa-09: 
      label: SA-9
      title: External System Services
      statement: |
        a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: {{ insert: param, sa-9_prm_1 }};
        b. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and
        c. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: {{ insert: param, sa-9_prm_2 }}.
      parameters:
        sa-9_prm_1:
          label: "organization-defined controls"
        sa-9_prm_2:
          label: "organization-defined processes, methods, and techniques"
    sa-09.01:
      label: SA-9(1)
      parent_control: sa-09
      title: Risk Assessments and Organizational Approvals
      statement: |
        (a) Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and
        (b) Verify that the acquisition or outsourcing of dedicated information security services is approved by {{ insert: param, sa-9.1_prm_1 }}.
      parameters:
        sa-9.1_prm_1:
          label: "organization-defined personnel or roles"
    sa-09.02:
      label: SA-9(2)
      parent_control: sa-09
      title: Identification of Functions, Ports, Protocols, and Services
      statement: |
        Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: {{ insert: param, sa-9.2_prm_1 }}.
      parameters:
        sa-9.2_prm_1:
          label: "organization-defined external system services"
    sa-09.03:
      label: SA-9(3)
      parent_control: sa-09
      title: Establish and Maintain Trust Relationship with Providers
      statement: |
        Establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or conditions: {{ insert: param, sa-9.3_prm_1 }}.
      parameters:
        sa-9.3_prm_1:
          label: "organization-defined security and privacy requirements, properties, factors, or conditions defining acceptable trust relationships"
    sa-09.04:
      label: SA-9(4)
      parent_control: sa-09
      title: Consistent Interests of Consumers and Providers
      statement: |
        Take the following actions to verify that the interests of {{ insert: param, sa-9.4_prm_1 }} are consistent with and reflect organizational interests: {{ insert: param, sa-9.4_prm_2 }}.
      parameters:
        sa-9.4_prm_1:
          label: "organization-defined external service providers"
        sa-9.4_prm_2:
          label: "organization-defined actions"
    sa-09.05:
      label: SA-9(5)
      parent_control: sa-09
      title: Processing, Storage, and Service Location
      statement: |
        Restrict the location of {{ insert: param, sa-9.5_prm_1 }} to {{ insert: param, sa-9.5_prm_2 }} based on {{ insert: param, sa-9.5_prm_3 }}.
      parameters:
        sa-9.5_prm_1:
          how-many: one or more
          choice:
            - "information processing"
            - "information or data"
            - "system services"
        sa-9.5_prm_2:
          label: "organization-defined locations"
        sa-9.5_prm_3:
          label: "organization-defined requirements or conditions"
    sa-09.06:
      label: SA-9(6)
      parent_control: sa-09
      title: Organization-controlled Cryptographic Keys
      statement: |
        Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.
    sa-09.07:
      label: SA-9(7)
      parent_control: sa-09
      title: Organization-controlled Integrity Checking
      statement: |
        Provide the capability to check the integrity of information while it resides in the external system.
    sa-09.08:
      label: SA-9(8)
      parent_control: sa-09
      title: Processing and Storage Location — U.s. Jurisdiction
      statement: |
        Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States.
    sa-10: 
      label: SA-10
      title: Developer Configuration Management
      statement: |
        Require the developer of the system, system component, or system service to:
          a. Perform configuration management during system, component, or service {{ insert: param, sa-10_prm_1 }};
          b. Document, manage, and control the integrity of changes to {{ insert: param, sa-10_prm_2 }};
          c. Implement only organization-approved changes to the system, component, or service;
          d. Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and
          e. Track security flaws and flaw resolution within the system, component, or service and report findings to {{ insert: param, sa-10_prm_3 }}.
      parameters:
        sa-10_prm_1:
          how-many: one or more
          choice:
            - "design"
            - "development"
            - "implementation"
            - "operation"
            - "disposal"
        sa-10_prm_2:
          label: "organization-defined configuration items under configuration management"
        sa-10_prm_3:
          label: "organization-defined personnel"
    sa-10.01:
      label: SA-10(1)
      parent_control: sa-10
      title: Software and Firmware Integrity Verification
      statement: |
        Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.
    sa-10.02:
      label: SA-10(2)
      parent_control: sa-10
      title: Alternative Configuration Management Processes
      statement: |
        Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
    sa-10.03:
      label: SA-10(3)
      parent_control: sa-10
      title: Hardware Integrity Verification
      statement: |
        Require the developer of the system, system component, or system service to enable integrity verification of hardware components.
    sa-10.04:
      label: SA-10(4)
      parent_control: sa-10
      title: Trusted Generation
      statement: |
        Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions, source code, and object code with previous versions.
    sa-10.05:
      label: SA-10(5)
      parent_control: sa-10
      title: Mapping Integrity for Version Control
      statement: |
        Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.
    sa-10.06:
      label: SA-10(6)
      parent_control: sa-10
      title: Trusted Distribution
      statement: |
        Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.
    sa-10.07:
      label: SA-10(7)
      parent_control: sa-10
      title: Security and Privacy Representatives
      statement: |
        Require {{ insert: param, sa-10.7_prm_1 }} to be included in the {{ insert: param, sa-10.7_prm_2 }}.
      parameters:
        sa-10.7_prm_1:
          label: "organization-defined security and privacy representatives"
        sa-10.7_prm_2:
          label: "organization-defined configuration change management and control process"
    sa-11: 
      label: SA-11
      title: Developer Testing and Evaluation
      statement: |
        Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:
          a. Develop and implement a plan for ongoing security and privacy control assessments;
          b. Perform {{ insert: param, sa-11_prm_1 }} testing/evaluation {{ insert: param, sa-11_prm_2 }} at {{ insert: param, sa-11_prm_3 }};
          c. Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;
          d. Implement a verifiable flaw remediation process; and
          e. Correct flaws identified during testing and evaluation.
      parameters:
        sa-11_prm_1:
          how-many: one or more
          choice:
            - "unit"
            - "integration"
            - "system"
            - "regression"
        sa-11_prm_2:
          label: "organization-defined frequency"
        sa-11_prm_3:
          label: "organization-defined depth and coverage"
    sa-11.01:
      label: SA-11(1)
      parent_control: sa-11
      title: Static Code Analysis
      statement: |
        Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis.
    sa-11.02:
      label: SA-11(2)
      parent_control: sa-11
      title: Threat Modeling and Vulnerability Analyses
      statement: |
        Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that: 
          (a) Uses the following contextual information: {{ insert: param, sa-11.2_prm_1 }};
          (b) Employs the following tools and methods: {{ insert: param, sa-11.2_prm_2 }};
          (c) Conducts the modeling and analyses at the following level of rigor: {{ insert: param, sa-11.2_prm_3 }}; and
          (d) Produces evidence that meets the following acceptance criteria: {{ insert: param, sa-11.2_prm_4 }}.
      parameters:
        sa-11.2_prm_1:
          label: "organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels"
        sa-11.2_prm_2:
          label: "organization-defined tools and methods"
        sa-11.2_prm_3:
          label: "organization-defined breadth and depth of modeling and analyses"
        sa-11.2_prm_4:
          label: "organization-defined acceptance criteria"
    sa-11.03:
      label: SA-11(3)
      parent_control: sa-11
      title: Independent Verification of Assessment Plans and Evidence
      statement: |
        (a) Require an independent agent satisfying {{ insert: param, sa-11.3_prm_1 }} to verify the correct implementation of the developer security and privacy assessment plans and the evidence produced during testing and evaluation; and
        (b) Verify that the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.
      parameters:
        sa-11.3_prm_1:
          label: "organization-defined independence criteria"
    sa-11.04:
      label: SA-11(4)
      parent_control: sa-11
      title: Manual Code Reviews
      statement: |
        Require the developer of the system, system component, or system service to perform a manual code review of {{ insert: param, sa-11.4_prm_1 }} using the following processes, procedures, and/or techniques: {{ insert: param, sa-11.4_prm_2 }}.
      parameters:
        sa-11.4_prm_1:
          label: "organization-defined specific code"
        sa-11.4_prm_2:
          label: "organization-defined processes, procedures, and/or techniques"
    sa-11.05:
      label: SA-11(5)
      parent_control: sa-11
      title: Penetration Testing
      statement: |
        Require the developer of the system, system component, or system service to perform penetration testing:
          (a) At the following level of rigor: {{ insert: param, sa-11.5_prm_1 }}; and
          (b) Under the following constraints: {{ insert: param, sa-11.5_prm_2 }}.
      parameters:
        sa-11.5_prm_1:
          label: "organization-defined breadth and depth of testing"
        sa-11.5_prm_2:
          label: "organization-defined constraints"
    sa-11.06:
      label: SA-11(6)
      parent_control: sa-11
      title: Attack Surface Reviews
      statement: |
        Require the developer of the system, system component, or system service to perform attack surface reviews. 
    sa-11.07:
      label: SA-11(7)
      parent_control: sa-11
      title: Verify Scope of Testing and Evaluation
      statement: |
        Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of the required controls at the following level of rigor: {{ insert: param, sa-11.7_prm_1 }}.
      parameters:
        sa-11.7_prm_1:
          label: "organization-defined breadth and depth of testing and evaluation"
    sa-11.08:
      label: SA-11(8)
      parent_control: sa-11
      title: Dynamic Code Analysis
      statement: |
        Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.
    sa-11.09:
      label: SA-11(9)
      parent_control: sa-11
      title: Interactive Application Security Testing
      statement: |
        Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws and document the results.
    sa-15: 
      label: SA-15
      title: Development Process, Standards, and Tools
      statement: |
        a. Require the developer of the system, system component, or system service to follow a documented development process that:
          1. Explicitly addresses security and privacy requirements;
          2. Identifies the standards and tools used in the development process;
          3. Documents the specific tool options and tool configurations used in the development process; and
          4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and
        b. Review the development process, standards, tools, tool options, and tool configurations {{ insert: param, sa-15_prm_1 }} to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: {{ insert: param, sa-15_prm_2 }}.
      parameters:
        sa-15_prm_1:
          label: "organization-defined frequency"
        sa-15_prm_2:
          label: "organization-defined security and privacy requirements"
    sa-15.01:
      label: SA-15(1)
      parent_control: sa-15
      title: Quality Metrics
      statement: |
        Require the developer of the system, system component, or system service to:
          (a) Define quality metrics at the beginning of the development process; and
          (b) Provide evidence of meeting the quality metrics {{ insert: param, sa-15.1_prm_1 }}.
      parameters:
        sa-15.1_prm_1:
          how-many: one or more
          choice:
            - " {{ insert: param, sa-15.1_prm_2 }} "
            - " {{ insert: param, sa-15.1_prm_3 }} "
            - "upon delivery"
        sa-15.1_prm_2:
          label: "organization-defined frequency"
        sa-15.1_prm_3:
          label: "organization-defined program review milestones"
    sa-15.02:
      label: SA-15(2)
      parent_control: sa-15
      title: Security and Privacy Tracking Tools
      statement: |
        Require the developer of the system, system component, or system service to select and employ security and privacy tracking tools for use during the development process.
    sa-15.03:
      label: SA-15(3)
      parent_control: sa-15
      title: Criticality Analysis
      statement: |
        Require the developer of the system, system component, or system service to perform a criticality analysis:
          (a) At the following decision points in the system development life cycle: {{ insert: param, sa-15.3_prm_1 }}; and
          (b) At the following level of rigor: {{ insert: param, sa-15.3_prm_2 }}.
      parameters:
        sa-15.3_prm_1:
          label: "organization-defined decision points in the system development life cycle"
        sa-15.3_prm_2:
          label: "organization-defined breadth and depth of criticality analysis"
    sa-15.05:
      label: SA-15(5)
      parent_control: sa-15
      title: Attack Surface Reduction
      statement: |
        Require the developer of the system, system component, or system service to reduce attack surfaces to {{ insert: param, sa-15.5_prm_1 }}.
      parameters:
        sa-15.5_prm_1:
          label: "organization-defined thresholds"
    sa-15.06:
      label: SA-15(6)
      parent_control: sa-15
      title: Continuous Improvement
      statement: |
        Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.
    sa-15.07:
      label: SA-15(7)
      parent_control: sa-15
      title: Automated Vulnerability Analysis
      statement: |
        Require the developer of the system, system component, or system service {{ insert: param, sa-15.7_prm_1 }} to:
          (a) Perform an automated vulnerability analysis using {{ insert: param, sa-15.7_prm_2 }};
          (b) Determine the exploitation potential for discovered vulnerabilities;
          (c) Determine potential risk mitigations for delivered vulnerabilities; and
          (d) Deliver the outputs of the tools and results of the analysis to {{ insert: param, sa-15.7_prm_3 }}.
      parameters:
        sa-15.7_prm_1:
          label: "organization-defined frequency"
        sa-15.7_prm_2:
          label: "organization-defined tools"
        sa-15.7_prm_3:
          label: "organization-defined personnel or roles"
    sa-15.08:
      label: SA-15(8)
      parent_control: sa-15
      title: Reuse of Threat and Vulnerability Information
      statement: |
        Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.
    sa-15.10:
      label: SA-15(10)
      parent_control: sa-15
      title: Incident Response Plan
      statement: |
        Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.
    sa-15.11:
      label: SA-15(11)
      parent_control: sa-15
      title: Archive System or Component
      statement: |
        Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.
    sa-15.12:
      label: SA-15(12)
      parent_control: sa-15
      title: Minimize Personally Identifiable Information
      statement: |
        Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.
    sa-16: 
      label: SA-16
      title: Developer-provided Training
      statement: |
        Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms: {{ insert: param, sa-16_prm_1 }}.
      parameters:
        sa-16_prm_1:
          label: "organization-defined training"
    sa-17: 
      label: SA-17
      title: Developer Security and Privacy Architecture and Design
      statement: |
        Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that:
          a. Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture;
          b. Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and
          c. Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.
    sa-17.01:
      label: SA-17(1)
      parent_control: sa-17
      title: Formal Policy Model
      statement: |
        Require the developer of the system, system component, or system service to:
          (a) Produce, as an integral part of the development process, a formal policy model describing the {{ insert: param, sa-17.1_prm_1 }} to be enforced; and
          (b) Prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security and privacy policy when implemented.
      parameters:
        sa-17.1_prm_1:
          label: "organization-defined elements of organizational security and privacy policy"
    sa-17.02:
      label: SA-17(2)
      parent_control: sa-17
      title: Security-relevant Components
      statement: |
        Require the developer of the system, system component, or system service to:
          (a) Define security-relevant hardware, software, and firmware; and
          (b) Provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.
    sa-17.03:
      label: SA-17(3)
      parent_control: sa-17
      title: Formal Correspondence
      statement: |
        Require the developer of the system, system component, or system service to:
          (a) Produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions, error messages, and effects;
          (b) Show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model;
          (c) Show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware;
          (d) Show that the formal top-level specification is an accurate description of the implemented security-relevant hardware, software, and firmware; and
          (e) Describe the security-relevant hardware, software, and firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware, software, and firmware.
    sa-17.04:
      label: SA-17(4)
      parent_control: sa-17
      title: Informal Correspondence
      statement: |
        Require the developer of the system, system component, or system service to:
          (a) Produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions, error messages, and effects;
          (b) Show via {{ insert: param, sa-17.4_prm_1 }} that the descriptive top-level specification is consistent with the formal policy model;
          (c) Show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware;
          (d) Show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware, software, and firmware; and
          (e) Describe the security-relevant hardware, software, and firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware, software, and firmware.
      parameters:
        sa-17.4_prm_1:
          choice:
            - "informal demonstration"
            - "convincing argument with formal methods as feasible"
    sa-17.05:
      label: SA-17(5)
      parent_control: sa-17
      title: Conceptually Simple Design
      statement: |
        Require the developer of the system, system component, or system service to:
          (a) Design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics; and
          (b) Internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.
    sa-17.06:
      label: SA-17(6)
      parent_control: sa-17
      title: Structure for Testing
      statement: |
        Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate testing.
    sa-17.07:
      label: SA-17(7)
      parent_control: sa-17
      title: Structure for Least Privilege
      statement: |
        Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.
    sa-17.08:
      label: SA-17(8)
      parent_control: sa-17
      title: Orchestration
      statement: |
        Design {{ insert: param, sa-17.8_prm_1 }} with coordinated behavior to implement the following capabilities: {{ insert: param, sa-17.8_prm_2 }}.
      parameters:
        sa-17.8_prm_1:
          label: "organization-defined critical systems or system components"
        sa-17.8_prm_2:
          label: "organization-defined capabilities, by system or component"
    sa-17.09:
      label: SA-17(9)
      parent_control: sa-17
      title: Design Diversity
      statement: |
        Use different designs for {{ insert: param, sa-17.9_prm_1 }} to satisfy a common set of requirements or to provide equivalent functionality.
      parameters:
        sa-17.9_prm_1:
          label: "organization-defined critical systems or system components"
    sa-20: 
      label: SA-20
      title: Customized Development of Critical Components
      statement: |
        Reimplement or custom develop the following critical system components: {{ insert: param, sa-20_prm_1 }}.
      parameters:
        sa-20_prm_1:
          label: "organization-defined critical system components"
    sa-21: 
      label: SA-21
      title: Developer Screening
      statement: |
        Require that the developer of {{ insert: param, sa-21_prm_1 }}:
          a. Has appropriate access authorizations as determined by assigned {{ insert: param, sa-21_prm_2 }}; and
          b. Satisfies the following additional personnel screening criteria: {{ insert: param, sa-21_prm_3 }}. 
      parameters:
        sa-21_prm_1:
          label: "organization-defined system, system component, or system service"
        sa-21_prm_2:
          label: "organization-defined official government duties"
        sa-21_prm_3:
          label: "organization-defined additional personnel screening criteria"
    sa-22: 
      label: SA-22
      title: Unsupported System Components
      statement: |
        a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or
        b. Provide the following options for alternative sources for continued support for unsupported components {{ insert: param, sa-22_prm_1 }}.
      parameters:
        sa-22_prm_1:
          how-many: one or more
          choice:
            - "in-house support"
            - " {{ insert: param, sa-22_prm_2 }} "
        sa-22_prm_2:
          label: "organization-defined support from external providers"
    sa-23: 
      label: SA-23
      title: Specialization
      statement: |
        Employ {{ insert: param, sa-23_prm_1 }} on {{ insert: param, sa-23_prm_2 }} supporting mission essential services or functions to increase the trustworthiness in those systems or components.
      parameters:
        sa-23_prm_1:
          how-many: one or more
          choice:
            - "design"
            - "modification"
            - "augmentation"
            - "reconfiguration"
        sa-23_prm_2:
          label: "organization-defined systems or system components"
sc:
  title: System and Communications Protection
  controls:
    sc-01: 
      label: SC-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, sc-1_prm_1 }}:
          1.  {{ insert: param, sc-1_prm_2 }} system and communications protection policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls;
        b. Designate an {{ insert: param, sc-1_prm_3 }} to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; and
        c. Review and update the current system and communications protection:
          1. Policy {{ insert: param, sc-1_prm_4 }} and following {{ insert: param, sc-1_prm_5 }}; and
          2. Procedures {{ insert: param, sc-1_prm_6 }} and following {{ insert: param, sc-1_prm_7 }}.
      parameters:
        sc-1_prm_1:
          label: "organization-defined personnel or roles"
        sc-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        sc-1_prm_3:
          label: "organization-defined official"
        sc-1_prm_4:
          label: "organization-defined frequency"
        sc-1_prm_5:
          label: "organization-defined events"
        sc-1_prm_6:
          label: "organization-defined frequency"
        sc-1_prm_7:
          label: "organization-defined events"
    sc-02: 
      label: SC-2
      title: Separation of System and User Functionality
      statement: |
        Separate user functionality, including user interface services, from system management functionality.
    sc-02.01:
      label: SC-2(1)
      parent_control: sc-02
      title: Interfaces for Non-privileged Users
      statement: |
        Prevent the presentation of system management functionality at interfaces to non-privileged users.
    sc-02.02:
      label: SC-2(2)
      parent_control: sc-02
      title: Disassociability
      statement: |
        Store state information from applications and software separately.
    sc-03: 
      label: SC-3
      title: Security Function Isolation
      statement: |
        Isolate security functions from nonsecurity functions.
    sc-03.01:
      label: SC-3(1)
      parent_control: sc-03
      title: Hardware Separation
      statement: |
        Employ hardware separation mechanisms to implement security function isolation.
    sc-03.02:
      label: SC-3(2)
      parent_control: sc-03
      title: Access and Flow Control Functions
      statement: |
        Isolate security functions enforcing access and information flow control from nonsecurity functions and from other security functions.
    sc-03.03:
      label: SC-3(3)
      parent_control: sc-03
      title: Minimize Nonsecurity Functionality
      statement: |
        Minimize the number of nonsecurity functions included within the isolation boundary containing security functions.
    sc-03.04:
      label: SC-3(4)
      parent_control: sc-03
      title: Module Coupling and Cohesiveness
      statement: |
        Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.
    sc-03.05:
      label: SC-3(5)
      parent_control: sc-03
      title: Layered Structures
      statement: |
        Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
    sc-04: 
      label: SC-4
      title: Information in Shared System Resources
      statement: |
        Prevent unauthorized and unintended information transfer via shared system resources.
    sc-04.02:
      label: SC-4(2)
      parent_control: sc-04
      title: Multilevel or Periods Processing
      statement: |
        Prevent unauthorized information transfer via shared resources in accordance with {{ insert: param, sc-4.2_prm_1 }} when system processing explicitly switches between different information classification levels or security categories.
      parameters:
        sc-4.2_prm_1:
          label: "organization-defined procedures"
    sc-05: 
      label: SC-5
      title: Denial-of-service Protection
      statement: |
        a.  {{ insert: param, sc-5_prm_1 }} the effects of the following types of denial-of-service events: {{ insert: param, sc-5_prm_2 }}; and
        b. Employ the following controls to achieve the denial-of-service objective: {{ insert: param, sc-5_prm_3 }}.
      parameters:
        sc-5_prm_1:
          choice:
            - "Protect against"
            - "Limit"
        sc-5_prm_2:
          label: "organization-defined types of denial-of-service events"
        sc-5_prm_3:
          label: "organization-defined controls by type of denial-of-service event"
    sc-05.01:
      label: SC-5(1)
      parent_control: sc-05
      title: Restrict Ability to Attack Other Systems
      statement: |
        Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: {{ insert: param, sc-5.1_prm_1 }}.
      parameters:
        sc-5.1_prm_1:
          label: "organization-defined denial-of-service attacks"
    sc-05.02:
      label: SC-5(2)
      parent_control: sc-05
      title: Capacity, Bandwidth, and Redundancy
      statement: |
        Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding denial-of-service attacks.
    sc-05.03:
      label: SC-5(3)
      parent_control: sc-05
      title: Detection and Monitoring
      statement: |
        (a) Employ the following monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system: {{ insert: param, sc-5.3_prm_1 }}; and
        (b) Monitor the following system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks: {{ insert: param, sc-5.3_prm_2 }}.
      parameters:
        sc-5.3_prm_1:
          label: "organization-defined monitoring tools"
        sc-5.3_prm_2:
          label: "organization-defined system resources"
    sc-06: 
      label: SC-6
      title: Resource Availability
      statement: |
        Protect the availability of resources by allocating {{ insert: param, sc-6_prm_1 }} by {{ insert: param, sc-6_prm_2 }}.
      parameters:
        sc-6_prm_1:
          label: "organization-defined resources"
        sc-6_prm_2:
          how-many: one or more
          choice:
            - "priority"
            - "quota"
            - " {{ insert: param, sc-6_prm_3 }} "
        sc-6_prm_3:
          label: "organization-defined controls"
    sc-07: 
      label: SC-7
      title: Boundary Protection
      statement: |
        a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;
        b. Implement subnetworks for publicly accessible system components that are {{ insert: param, sc-7_prm_1 }} separated from internal organizational networks; and
        c. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
      parameters:
        sc-7_prm_1:
          choice:
            - "physically"
            - "logically"
    sc-07.03:
      label: SC-7(3)
      parent_control: sc-07
      title: Access Points
      statement: |
        Limit the number of external network connections to the system.
    sc-07.04:
      label: SC-7(4)
      parent_control: sc-07
      title: External Telecommunications Services
      statement: |
        (a) Implement a managed interface for each external telecommunication service;
        (b) Establish a traffic flow policy for each managed interface;
        (c) Protect the confidentiality and integrity of the information being transmitted across each interface;
        (d) Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;
        (e) Review exceptions to the traffic flow policy {{ insert: param, sc-7.4_prm_1 }} and remove exceptions that are no longer supported by an explicit mission or business need;
        (f) Prevent unauthorized exchange of control plane traffic with external networks;
        (g) Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and
        (h) Filter unauthorized control plane traffic from external networks.
      parameters:
        sc-7.4_prm_1:
          label: "organization-defined frequency"
    sc-07.05:
      label: SC-7(5)
      parent_control: sc-07
      title: Deny by Default — Allow by Exception
      statement: |
        Deny network communications traffic by default and allow network communications traffic by exception {{ insert: param, sc-7.5_prm_1 }}.
      parameters:
        sc-7.5_prm_1:
          how-many: one or more
          choice:
            - "at managed interfaces"
            - "for {{ insert: param, sc-7.5_prm_2 }} "
        sc-7.5_prm_2:
          label: "organization-defined systems"
    sc-07.07:
      label: SC-7(7)
      parent_control: sc-07
      title: Split Tunneling for Remote Devices
      statement: |
        Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using {{ insert: param, sc-7.7_prm_1 }}.
      parameters:
        sc-7.7_prm_1:
          label: "organization-defined safeguards"
    sc-07.08:
      label: SC-7(8)
      parent_control: sc-07
      title: Route Traffic to Authenticated Proxy Servers
      statement: |
        Route {{ insert: param, sc-7.8_prm_1 }} to {{ insert: param, sc-7.8_prm_2 }} through authenticated proxy servers at managed interfaces.
      parameters:
        sc-7.8_prm_1:
          label: "organization-defined internal communications traffic"
        sc-7.8_prm_2:
          label: "organization-defined external networks"
    sc-07.09:
      label: SC-7(9)
      parent_control: sc-07
      title: Restrict Threatening Outgoing Communications Traffic
      statement: |
        (a) Detect and deny outgoing communications traffic posing a threat to external systems; and
        (b) Audit the identity of internal users associated with denied communications.
    sc-07.10:
      label: SC-7(10)
      parent_control: sc-07
      title: Prevent Exfiltration
      statement: |
        (a) Prevent the exfiltration of information; and
        (b) Conduct exfiltration tests {{ insert: param, sc-7.10_prm_1 }}.
      parameters:
        sc-7.10_prm_1:
          label: "organization-defined frequency"
    sc-07.11:
      label: SC-7(11)
      parent_control: sc-07
      title: Restrict Incoming Communications Traffic
      statement: |
        Only allow incoming communications from {{ insert: param, sc-7.11_prm_1 }} to be routed to {{ insert: param, sc-7.11_prm_2 }}.
      parameters:
        sc-7.11_prm_1:
          label: "organization-defined authorized sources"
        sc-7.11_prm_2:
          label: "organization-defined authorized destinations"
    sc-07.12:
      label: SC-7(12)
      parent_control: sc-07
      title: Host-based Protection
      statement: |
        Implement {{ insert: param, sc-7.12_prm_1 }} at {{ insert: param, sc-7.12_prm_2 }}.
      parameters:
        sc-7.12_prm_1:
          label: "organization-defined host-based boundary protection mechanisms"
        sc-7.12_prm_2:
          label: "organization-defined system components"
    sc-07.13:
      label: SC-7(13)
      parent_control: sc-07
      title: Isolation of Security Tools, Mechanisms, and Support Components
      statement: |
        Isolate {{ insert: param, sc-7.13_prm_1 }} from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.
      parameters:
        sc-7.13_prm_1:
          label: "organization-defined information security tools, mechanisms, and support components"
    sc-07.14:
      label: SC-7(14)
      parent_control: sc-07
      title: Protect Against Unauthorized Physical Connections
      statement: |
        Protect against unauthorized physical connections at {{ insert: param, sc-7.14_prm_1 }}.
      parameters:
        sc-7.14_prm_1:
          label: "organization-defined managed interfaces"
    sc-07.15:
      label: SC-7(15)
      parent_control: sc-07
      title: Networked Privileged Accesses
      statement: |
        Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.
    sc-07.16:
      label: SC-7(16)
      parent_control: sc-07
      title: Prevent Discovery of System Components
      statement: |
        Prevent the discovery of specific system components that represent a managed interface.
    sc-07.17:
      label: SC-7(17)
      parent_control: sc-07
      title: Automated Enforcement of Protocol Formats
      statement: |
        Enforce adherence to protocol formats.
    sc-07.18:
      label: SC-7(18)
      parent_control: sc-07
      title: Fail Secure
      statement: |
        Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device. 
    sc-07.19:
      label: SC-7(19)
      parent_control: sc-07
      title: Block Communication from Non-organizationally Configured Hosts
      statement: |
        Block inbound and outbound communications traffic between {{ insert: param, sc-7.19_prm_1 }} that are independently configured by end users and external service providers.
      parameters:
        sc-7.19_prm_1:
          label: "organization-defined communication clients"
    sc-07.20:
      label: SC-7(20)
      parent_control: sc-07
      title: Dynamic Isolation and Segregation
      statement: |
        Provide the capability to dynamically isolate {{ insert: param, sc-7.20_prm_1 }} from other system components.
      parameters:
        sc-7.20_prm_1:
          label: "organization-defined system components"
    sc-07.21:
      label: SC-7(21)
      parent_control: sc-07
      title: Isolation of System Components
      statement: |
        Employ boundary protection mechanisms to isolate {{ insert: param, sc-7.21_prm_1 }} supporting {{ insert: param, sc-7.21_prm_2 }}.
      parameters:
        sc-7.21_prm_1:
          label: "organization-defined system components"
        sc-7.21_prm_2:
          label: "organization-defined missions and/or business functions"
    sc-07.22:
      label: SC-7(22)
      parent_control: sc-07
      title: Separate Subnets for Connecting to Different Security Domains
      statement: |
        Implement separate network addresses to connect to systems in different security domains.
    sc-07.23:
      label: SC-7(23)
      parent_control: sc-07
      title: Disable Sender Feedback on Protocol Validation Failure
      statement: |
        Disable feedback to senders on protocol format validation failure.
    sc-07.24:
      label: SC-7(24)
      parent_control: sc-07
      title: Personally Identifiable Information
      statement: |
        For systems that process personally identifiable information:
          (a) Apply the following processing rules to data elements of personally identifiable information: {{ insert: param, sc-7.24_prm_1 }};
          (b) Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system;
          (c) Document each processing exception; and
          (d) Review and remove exceptions that are no longer supported. 
      parameters:
        sc-7.24_prm_1:
          label: "organization-defined processing rules"
    sc-07.25:
      label: SC-7(25)
      parent_control: sc-07
      title: Unclassified National Security System Connections
      statement: |
        Prohibit the direct connection of {{ insert: param, sc-7.25_prm_1 }} to an external network without the use of {{ insert: param, sc-7.25_prm_2 }}.
      parameters:
        sc-7.25_prm_1:
          label: "organization-defined unclassified national security system"
        sc-7.25_prm_2:
          label: "organization-defined boundary protection device"
    sc-07.26:
      label: SC-7(26)
      parent_control: sc-07
      title: Classified National Security System Connections
      statement: |
        Prohibit the direct connection of a classified national security system to an external network without the use of {{ insert: param, sc-7.26_prm_1 }}.
      parameters:
        sc-7.26_prm_1:
          label: "organization-defined boundary protection device"
    sc-07.27:
      label: SC-7(27)
      parent_control: sc-07
      title: Unclassified Non-national Security System Connections
      statement: |
        Prohibit the direct connection of {{ insert: param, sc-7.27_prm_1 }} to an external network without the use of {{ insert: param, sc-7.27_prm_2 }}.
      parameters:
        sc-7.27_prm_1:
          label: "organization-defined unclassified non-national security system"
        sc-7.27_prm_2:
          label: "organization-defined boundary protection device"
    sc-07.28:
      label: SC-7(28)
      parent_control: sc-07
      title: Connections to Public Networks
      statement: |
        Prohibit the direct connection of {{ insert: param, sc-7.28_prm_1 }} to a public network.
      parameters:
        sc-7.28_prm_1:
          label: "organization-defined system"
    sc-07.29:
      label: SC-7(29)
      parent_control: sc-07
      title: Separate Subnets to Isolate Functions
      statement: |
        Implement {{ insert: param, sc-7.29_prm_1 }} separate subnetworks to isolate the following critical system components and functions: {{ insert: param, sc-7.29_prm_2 }}.
      parameters:
        sc-7.29_prm_1:
          choice:
            - "physically"
            - "logically"
        sc-7.29_prm_2:
          label: "organization-defined critical system components and functions"
    sc-08: 
      label: SC-8
      title: Transmission Confidentiality and Integrity
      statement: |
        Protect the {{ insert: param, sc-8_prm_1 }} of transmitted information.
      parameters:
        sc-8_prm_1:
          how-many: one or more
          choice:
            - "confidentiality"
            - "integrity"
    sc-08.01:
      label: SC-8(1)
      parent_control: sc-08
      title: Cryptographic Protection
      statement: |
        Implement cryptographic mechanisms to {{ insert: param, sc-8.1_prm_1 }} during transmission.
      parameters:
        sc-8.1_prm_1:
          how-many: one or more
          choice:
            - "prevent unauthorized disclosure of information"
            - "detect changes to information"
    sc-08.02:
      label: SC-8(2)
      parent_control: sc-08
      title: Pre- and Post-transmission Handling
      statement: |
        Maintain the {{ insert: param, sc-8.2_prm_1 }} of information during preparation for transmission and during reception.
      parameters:
        sc-8.2_prm_1:
          how-many: one or more
          choice:
            - "confidentiality"
            - "integrity"
    sc-08.03:
      label: SC-8(3)
      parent_control: sc-08
      title: Cryptographic Protection for Message Externals
      statement: |
        Implement cryptographic mechanisms to protect message externals unless otherwise protected by {{ insert: param, sc-8.3_prm_1 }}.
      parameters:
        sc-8.3_prm_1:
          label: "organization-defined alternative physical controls"
    sc-08.04:
      label: SC-8(4)
      parent_control: sc-08
      title: Conceal or Randomize Communications
      statement: |
        Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by {{ insert: param, sc-8.4_prm_1 }}.
      parameters:
        sc-8.4_prm_1:
          label: "organization-defined alternative physical controls"
    sc-08.05:
      label: SC-8(5)
      parent_control: sc-08
      title: Protected Distribution System
      statement: |
        Implement {{ insert: param, sc-8.5_prm_1 }} to {{ insert: param, sc-8.5_prm_2 }} during transmission.
      parameters:
        sc-8.5_prm_1:
          label: "organization-defined protected distribution system"
        sc-8.5_prm_2:
          how-many: one or more
          choice:
            - "prevent unauthorized disclosure of information"
            - "detect changes to information"
    sc-10: 
      label: SC-10
      title: Network Disconnect
      statement: |
        Terminate the network connection associated with a communications session at the end of the session or after {{ insert: param, sc-10_prm_1 }} of inactivity. 
      parameters:
        sc-10_prm_1:
          label: "organization-defined time period"
    sc-11: 
      label: SC-11
      title: Trusted Path
      statement: |
        a. Provide a {{ insert: param, sc-11_prm_1 }} isolated trusted communications path for communications between the user and the trusted components of the system; and
        b. Permit users to invoke the trusted communications path for communications between the user and the following security functions of the system, including at a minimum, authentication and re-authentication: {{ insert: param, sc-11_prm_2 }}. 
      parameters:
        sc-11_prm_1:
          choice:
            - "physically"
            - "logically"
        sc-11_prm_2:
          label: "organization-defined security functions"
    sc-11.01:
      label: SC-11(1)
      parent_control: sc-11
      title: Irrefutable Communications Path
      statement: |
        (a) Provide a trusted communications path that is irrefutably distinguishable from other communications paths; and
        (b) Initiate the trusted communications path for communications between the {{ insert: param, sc-11.1_prm_1 }} of the system and the user.
      parameters:
        sc-11.1_prm_1:
          label: "organization-defined security functions"
    sc-12: 
      label: SC-12
      title: Cryptographic Key Establishment and Management
      statement: |
        Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: {{ insert: param, sc-12_prm_1 }}.
      parameters:
        sc-12_prm_1:
          label: "organization-defined requirements for key generation, distribution, storage, access, and destruction"
    sc-12.01:
      label: SC-12(1)
      parent_control: sc-12
      title: Availability
      statement: |
        Maintain availability of information in the event of the loss of cryptographic keys by users.
    sc-12.02:
      label: SC-12(2)
      parent_control: sc-12
      title: Symmetric Keys
      statement: |
        Produce, control, and distribute symmetric cryptographic keys using {{ insert: param, sc-12.2_prm_1 }} key management technology and processes.
      parameters:
        sc-12.2_prm_1:
          choice:
            - "NIST FIPS-validated"
            - "NSA-approved"
    sc-12.03:
      label: SC-12(3)
      parent_control: sc-12
      title: Asymmetric Keys
      statement: |
        Produce, control, and distribute asymmetric cryptographic keys using {{ insert: param, sc-12.3_prm_1 }}.
      parameters:
        sc-12.3_prm_1:
          choice:
            - "NSA-approved key management technology and processes"
            - "prepositioned keying material"
            - "DoD-approved or DoD-issued Medium Assurance PKI certificates"
            - "DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key"
            - "certificates issued in accordance with organization-defined requirements"
    sc-12.06:
      label: SC-12(6)
      parent_control: sc-12
      title: Physical Control of Keys
      statement: |
        Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.
    sc-13: 
      label: SC-13
      title: Cryptographic Protection
      statement: |
        a. Determine the {{ insert: param, sc-13_prm_1 }}; and
        b. Implement the following types of cryptography required for each specified cryptographic use: {{ insert: param, sc-13_prm_2 }}.
      parameters:
        sc-13_prm_1:
          label: "organization-defined cryptographic uses"
        sc-13_prm_2:
          label: "organization-defined types of cryptography for each specified cryptographic use"
    sc-15: 
      label: SC-15
      title: Collaborative Computing Devices and Applications
      statement: |
        a. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: {{ insert: param, sc-15_prm_1 }}; and
        b. Provide an explicit indication of use to users physically present at the devices.
      parameters:
        sc-15_prm_1:
          label: "organization-defined exceptions where remote activation is to be allowed"
    sc-15.01:
      label: SC-15(1)
      parent_control: sc-15
      title: Physical or Logical Disconnect
      statement: |
        Provide {{ insert: param, sc-15.1_prm_1 }} disconnect of collaborative computing devices in a manner that supports ease of use.
      parameters:
        sc-15.1_prm_1:
          how-many: one or more
          choice:
            - "physical"
            - "logical"
    sc-15.03:
      label: SC-15(3)
      parent_control: sc-15
      title: Disabling and Removal in Secure Work Areas
      statement: |
        Disable or remove collaborative computing devices and applications from {{ insert: param, sc-15.3_prm_1 }} in {{ insert: param, sc-15.3_prm_2 }}.
      parameters:
        sc-15.3_prm_1:
          label: "organization-defined systems or system components"
        sc-15.3_prm_2:
          label: "organization-defined secure work areas"
    sc-15.04:
      label: SC-15(4)
      parent_control: sc-15
      title: Explicitly Indicate Current Participants
      statement: |
        Provide an explicit indication of current participants in {{ insert: param, sc-15.4_prm_1 }}.
      parameters:
        sc-15.4_prm_1:
          label: "organization-defined online meetings and teleconferences"
    sc-16: 
      label: SC-16
      title: Transmission of Security and Privacy Attributes
      statement: |
        Associate {{ insert: param, sc-16_prm_1 }} with information exchanged between systems and between system components.
      parameters:
        sc-16_prm_1:
          label: "organization-defined security and privacy attributes"
    sc-16.01:
      label: SC-16(1)
      parent_control: sc-16
      title: Integrity Verification
      statement: |
        Verify the integrity of transmitted security and privacy attributes.
    sc-16.02:
      label: SC-16(2)
      parent_control: sc-16
      title: Anti-spoofing Mechanisms
      statement: |
        Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.
    sc-16.03:
      label: SC-16(3)
      parent_control: sc-16
      title: Cryptographic Binding
      statement: |
        Implement {{ insert: param, sc-16.3_prm_1 }} to bind security and privacy attributes to transmitted information.
      parameters:
        sc-16.3_prm_1:
          label: "organization-defined mechanisms or techniques"
    sc-17: 
      label: SC-17
      title: Public Key Infrastructure Certificates
      statement: |
        a. Issue public key certificates under an {{ insert: param, sc-17_prm_1 }} or obtain public key certificates from an approved service provider; and
        b. Include only approved trust anchors in trust stores or certificate stores managed by the organization.
      parameters:
        sc-17_prm_1:
          label: "organization-defined certificate policy"
    sc-18: 
      label: SC-18
      title: Mobile Code
      statement: |
        a. Define acceptable and unacceptable mobile code and mobile code technologies; and
        b. Authorize, monitor, and control the use of mobile code within the system.
    sc-18.01:
      label: SC-18(1)
      parent_control: sc-18
      title: Identify Unacceptable Code and Take Corrective Actions
      statement: |
        Identify {{ insert: param, sc-18.1_prm_1 }} and take {{ insert: param, sc-18.1_prm_2 }}.
      parameters:
        sc-18.1_prm_1:
          label: "organization-defined unacceptable mobile code"
        sc-18.1_prm_2:
          label: "organization-defined corrective actions"
    sc-18.02:
      label: SC-18(2)
      parent_control: sc-18
      title: Acquisition, Development, and Use
      statement: |
        Verify that the acquisition, development, and use of mobile code to be deployed in the system meets {{ insert: param, sc-18.2_prm_1 }}.
      parameters:
        sc-18.2_prm_1:
          label: "organization-defined mobile code requirements"
    sc-18.03:
      label: SC-18(3)
      parent_control: sc-18
      title: Prevent Downloading and Execution
      statement: |
        Prevent the download and execution of {{ insert: param, sc-18.3_prm_1 }}.
      parameters:
        sc-18.3_prm_1:
          label: "organization-defined unacceptable mobile code"
    sc-18.04:
      label: SC-18(4)
      parent_control: sc-18
      title: Prevent Automatic Execution
      statement: |
        Prevent the automatic execution of mobile code in {{ insert: param, sc-18.4_prm_1 }} and enforce {{ insert: param, sc-18.4_prm_2 }} prior to executing the code.
      parameters:
        sc-18.4_prm_1:
          label: "organization-defined software applications"
        sc-18.4_prm_2:
          label: "organization-defined actions"
    sc-18.05:
      label: SC-18(5)
      parent_control: sc-18
      title: Allow Execution Only in Confined Environments
      statement: |
        Allow execution of permitted mobile code only in confined virtual machine environments.
    sc-19: 
      label: SC-19
      title: Voice Over Internet Protocol
      statement: |
        Technology-specific; addressed as any other technology or protocol.
    sc-20: 
      label: SC-20
      title: Secure Name/address Resolution Service (authoritative Source)
      statement: |
        a. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and
        b. Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.
    sc-20.02:
      label: SC-20(2)
      parent_control: sc-20
      title: Data Origin and Integrity
      statement: |
        Provide data origin and integrity protection artifacts for internal name/address resolution queries.
    sc-21: 
      label: SC-21
      title: Secure Name/address Resolution Service (recursive or Caching Resolver)
      statement: |
        Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
    sc-22: 
      label: SC-22
      title: Architecture and Provisioning for Name/address Resolution Service
      statement: |
        Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation.
    sc-23: 
      label: SC-23
      title: Session Authenticity
      statement: |
        Protect the authenticity of communications sessions.
    sc-23.01:
      label: SC-23(1)
      parent_control: sc-23
      title: Invalidate Session Identifiers at Logout
      statement: |
        Invalidate session identifiers upon user logout or other session termination.
    sc-23.03:
      label: SC-23(3)
      parent_control: sc-23
      title: Unique System-generated Session Identifiers
      statement: |
        Generate a unique session identifier for each session with {{ insert: param, sc-23.3_prm_1 }} and recognize only session identifiers that are system-generated.
      parameters:
        sc-23.3_prm_1:
          label: "organization-defined randomness requirements"
    sc-23.05:
      label: SC-23(5)
      parent_control: sc-23
      title: Allowed Certificate Authorities
      statement: |
        Only allow the use of {{ insert: param, sc-23.5_prm_1 }} for verification of the establishment of protected sessions.
      parameters:
        sc-23.5_prm_1:
          label: "organization-defined certificate authorities"
    sc-24: 
      label: SC-24
      title: Fail in Known State
      statement: |
        Fail to a {{ insert: param, sc-24_prm_1 }} for the following failures on the indicated components while preserving {{ insert: param, sc-24_prm_2 }} in failure: {{ insert: param, sc-24_prm_3 }}.
      parameters:
        sc-24_prm_1:
          label: "organization-defined known system state"
        sc-24_prm_2:
          label: "organization-defined system state information"
        sc-24_prm_3:
          label: "list of organization-defined types of system failures on organization-defined system components"
    sc-25: 
      label: SC-25
      title: Thin Nodes
      statement: |
        Employ minimal functionality and information storage on the following system components: {{ insert: param, sc-25_prm_1 }}.
      parameters:
        sc-25_prm_1:
          label: "organization-defined system components"
    sc-26: 
      label: SC-26
      title: Decoys
      statement: |
        Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.
    sc-27: 
      label: SC-27
      title: Platform-independent Applications
      statement: |
        Include within organizational systems the following platform independent applications: {{ insert: param, sc-27_prm_1 }}.
      parameters:
        sc-27_prm_1:
          label: "organization-defined platform-independent applications"
    sc-28: 
      label: SC-28
      title: Protection of Information at Rest
      statement: |
        Protect the {{ insert: param, sc-28_prm_1 }} of the following information at rest: {{ insert: param, sc-28_prm_2 }}.
      parameters:
        sc-28_prm_1:
          how-many: one or more
          choice:
            - "confidentiality"
            - "integrity"
        sc-28_prm_2:
          label: "organization-defined information at rest"
    sc-28.01:
      label: SC-28(1)
      parent_control: sc-28
      title: Cryptographic Protection
      statement: |
        Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on {{ insert: param, sc-28.1_prm_1 }}: {{ insert: param, sc-28.1_prm_2 }}.
      parameters:
        sc-28.1_prm_1:
          label: "organization-defined system components or media"
        sc-28.1_prm_2:
          label: "organization-defined information"
    sc-28.02:
      label: SC-28(2)
      parent_control: sc-28
      title: Offline Storage
      statement: |
        Remove the following information from online storage and store offline in a secure location: {{ insert: param, sc-28.2_prm_1 }}.
      parameters:
        sc-28.2_prm_1:
          label: "organization-defined information"
    sc-28.03:
      label: SC-28(3)
      parent_control: sc-28
      title: Cryptographic Keys
      statement: |
        Provide protected storage for cryptographic keys {{ insert: param, sc-28.3_prm_1 }}.
      parameters:
        sc-28.3_prm_1:
          choice:
            - " {{ insert: param, sc-28.3_prm_2 }} "
            - "hardware-protected key store"
        sc-28.3_prm_2:
          label: "organization-defined safeguards"
    sc-29: 
      label: SC-29
      title: Heterogeneity
      statement: |
        Employ a diverse set of information technologies for the following system components in the implementation of the system: {{ insert: param, sc-29_prm_1 }}.
      parameters:
        sc-29_prm_1:
          label: "organization-defined system components"
    sc-29.01:
      label: SC-29(1)
      parent_control: sc-29
      title: Virtualization Techniques
      statement: |
        Employ virtualization techniques to support the deployment of a diversity of operating systems and applications that are changed {{ insert: param, sc-29.1_prm_1 }}.
      parameters:
        sc-29.1_prm_1:
          label: "organization-defined frequency"
    sc-30: 
      label: SC-30
      title: Concealment and Misdirection
      statement: |
        Employ the following concealment and misdirection techniques for {{ insert: param, sc-30_prm_1 }} at {{ insert: param, sc-30_prm_2 }} to confuse and mislead adversaries: {{ insert: param, sc-30_prm_3 }}.
      parameters:
        sc-30_prm_1:
          label: "organization-defined systems"
        sc-30_prm_2:
          label: "organization-defined time periods"
        sc-30_prm_3:
          label: "organization-defined concealment and misdirection techniques"
    sc-30.02:
      label: SC-30(2)
      parent_control: sc-30
      title: Randomness
      statement: |
        Employ {{ insert: param, sc-30.2_prm_1 }} to introduce randomness into organizational operations and assets.
      parameters:
        sc-30.2_prm_1:
          label: "organization-defined techniques"
    sc-30.03:
      label: SC-30(3)
      parent_control: sc-30
      title: Change Processing and Storage Locations
      statement: |
        Change the location of {{ insert: param, sc-30.3_prm_1 }} {{ insert: param, sc-30.3_prm_2 }}].
      parameters:
        sc-30.3_prm_1:
          label: "organization-defined processing and/or storage"
        sc-30.3_prm_2:
          choice:
            - " {{ insert: param, sc-30.3_prm_3 }} "
            - "at random time intervals"
        sc-30.3_prm_3:
          label: "organization-defined time frequency"
    sc-30.04:
      label: SC-30(4)
      parent_control: sc-30
      title: Misleading Information
      statement: |
        Employ realistic, but misleading information in {{ insert: param, sc-30.4_prm_1 }} about its security state or posture.
      parameters:
        sc-30.4_prm_1:
          label: "organization-defined system components"
    sc-30.05:
      label: SC-30(5)
      parent_control: sc-30
      title: Concealment of System Components
      statement: |
        Employ the following techniques to hide or conceal {{ insert: param, sc-30.5_prm_1 }}: {{ insert: param, sc-30.5_prm_2 }}.
      parameters:
        sc-30.5_prm_1:
          label: "organization-defined system components"
        sc-30.5_prm_2:
          label: "organization-defined techniques"
    sc-31: 
      label: SC-31
      title: Covert Channel Analysis
      statement: |
        a. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert {{ insert: param, sc-31_prm_1 }} channels; and
        b. Estimate the maximum bandwidth of those channels.
      parameters:
        sc-31_prm_1:
          how-many: one or more
          choice:
            - "storage"
            - "timing"
    sc-31.01:
      label: SC-31(1)
      parent_control: sc-31
      title: Test Covert Channels for Exploitability
      statement: |
        Test a subset of the identified covert channels to determine the channels that are exploitable.
    sc-31.02:
      label: SC-31(2)
      parent_control: sc-31
      title: Maximum Bandwidth
      statement: |
        Reduce the maximum bandwidth for identified covert {{ insert: param, sc-31.2_prm_1 }} channels to {{ insert: param, sc-31.2_prm_2 }}.
      parameters:
        sc-31.2_prm_1:
          how-many: one or more
          choice:
            - "storage"
            - "timing"
        sc-31.2_prm_2:
          label: "organization-defined values"
    sc-31.03:
      label: SC-31(3)
      parent_control: sc-31
      title: Measure Bandwidth in Operational Environments
      statement: |
        Measure the bandwidth of {{ insert: param, sc-31.3_prm_1 }} in the operational environment of the system.
      parameters:
        sc-31.3_prm_1:
          label: "organization-defined subset of identified covert channels"
    sc-32: 
      label: SC-32
      title: System Partitioning
      statement: |
        Partition the system into {{ insert: param, sc-32_prm_1 }} residing in separate {{ insert: param, sc-32_prm_2 }} domains or environments based on {{ insert: param, sc-32_prm_3 }}.
      parameters:
        sc-32_prm_1:
          label: "organization-defined system components"
        sc-32_prm_2:
          choice:
            - "physical"
            - "logical"
        sc-32_prm_3:
          label: "organization-defined circumstances for physical or logical separation of components"
    sc-32.01:
      label: SC-32(1)
      parent_control: sc-32
      title: Separate Physical Domains for Privileged Functions
      statement: |
        Partition privileged functions into separate physical domains.
    sc-34: 
      label: SC-34
      title: Non-modifiable Executable Programs
      statement: |
        For {{ insert: param, sc-34_prm_1 }}, load and execute:
          a. The operating environment from hardware-enforced, read-only media; and
          b. The following applications from hardware-enforced, read-only media: {{ insert: param, sc-34_prm_2 }}.
      parameters:
        sc-34_prm_1:
          label: "organization-defined system components"
        sc-34_prm_2:
          label: "organization-defined applications"
    sc-34.01:
      label: SC-34(1)
      parent_control: sc-34
      title: No Writable Storage
      statement: |
        Employ {{ insert: param, sc-34.1_prm_1 }} with no writeable storage that is persistent across component restart or power on/off.
      parameters:
        sc-34.1_prm_1:
          label: "organization-defined system components"
    sc-34.02:
      label: SC-34(2)
      parent_control: sc-34
      title: Integrity Protection on Read-only Media
      statement: |
        Protect the integrity of information prior to storage on read-only media and control the media after such information has been recorded onto the media.
    sc-35: 
      label: SC-35
      title: External Malicious Code Identification
      statement: |
        Include system components that proactively seek to identify network-based malicious code or malicious websites.
    sc-36: 
      label: SC-36
      title: Distributed Processing and Storage
      statement: |
        Distribute the following processing and storage components across multiple {{ insert: param, sc-36_prm_1 }}: {{ insert: param, sc-36_prm_2 }}.
      parameters:
        sc-36_prm_1:
          choice:
            - "physical locations"
            - "logical domains"
        sc-36_prm_2:
          label: "organization-defined processing and storage components"
    sc-36.01:
      label: SC-36(1)
      parent_control: sc-36
      title: Polling Techniques
      statement: |
        (a) Employ polling techniques to identify potential faults, errors, or compromises to the following processing and storage components: {{ insert: param, sc-36.1_prm_1 }}; and
        (b) Take the following actions in response to identified faults, errors, or compromises: {{ insert: param, sc-36.1_prm_2 }}.
      parameters:
        sc-36.1_prm_1:
          label: "organization-defined distributed processing and storage components"
        sc-36.1_prm_2:
          label: "organization-defined actions"
    sc-36.02:
      label: SC-36(2)
      parent_control: sc-36
      title: Synchronization
      statement: |
        Synchronize the following duplicate systems or system components: {{ insert: param, sc-36.2_prm_1 }}.
      parameters:
        sc-36.2_prm_1:
          label: "organization-defined duplicate systems or system components"
    sc-37: 
      label: SC-37
      title: Out-of-band Channels
      statement: |
        Employ the following out-of-band channels for the physical delivery or electronic transmission of {{ insert: param, sc-37_prm_1 }} to {{ insert: param, sc-37_prm_2 }}: {{ insert: param, sc-37_prm_3 }}.
      parameters:
        sc-37_prm_1:
          label: "organization-defined information, system components, or devices"
        sc-37_prm_2:
          label: "organization-defined individuals or systems"
        sc-37_prm_3:
          label: "organization-defined out-of-band channels"
    sc-37.01:
      label: SC-37(1)
      parent_control: sc-37
      title: Ensure Delivery and Transmission
      statement: |
        Employ {{ insert: param, sc-37.1_prm_1 }} to ensure that only {{ insert: param, sc-37.1_prm_2 }} receive the following information, system components, or devices: {{ insert: param, sc-37.1_prm_3 }}.
      parameters:
        sc-37.1_prm_1:
          label: "organization-defined controls"
        sc-37.1_prm_2:
          label: "organization-defined individuals or systems"
        sc-37.1_prm_3:
          label: "organization-defined information, system components, or devices"
    sc-38: 
      label: SC-38
      title: Operations Security
      statement: |
        Employ the following operations security controls to protect key organizational information throughout the system development life cycle: {{ insert: param, sc-38_prm_1 }}.
      parameters:
        sc-38_prm_1:
          label: "organization-defined operations security controls"
    sc-39: 
      label: SC-39
      title: Process Isolation
      statement: |
        Maintain a separate execution domain for each executing system process.
    sc-39.01:
      label: SC-39(1)
      parent_control: sc-39
      title: Hardware Separation
      statement: |
        Implement hardware separation mechanisms to facilitate process isolation.
    sc-39.02:
      label: SC-39(2)
      parent_control: sc-39
      title: Separate Execution Domain Per Thread
      statement: |
        Maintain a separate execution domain for each thread in {{ insert: param, sc-39.2_prm_1 }}.
      parameters:
        sc-39.2_prm_1:
          label: "organization-defined multi-threaded processing"
    sc-40: 
      label: SC-40
      title: Wireless Link Protection
      statement: |
        Protect external and internal {{ insert: param, sc-40_prm_1 }} from the following signal parameter attacks: {{ insert: param, sc-40_prm_2 }}.
      parameters:
        sc-40_prm_1:
          label: "organization-defined wireless links"
        sc-40_prm_2:
          label: "organization-defined types of signal parameter attacks or references to sources for such attacks"
    sc-40.01:
      label: SC-40(1)
      parent_control: sc-40
      title: Electromagnetic Interference
      statement: |
        Implement cryptographic mechanisms that achieve {{ insert: param, sc-40.1_prm_1 }} against the effects of intentional electromagnetic interference.
      parameters:
        sc-40.1_prm_1:
          label: "organization-defined level of protection"
    sc-40.02:
      label: SC-40(2)
      parent_control: sc-40
      title: Reduce Detection Potential
      statement: |
        Implement cryptographic mechanisms to reduce the detection potential of wireless links to {{ insert: param, sc-40.2_prm_1 }}. 
      parameters:
        sc-40.2_prm_1:
          label: "organization-defined level of reduction"
    sc-40.03:
      label: SC-40(3)
      parent_control: sc-40
      title: Imitative or Manipulative Communications Deception
      statement: |
        Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.
    sc-40.04:
      label: SC-40(4)
      parent_control: sc-40
      title: Signal Parameter Identification
      statement: |
        Implement cryptographic mechanisms to prevent the identification of {{ insert: param, sc-40.4_prm_1 }} by using the transmitter signal parameters. 
      parameters:
        sc-40.4_prm_1:
          label: "organization-defined wireless transmitters"
    sc-41: 
      label: SC-41
      title: Port and I/O Device Access
      statement: |
         {{ insert: param, sc-41_prm_1 }} disable or remove {{ insert: param, sc-41_prm_2 }} on the following systems or system components: {{ insert: param, sc-41_prm_3 }}.
      parameters:
        sc-41_prm_1:
          choice:
            - "Physically"
            - "Logically"
        sc-41_prm_2:
          label: "organization-defined connection ports or input/output devices"
        sc-41_prm_3:
          label: "organization-defined systems or system components"
    sc-42: 
      label: SC-42
      title: Sensor Capability and Data
      statement: |
        a. Prohibit {{ insert: param, sc-42_prm_1 }}; and
        b. Provide an explicit indication of sensor use to {{ insert: param, sc-42_prm_5 }}.
      parameters:
        sc-42_prm_1:
          how-many: one or more
          choice:
            - "the use of devices possessing {{ insert: param, sc-42_prm_2 }} in {{ insert: param, sc-42_prm_3 }} "
            - "the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: {{ insert: param, sc-42_prm_4 }} "
        sc-42_prm_2:
          label: "organization-defined environmental sensing capabilities"
        sc-42_prm_3:
          label: "organization-defined facilities, areas, or systems"
        sc-42_prm_4:
          label: "organization-defined exceptions where remote activation of sensors is allowed"
        sc-42_prm_5:
          label: "organization-defined group of users"
    sc-42.01:
      label: SC-42(1)
      parent_control: sc-42
      title: Reporting to Authorized Individuals or Roles
      statement: |
        Verify that the system is configured so that data or information collected by the {{ insert: param, sc-42.1_prm_1 }} is only reported to authorized individuals or roles.
      parameters:
        sc-42.1_prm_1:
          label: "organization-defined sensors"
    sc-42.02:
      label: SC-42(2)
      parent_control: sc-42
      title: Authorized Use
      statement: |
        Employ the following measures so that data or information collected by {{ insert: param, sc-42.2_prm_1 }} is only used for authorized purposes: {{ insert: param, sc-42.2_prm_2 }}.
      parameters:
        sc-42.2_prm_1:
          label: "organization-defined sensors"
        sc-42.2_prm_2:
          label: "organization-defined measures"
    sc-42.04:
      label: SC-42(4)
      parent_control: sc-42
      title: Notice of Collection
      statement: |
        Employ the following measures to facilitate an individual’s awareness that personally identifiable information is being collected by {{ insert: param, sc-42.4_prm_1 }}: {{ insert: param, sc-42.4_prm_2 }}.
      parameters:
        sc-42.4_prm_1:
          label: "organization-defined sensors"
        sc-42.4_prm_2:
          label: "organization-defined measures"
    sc-42.05:
      label: SC-42(5)
      parent_control: sc-42
      title: Collection Minimization
      statement: |
        Employ {{ insert: param, sc-42.5_prm_1 }} that are configured to minimize the collection of information about individuals that is not needed.
      parameters:
        sc-42.5_prm_1:
          label: "organization-defined sensors"
    sc-43: 
      label: SC-43
      title: Usage Restrictions
      statement: |
        a. Establish usage restrictions and implementation guidelines for the following system components: {{ insert: param, sc-43_prm_1 }}; and
        b. Authorize, monitor, and control the use of such components within the system.
      parameters:
        sc-43_prm_1:
          label: "organization-defined system components"
    sc-44: 
      label: SC-44
      title: Detonation Chambers
      statement: |
        Employ a detonation chamber capability within {{ insert: param, sc-44_prm_1 }}.
      parameters:
        sc-44_prm_1:
          label: "organization-defined system, system component, or location"
    sc-45: 
      label: SC-45
      title: System Time Synchronization
      statement: |
        Synchronize system clocks within and between systems and system components.
    sc-45.01:
      label: SC-45(1)
      parent_control: sc-45
      title: Synchronization with Authoritative Time Source
      statement: |
        (a) Compare the internal system clocks {{ insert: param, sc-45.1_prm_1 }} with {{ insert: param, sc-45.1_prm_2 }}; and
        (b) Synchronize the internal system clocks to the authoritative time source when the time difference is greater than {{ insert: param, sc-45.1_prm_3 }}.
      parameters:
        sc-45.1_prm_1:
          label: "organization-defined frequency"
        sc-45.1_prm_2:
          label: "organization-defined authoritative time source"
        sc-45.1_prm_3:
          label: "organization-defined time period"
    sc-45.02:
      label: SC-45(2)
      parent_control: sc-45
      title: Secondary Authoritative Time Source
      statement: |
        (a) Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source; and
        (b) Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable.
    sc-46: 
      label: SC-46
      title: Cross Domain Policy Enforcement
      statement: |
        Implement a policy enforcement mechanism {{ insert: param, sc-46_prm_1 }} between the physical and/or network interfaces for the connecting security domains.
      parameters:
        sc-46_prm_1:
          choice:
            - "physically"
            - "logically"
    sc-47: 
      label: SC-47
      title: Alternate Communications Paths
      statement: |
        Establish {{ insert: param, sc-47_prm_1 }} for system operations organizational command and control.
      parameters:
        sc-47_prm_1:
          label: "organization-defined alternate communications paths"
    sc-48: 
      label: SC-48
      title: Sensor Relocation
      statement: |
        Relocate {{ insert: param, sc-48_prm_1 }} to {{ insert: param, sc-48_prm_2 }} under the following conditions or circumstances: {{ insert: param, sc-48_prm_3 }}.
      parameters:
        sc-48_prm_1:
          label: "organization-defined sensors and monitoring capabilities"
        sc-48_prm_2:
          label: "organization-defined locations"
        sc-48_prm_3:
          label: "organization-defined conditions or circumstances"
    sc-48.01:
      label: SC-48(1)
      parent_control: sc-48
      title: Dynamic Relocation of Sensors or Monitoring Capabilities
      statement: |
        Dynamically relocate {{ insert: param, sc-48.1_prm_1 }} to {{ insert: param, sc-48.1_prm_2 }} under the following conditions or circumstances: {{ insert: param, sc-48.1_prm_3 }}.
      parameters:
        sc-48.1_prm_1:
          label: "organization-defined sensors and monitoring capabilities"
        sc-48.1_prm_2:
          label: "organization-defined locations"
        sc-48.1_prm_3:
          label: "organization-defined conditions or circumstances"
    sc-49: 
      label: SC-49
      title: Hardware-enforced Separation and Policy Enforcement
      statement: |
        Implement hardware-enforced separation and policy enforcement mechanisms between {{ insert: param, sc-49_prm_1 }}.
      parameters:
        sc-49_prm_1:
          label: "organization-defined security domains"
    sc-50: 
      label: SC-50
      title: Software-enforced Separation and Policy Enforcement
      statement: |
        Implement software-enforced separation and policy enforcement mechanisms between {{ insert: param, sc-50_prm_1 }}.
      parameters:
        sc-50_prm_1:
          label: "organization-defined security domains"
    sc-51: 
      label: SC-51
      title: Hardware-based Protection
      statement: |
        a. Employ hardware-based, write-protect for {{ insert: param, sc-51_prm_1 }}; and
        b. Implement specific procedures for {{ insert: param, sc-51_prm_2 }} to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.
      parameters:
        sc-51_prm_1:
          label: "organization-defined system firmware components"
        sc-51_prm_2:
          label: "organization-defined authorized individuals"
si:
  title: System and Information Integrity
  controls:
    si-01: 
      label: SI-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, si-1_prm_1 }}:
          1.  {{ insert: param, si-1_prm_2 }} system and information integrity policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;
        b. Designate an {{ insert: param, si-1_prm_3 }} to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and
        c. Review and update the current system and information integrity:
          1. Policy {{ insert: param, si-1_prm_4 }} and following {{ insert: param, si-1_prm_5 }}; and
          2. Procedures {{ insert: param, si-1_prm_6 }} and following {{ insert: param, si-1_prm_7 }}.
      parameters:
        si-1_prm_1:
          label: "organization-defined personnel or roles"
        si-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        si-1_prm_3:
          label: "organization-defined official"
        si-1_prm_4:
          label: "organization-defined frequency"
        si-1_prm_5:
          label: "organization-defined events"
        si-1_prm_6:
          label: "organization-defined frequency"
        si-1_prm_7:
          label: "organization-defined events"
    si-02: 
      label: SI-2
      title: Flaw Remediation
      statement: |
        a. Identify, report, and correct system flaws;
        b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
        c. Install security-relevant software and firmware updates within {{ insert: param, si-2_prm_1 }} of the release of the updates; and
        d. Incorporate flaw remediation into the organizational configuration management process.
      parameters:
        si-2_prm_1:
          label: "organization-defined time period"
    si-02.02:
      label: SI-2(2)
      parent_control: si-02
      title: Automated Flaw Remediation Status
      statement: |
        Determine if system components have applicable security-relevant software and firmware updates installed using {{ insert: param, si-2.2_prm_1 }} {{ insert: param, si-2.2_prm_2 }}.
      parameters:
        si-2.2_prm_1:
          label: "organization-defined automated mechanisms"
        si-2.2_prm_2:
          label: "organization-defined frequency"
    si-02.03:
      label: SI-2(3)
      parent_control: si-02
      title: Time to Remediate Flaws and Benchmarks for Corrective Actions
      statement: |
        (a) Measure the time between flaw identification and flaw remediation; and
        (b) Establish the following benchmarks for taking corrective actions: {{ insert: param, si-2.3_prm_1 }}.
      parameters:
        si-2.3_prm_1:
          label: "organization-defined benchmarks"
    si-02.04:
      label: SI-2(4)
      parent_control: si-02
      title: Automated Patch Management Tools
      statement: |
        Employ automated patch management tools to facilitate flaw remediation to the following system components: {{ insert: param, si-2.4_prm_1 }}.
      parameters:
        si-2.4_prm_1:
          label: "organization-defined system components"
    si-02.05:
      label: SI-2(5)
      parent_control: si-02
      title: Automatic Software and Firmware Updates
      statement: |
        Install {{ insert: param, si-2.5_prm_1 }} automatically to {{ insert: param, si-2.5_prm_2 }}.
      parameters:
        si-2.5_prm_1:
          label: "organization-defined security-relevant software and firmware updates"
        si-2.5_prm_2:
          label: "organization-defined system components"
    si-02.06:
      label: SI-2(6)
      parent_control: si-02
      title: Removal of Previous Versions of Software and Firmware
      statement: |
        Remove previous versions of {{ insert: param, si-2.6_prm_1 }} after updated versions have been installed.
      parameters:
        si-2.6_prm_1:
          label: "organization-defined software and firmware components"
    si-03: 
      label: SI-3
      title: Malicious Code Protection
      statement: |
        a. Implement {{ insert: param, si-3_prm_1 }} malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
        b. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
        c. Configure malicious code protection mechanisms to:
          1. Perform periodic scans of the system {{ insert: param, si-3_prm_2 }} and real-time scans of files from external sources at {{ insert: param, si-3_prm_3 }} as the files are downloaded, opened, or executed in accordance with organizational policy; and
          2.  {{ insert: param, si-3_prm_4 }}; and send alert to {{ insert: param, si-3_prm_6 }} in response to malicious code detection; and
        d. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.
      parameters:
        si-3_prm_1:
          how-many: one or more
          choice:
            - "signature based"
            - "non-signature based"
        si-3_prm_2:
          label: "organization-defined frequency"
        si-3_prm_3:
          how-many: one or more
          choice:
            - "endpoint"
            - "network entry and exit points"
        si-3_prm_4:
          how-many: one or more
          choice:
            - "block malicious code"
            - "quarantine malicious code"
            - "take {{ insert: param, si-3_prm_5 }} "
        si-3_prm_5:
          label: "organization-defined action"
        si-3_prm_6:
          label: "organization-defined personnel or roles"
    si-03.04:
      label: SI-3(4)
      parent_control: si-03
      title: Updates Only by Privileged Users
      statement: |
        Update malicious code protection mechanisms only when directed by a privileged user.
    si-03.06:
      label: SI-3(6)
      parent_control: si-03
      title: Testing and Verification
      statement: |
        (a) Test malicious code protection mechanisms {{ insert: param, si-3.6_prm_1 }} by introducing known benign code into the system; and
        (b) Verify that the detection of the code and the associated incident reporting occur.
      parameters:
        si-3.6_prm_1:
          label: "organization-defined frequency"
    si-03.08:
      label: SI-3(8)
      parent_control: si-03
      title: Detect Unauthorized Commands
      statement: |
        (a) Detect the following unauthorized operating system commands through the kernel application programming interface on {{ insert: param, si-3.8_prm_1 }}: {{ insert: param, si-3.8_prm_2 }}; and
        (b)  {{ insert: param, si-3.8_prm_3 }}.
      parameters:
        si-3.8_prm_1:
          label: "organization-defined system hardware components"
        si-3.8_prm_2:
          label: "organization-defined unauthorized operating system commands"
        si-3.8_prm_3:
          how-many: one or more
          choice:
            - "issue a warning"
            - "audit the command execution"
            - "prevent the execution of the command"
    si-03.10:
      label: SI-3(10)
      parent_control: si-03
      title: Malicious Code Analysis
      statement: |
        (a) Employ the following tools and techniques to analyze the characteristics and behavior of malicious code: {{ insert: param, si-3.10_prm_1 }}; and
        (b) Incorporate the results from malicious code analysis into organizational incident response and flaw remediation processes.
      parameters:
        si-3.10_prm_1:
          label: "organization-defined tools and techniques"
    si-04: 
      label: SI-4
      title: System Monitoring
      statement: |
        a. Monitor the system to detect:
          1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: {{ insert: param, si-4_prm_1 }}; and
          2. Unauthorized local, network, and remote connections;
        b. Identify unauthorized use of the system through the following techniques and methods: {{ insert: param, si-4_prm_2 }};
        c. Invoke internal monitoring capabilities or deploy monitoring devices:
          1. Strategically within the system to collect organization-determined essential information; and
          2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;
        d. Analyze detected events and anomalies;
        e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
        f. Obtain legal opinion regarding system monitoring activities; and
        g. Provide {{ insert: param, si-4_prm_3 }} to {{ insert: param, si-4_prm_4 }} {{ insert: param, si-4_prm_5 }}.
      parameters:
        si-4_prm_1:
          label: "organization-defined monitoring objectives"
        si-4_prm_2:
          label: "organization-defined techniques and methods"
        si-4_prm_3:
          label: "organization-defined system monitoring information"
        si-4_prm_4:
          label: "organization-defined personnel or roles"
        si-4_prm_5:
          how-many: one or more
          choice:
            - "as needed"
            - " {{ insert: param, si-4_prm_6 }} "
        si-4_prm_6:
          label: "organization-defined frequency"
    si-04.01:
      label: SI-4(1)
      parent_control: si-04
      title: System-wide Intrusion Detection System
      statement: |
        Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.
    si-04.02:
      label: SI-4(2)
      parent_control: si-04
      title: Automated Tools and Mechanisms for Real-time Analysis
      statement: |
        Employ automated tools and mechanisms to support near real-time analysis of events.
    si-04.03:
      label: SI-4(3)
      parent_control: si-04
      title: Automated Tool and Mechanism Integration
      statement: |
        Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.
    si-04.04:
      label: SI-4(4)
      parent_control: si-04
      title: Inbound and Outbound Communications Traffic
      statement: |
        (a) Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic;
        (b) Monitor inbound and outbound communications traffic {{ insert: param, si-4.4_prm_1 }} for {{ insert: param, si-4.4_prm_2 }}.
      parameters:
        si-4.4_prm_1:
          label: "organization-defined frequency"
        si-4.4_prm_2:
          label: "organization-defined unusual or unauthorized activities or conditions"
    si-04.05:
      label: SI-4(5)
      parent_control: si-04
      title: System-generated Alerts
      statement: |
        Alert {{ insert: param, si-4.5_prm_1 }} when the following system-generated indications of compromise or potential compromise occur: {{ insert: param, si-4.5_prm_2 }}.
      parameters:
        si-4.5_prm_1:
          label: "organization-defined personnel or roles"
        si-4.5_prm_2:
          label: "organization-defined compromise indicators"
    si-04.07:
      label: SI-4(7)
      parent_control: si-04
      title: Automated Response to Suspicious Events
      statement: |
        (a) Notify {{ insert: param, si-4.7_prm_1 }} of detected suspicious events; and
        (b) Take the following actions upon detection: {{ insert: param, si-4.7_prm_2 }}.
      parameters:
        si-4.7_prm_1:
          label: "organization-defined incident response personnel (identified by name and/or by role)"
        si-4.7_prm_2:
          label: "organization-defined least-disruptive actions to terminate suspicious events"
    si-04.09:
      label: SI-4(9)
      parent_control: si-04
      title: Testing of Monitoring Tools and Mechanisms
      statement: |
        Test intrusion-monitoring tools and mechanisms {{ insert: param, si-4.9_prm_1 }}.
      parameters:
        si-4.9_prm_1:
          label: "organization-defined frequency"
    si-04.10:
      label: SI-4(10)
      parent_control: si-04
      title: Visibility of Encrypted Communications
      statement: |
        Make provisions so that {{ insert: param, si-4.10_prm_1 }} is visible to {{ insert: param, si-4.10_prm_2 }}.
      parameters:
        si-4.10_prm_1:
          label: "organization-defined encrypted communications traffic"
        si-4.10_prm_2:
          label: "organization-defined system monitoring tools and mechanisms"
    si-04.11:
      label: SI-4(11)
      parent_control: si-04
      title: Analyze Communications Traffic Anomalies
      statement: |
        Analyze outbound communications traffic at the external interfaces to the system and selected {{ insert: param, si-4.11_prm_1 }} to discover anomalies.
      parameters:
        si-4.11_prm_1:
          label: "organization-defined interior points within the system"
    si-04.12:
      label: SI-4(12)
      parent_control: si-04
      title: Automated Organization-generated Alerts
      statement: |
        Alert {{ insert: param, si-4.12_prm_1 }} using {{ insert: param, si-4.12_prm_2 }} when the following indications of inappropriate or unusual activities with security or privacy implications occur: {{ insert: param, si-4.12_prm_3 }}.
      parameters:
        si-4.12_prm_1:
          label: "organization-defined personnel or roles"
        si-4.12_prm_2:
          label: "organization-defined automated mechanisms"
        si-4.12_prm_3:
          label: "organization-defined activities that trigger alerts"
    si-04.13:
      label: SI-4(13)
      parent_control: si-04
      title: Analyze Traffic and Event Patterns
      statement: |
        (a) Analyze communications traffic and event patterns for the system;
        (b) Develop profiles representing common traffic and event patterns; and
        (c) Use the traffic and event profiles in tuning system-monitoring devices.
    si-04.14:
      label: SI-4(14)
      parent_control: si-04
      title: Wireless Intrusion Detection
      statement: |
        Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
    si-04.15:
      label: SI-4(15)
      parent_control: si-04
      title: Wireless to Wireline Communications
      statement: |
        Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
    si-04.16:
      label: SI-4(16)
      parent_control: si-04
      title: Correlate Monitoring Information
      statement: |
        Correlate information from monitoring tools and mechanisms employed throughout the system.
    si-04.17:
      label: SI-4(17)
      parent_control: si-04
      title: Integrated Situational Awareness
      statement: |
        Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
    si-04.18:
      label: SI-4(18)
      parent_control: si-04
      title: Analyze Traffic and Covert Exfiltration
      statement: |
        Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: {{ insert: param, si-4.18_prm_1 }}.
      parameters:
        si-4.18_prm_1:
          label: "organization-defined interior points within the system"
    si-04.19:
      label: SI-4(19)
      parent_control: si-04
      title: Risk for Individuals
      statement: |
        Implement {{ insert: param, si-4.19_prm_1 }} of individuals who have been identified by {{ insert: param, si-4.19_prm_2 }} as posing an increased level of risk.
      parameters:
        si-4.19_prm_1:
          label: "organization-defined additional monitoring"
        si-4.19_prm_2:
          label: "organization-defined sources"
    si-04.20:
      label: SI-4(20)
      parent_control: si-04
      title: Privileged Users
      statement: |
        Implement the following additional monitoring of privileged users: {{ insert: param, si-4.20_prm_1 }}.
      parameters:
        si-4.20_prm_1:
          label: "organization-defined additional monitoring"
    si-04.21:
      label: SI-4(21)
      parent_control: si-04
      title: Probationary Periods
      statement: |
        Implement the following additional monitoring of individuals during {{ insert: param, si-4.21_prm_1 }}: {{ insert: param, si-4.21_prm_2 }}.
      parameters:
        si-4.21_prm_1:
          label: "organization-defined probationary period"
        si-4.21_prm_2:
          label: "organization-defined additional monitoring"
    si-04.22:
      label: SI-4(22)
      parent_control: si-04
      title: Unauthorized Network Services
      statement: |
        (a) Detect network services that have not been authorized or approved by {{ insert: param, si-4.22_prm_1 }}; and
        (b)  {{ insert: param, si-4.22_prm_2 }} when detected.
      parameters:
        si-4.22_prm_1:
          label: "organization-defined authorization or approval processes"
        si-4.22_prm_2:
          how-many: one or more
          choice:
            - "Audit"
            - "Alert {{ insert: param, si-4.22_prm_3 }} "
        si-4.22_prm_3:
          label: "organization-defined personnel or roles"
    si-04.23:
      label: SI-4(23)
      parent_control: si-04
      title: Host-based Devices
      statement: |
        Implement the following host-based monitoring mechanisms at {{ insert: param, si-4.23_prm_1 }}: {{ insert: param, si-4.23_prm_2 }}.
      parameters:
        si-4.23_prm_1:
          label: "organization-defined system components"
        si-4.23_prm_2:
          label: "organization-defined host-based monitoring mechanisms"
    si-04.24:
      label: SI-4(24)
      parent_control: si-04
      title: Indicators of Compromise
      statement: |
        Discover, collect, and distribute to {{ insert: param, si-4.24_prm_1 }}, indicators of compromise provided by {{ insert: param, si-4.24_prm_2 }}.
      parameters:
        si-4.24_prm_1:
          label: "organization-defined personnel or roles"
        si-4.24_prm_2:
          label: "organization-defined sources"
    si-04.25:
      label: SI-4(25)
      parent_control: si-04
      title: Optimize Network Traffic Analysis
      statement: |
        Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices. 
    si-05: 
      label: SI-5
      title: Security Alerts, Advisories, and Directives
      statement: |
        a. Receive system security alerts, advisories, and directives from {{ insert: param, si-5_prm_1 }} on an ongoing basis;
        b. Generate internal security alerts, advisories, and directives as deemed necessary;
        c. Disseminate security alerts, advisories, and directives to: {{ insert: param, si-5_prm_2 }}; and
        d. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.
      parameters:
        si-5_prm_1:
          label: "organization-defined external organizations"
        si-5_prm_2:
          how-many: one or more
          choice:
            - " {{ insert: param, si-5_prm_3 }} "
            - " {{ insert: param, si-5_prm_4 }} "
            - " {{ insert: param, si-5_prm_5 }} "
        si-5_prm_3:
          label: "organization-defined personnel or roles"
        si-5_prm_4:
          label: "organization-defined elements within the organization"
        si-5_prm_5:
          label: "organization-defined external organizations"
    si-05.01:
      label: SI-5(1)
      parent_control: si-05
      title: Automated Alerts and Advisories
      statement: |
        Broadcast security alert and advisory information throughout the organization using {{ insert: param, si-5.1_prm_1 }}.
      parameters:
        si-5.1_prm_1:
          label: "organization-defined automated mechanisms"
    si-06: 
      label: SI-6
      title: Security and Privacy Function Verification
      statement: |
        a. Verify the correct operation of {{ insert: param, si-6_prm_1 }};
        b. Perform the verification of the functions specified in SI-6a {{ insert: param, si-6_prm_2 }};
        c. Alert {{ insert: param, si-6_prm_5 }} to failed security and privacy verification tests; and
        d.  {{ insert: param, si-6_prm_6 }} when anomalies are discovered.
      parameters:
        si-6_prm_1:
          label: "organization-defined security and privacy functions"
        si-6_prm_2:
          how-many: one or more
          choice:
            - " {{ insert: param, si-6_prm_3 }} "
            - "upon command by user with appropriate privilege"
            - " {{ insert: param, si-6_prm_4 }} "
        si-6_prm_3:
          label: "organization-defined system transitional states"
        si-6_prm_4:
          label: "organization-defined frequency"
        si-6_prm_5:
          label: "organization-defined personnel or roles"
        si-6_prm_6:
          how-many: one or more
          choice:
            - "Shut the system down"
            - "Restart the system"
            - " {{ insert: param, si-6_prm_7 }} "
        si-6_prm_7:
          label: "organization-defined alternative action(s)"
    si-06.02:
      label: SI-6(2)
      parent_control: si-06
      title: Automation Support for Distributed Testing
      statement: |
        Implement automated mechanisms to support the management of distributed security and privacy function testing.
    si-06.03:
      label: SI-6(3)
      parent_control: si-06
      title: Report Verification Results
      statement: |
        Report the results of security and privacy function verification to {{ insert: param, si-6.3_prm_1 }}.
      parameters:
        si-6.3_prm_1:
          label: "organization-defined personnel or roles"
    si-07: 
      label: SI-7
      title: Software, Firmware, and Information Integrity
      statement: |
        a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: {{ insert: param, si-7_prm_1 }}; and
        b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: {{ insert: param, si-7_prm_2 }}.
      parameters:
        si-7_prm_1:
          label: "organization-defined software, firmware, and information"
        si-7_prm_2:
          label: "organization-defined actions"
    si-07.01:
      label: SI-7(1)
      parent_control: si-07
      title: Integrity Checks
      statement: |
        Perform an integrity check of {{ insert: param, si-7.1_prm_1 }} {{ insert: param, si-7.1_prm_2 }}.
      parameters:
        si-7.1_prm_1:
          label: "organization-defined software, firmware, and information"
        si-7.1_prm_2:
          how-many: one or more
          choice:
            - "at startup"
            - "at {{ insert: param, si-7.1_prm_3 }} "
            - " {{ insert: param, si-7.1_prm_4 }} "
        si-7.1_prm_3:
          label: "organization-defined transitional states or security-relevant events"
        si-7.1_prm_4:
          label: "organization-defined frequency"
    si-07.02:
      label: SI-7(2)
      parent_control: si-07
      title: Automated Notifications of Integrity Violations
      statement: |
        Employ automated tools that provide notification to {{ insert: param, si-7.2_prm_1 }} upon discovering discrepancies during integrity verification.
      parameters:
        si-7.2_prm_1:
          label: "organization-defined personnel or roles"
    si-07.03:
      label: SI-7(3)
      parent_control: si-07
      title: Centrally Managed Integrity Tools
      statement: |
        Employ centrally managed integrity verification tools.
    si-07.05:
      label: SI-7(5)
      parent_control: si-07
      title: Automated Response to Integrity Violations
      statement: |
        Automatically {{ insert: param, si-7.5_prm_1 }} when integrity violations are discovered.
      parameters:
        si-7.5_prm_1:
          how-many: one or more
          choice:
            - "shut the system down"
            - "restart the system"
            - "implement {{ insert: param, si-7.5_prm_2 }} "
        si-7.5_prm_2:
          label: "organization-defined controls"
    si-07.06:
      label: SI-7(6)
      parent_control: si-07
      title: Cryptographic Protection
      statement: |
        Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
    si-07.07:
      label: SI-7(7)
      parent_control: si-07
      title: Integration of Detection and Response
      statement: |
        Incorporate the detection of the following unauthorized changes into the organizational incident response capability: {{ insert: param, si-7.7_prm_1 }}.
      parameters:
        si-7.7_prm_1:
          label: "organization-defined security-relevant changes to the system"
    si-07.08:
      label: SI-7(8)
      parent_control: si-07
      title: Auditing Capability for Significant Events
      statement: |
        Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: {{ insert: param, si-7.8_prm_1 }}.
      parameters:
        si-7.8_prm_1:
          how-many: one or more
          choice:
            - "generate an audit record"
            - "alert current user"
            - "alert {{ insert: param, si-7.8_prm_2 }} "
            - " {{ insert: param, si-7.8_prm_3 }} "
        si-7.8_prm_2:
          label: "organization-defined personnel or roles"
        si-7.8_prm_3:
          label: "organization-defined other actions"
    si-07.09:
      label: SI-7(9)
      parent_control: si-07
      title: Verify Boot Process
      statement: |
        Verify the integrity of the boot process of the following system components: {{ insert: param, si-7.9_prm_1 }}.
      parameters:
        si-7.9_prm_1:
          label: "organization-defined system components"
    si-07.10:
      label: SI-7(10)
      parent_control: si-07
      title: Protection of Boot Firmware
      statement: |
        Implement the following mechanisms to protect the integrity of boot firmware in {{ insert: param, si-7.10_prm_1 }}: {{ insert: param, si-7.10_prm_2 }}.
      parameters:
        si-7.10_prm_1:
          label: "organization-defined system components"
        si-7.10_prm_2:
          label: "organization-defined mechanisms"
    si-07.12:
      label: SI-7(12)
      parent_control: si-07
      title: Integrity Verification
      statement: |
        Require that the integrity of the following user-installed software be verified prior to execution: {{ insert: param, si-7.12_prm_1 }}.
      parameters:
        si-7.12_prm_1:
          label: "organization-defined user-installed software"
    si-07.15:
      label: SI-7(15)
      parent_control: si-07
      title: Code Authentication
      statement: |
        Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: {{ insert: param, si-7.15_prm_1 }}.
      parameters:
        si-7.15_prm_1:
          label: "organization-defined software or firmware components"
    si-07.16:
      label: SI-7(16)
      parent_control: si-07
      title: Time Limit on Process Execution Without Supervision
      statement: |
        Prohibit processes from executing without supervision for more than {{ insert: param, si-7.16_prm_1 }}.
      parameters:
        si-7.16_prm_1:
          label: "organization-defined time period"
    si-07.17:
      label: SI-7(17)
      parent_control: si-07
      title: Runtime Application Self-protection
      statement: |
        Implement {{ insert: param, si-7.17_prm_1 }} for application self-protection at runtime.
      parameters:
        si-7.17_prm_1:
          label: "organization-defined controls"
    si-08: 
      label: SI-8
      title: Spam Protection
      statement: |
        a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
        b. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
    si-08.02:
      label: SI-8(2)
      parent_control: si-08
      title: Automatic Updates
      statement: |
        Automatically update spam protection mechanisms {{ insert: param, si-8.2_prm_1 }}.
      parameters:
        si-8.2_prm_1:
          label: "organization-defined frequency"
    si-08.03:
      label: SI-8(3)
      parent_control: si-08
      title: Continuous Learning Capability
      statement: |
        Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.
    si-10: 
      label: SI-10
      title: Information Input Validation
      statement: |
        Check the validity of the following information inputs: {{ insert: param, si-10_prm_1 }}.
      parameters:
        si-10_prm_1:
          label: "organization-defined information inputs to the system"
    si-10.01:
      label: SI-10(1)
      parent_control: si-10
      title: Manual Override Capability
      statement: |
        (a) Provide a manual override capability for input validation of the following information inputs: {{ insert: param, si-10.1_prm_1 }};
        (b) Restrict the use of the manual override capability to only {{ insert: param, si-10.1_prm_2 }}; and
        (c) Audit the use of the manual override capability.
      parameters:
        si-10.1_prm_1:
          label: "organization-defined inputs defined in the base control (SI-10)"
        si-10.1_prm_2:
          label: "organization-defined authorized individuals"
    si-10.02:
      label: SI-10(2)
      parent_control: si-10
      title: Review and Resolve Errors
      statement: |
        Review and resolve input validation errors within {{ insert: param, si-10.2_prm_1 }}.
      parameters:
        si-10.2_prm_1:
          label: "organization-defined time period"
    si-10.03:
      label: SI-10(3)
      parent_control: si-10
      title: Predictable Behavior
      statement: |
        Verify that the system behaves in a predictable and documented manner when invalid inputs are received.
    si-10.04:
      label: SI-10(4)
      parent_control: si-10
      title: Timing Interactions
      statement: |
        Account for timing interactions among system components in determining appropriate responses for invalid inputs.
    si-10.05:
      label: SI-10(5)
      parent_control: si-10
      title: Restrict Inputs to Trusted Sources and Approved Formats
      statement: |
        Restrict the use of information inputs to {{ insert: param, si-10.5_prm_1 }} and/or {{ insert: param, si-10.5_prm_2 }}.
      parameters:
        si-10.5_prm_1:
          label: "organization-defined trusted sources"
        si-10.5_prm_2:
          label: "organization-defined formats"
    si-10.06:
      label: SI-10(6)
      parent_control: si-10
      title: Injection Prevention
      statement: |
        Prevent untrusted data injections.
    si-11: 
      label: SI-11
      title: Error Handling
      statement: |
        a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and
        b. Reveal error messages only to {{ insert: param, si-11_prm_1 }}.
      parameters:
        si-11_prm_1:
          label: "organization-defined personnel or roles"
    si-12: 
      label: SI-12
      title: Information Management and Retention
      statement: |
        Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.
    si-12.01:
      label: SI-12(1)
      parent_control: si-12
      title: Limit Personally Identifiable Information Elements
      statement: |
        Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: {{ insert: param, si-12.1_prm_1 }}.
      parameters:
        si-12.1_prm_1:
          label: "organization-defined elements of personally identifiable information"
    si-12.02:
      label: SI-12(2)
      parent_control: si-12
      title: Minimize Personally Identifiable Information in Testing, Training, and Research
      statement: |
        Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: {{ insert: param, si-12.2_prm_1 }}.
      parameters:
        si-12.2_prm_1:
          label: "organization-defined techniques"
    si-12.03:
      label: SI-12(3)
      parent_control: si-12
      title: Information Disposal
      statement: |
        Use the following techniques to dispose of, destroy, or erase information following the retention period: {{ insert: param, si-12.3_prm_1 }}. 
      parameters:
        si-12.3_prm_1:
          label: "organization-defined techniques"
    si-13: 
      label: SI-13
      title: Predictable Failure Prevention
      statement: |
        a. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: {{ insert: param, si-13_prm_1 }}; and
        b. Provide substitute system components and a means to exchange active and standby components in accordance with the following criteria: {{ insert: param, si-13_prm_2 }}.
      parameters:
        si-13_prm_1:
          label: "organization-defined system components"
        si-13_prm_2:
          label: "organization-defined MTTF substitution criteria"
    si-13.01:
      label: SI-13(1)
      parent_control: si-13
      title: Transferring Component Responsibilities
      statement: |
        Take system components out of service by transferring component responsibilities to substitute components no later than {{ insert: param, si-13.1_prm_1 }} of mean time to failure.
      parameters:
        si-13.1_prm_1:
          label: "organization-defined fraction or percentage"
    si-13.03:
      label: SI-13(3)
      parent_control: si-13
      title: Manual Transfer Between Components
      statement: |
        Manually initiate transfers between active and standby system components when the use of the active component reaches {{ insert: param, si-13.3_prm_1 }} of the mean time to failure.
      parameters:
        si-13.3_prm_1:
          label: "organization-defined percentage"
    si-13.04:
      label: SI-13(4)
      parent_control: si-13
      title: Standby Component Installation and Notification
      statement: |
        If system component failures are detected:
          (a) Ensure that the standby components are successfully and transparently installed within {{ insert: param, si-13.4_prm_1 }}; and
          (b)  {{ insert: param, si-13.4_prm_2 }}.
      parameters:
        si-13.4_prm_1:
          label: "organization-defined time period"
        si-13.4_prm_2:
          how-many: one or more
          choice:
            - "Activate {{ insert: param, si-13.4_prm_3 }} "
            - "Automatically shut down the system"
            - " {{ insert: param, si-13.4_prm_4 }} "
        si-13.4_prm_3:
          label: "organization-defined alarm"
        si-13.4_prm_4:
          label: "organization-defined action"
    si-13.05:
      label: SI-13(5)
      parent_control: si-13
      title: Failover Capability
      statement: |
        Provide {{ insert: param, si-13.5_prm_1 }} {{ insert: param, si-13.5_prm_2 }} for the system.
      parameters:
        si-13.5_prm_1:
          choice:
            - "real-time"
            - "near real-time"
        si-13.5_prm_2:
          label: "organization-defined failover capability"
    si-14: 
      label: SI-14
      title: Non-persistence
      statement: |
        Implement non-persistent {{ insert: param, si-14_prm_1 }} that are initiated in a known state and terminated {{ insert: param, si-14_prm_2 }}.
      parameters:
        si-14_prm_1:
          label: "organization-defined system components and services"
        si-14_prm_2:
          how-many: one or more
          choice:
            - "upon end of session of use"
            - "periodically at {{ insert: param, si-14_prm_3 }} "
        si-14_prm_3:
          label: "organization-defined frequency"
    si-14.01:
      label: SI-14(1)
      parent_control: si-14
      title: Refresh from Trusted Sources
      statement: |
        Obtain software and data employed during system component and service refreshes from the following trusted sources: {{ insert: param, si-14.1_prm_1 }}.
      parameters:
        si-14.1_prm_1:
          label: "organization-defined trusted sources"
    si-14.02:
      label: SI-14(2)
      parent_control: si-14
      title: Non-persistent Information
      statement: |
        (a)  {{ insert: param, si-14.2_prm_1 }}; and
        (b) Delete information when no longer needed.
      parameters:
        si-14.2_prm_1:
          choice:
            - "Refresh {{ insert: param, si-14.2_prm_2 }} {{ insert: param, si-14.2_prm_3 }} "
            - "Generate {{ insert: param, si-14.2_prm_4 }} on demand"
        si-14.2_prm_2:
          label: "organization-defined information"
        si-14.2_prm_3:
          label: "organization-defined frequency"
        si-14.2_prm_4:
          label: "organization-defined information"
    si-14.03:
      label: SI-14(3)
      parent_control: si-14
      title: Non-persistent Connectivity
      statement: |
        Establish connections to the system on demand and terminate connections after {{ insert: param, si-14.3_prm_1 }}.
      parameters:
        si-14.3_prm_1:
          choice:
            - "completion of a request"
            - "a period of non-use"
    si-15: 
      label: SI-15
      title: Information Output Filtering
      statement: |
        Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: {{ insert: param, si-15_prm_1 }}.
      parameters:
        si-15_prm_1:
          label: "organization-defined software programs and/or applications"
    si-16: 
      label: SI-16
      title: Memory Protection
      statement: |
        Implement the following controls to protect the system memory from unauthorized code execution: {{ insert: param, si-16_prm_1 }}.
      parameters:
        si-16_prm_1:
          label: "organization-defined controls"
    si-17: 
      label: SI-17
      title: Fail-safe Procedures
      statement: |
        Implement the indicated fail-safe procedures when the indicated failures occur: {{ insert: param, si-17_prm_1 }}.
      parameters:
        si-17_prm_1:
          label: "organization-defined list of failure conditions and associated fail-safe procedures"
    si-18: 
      label: SI-18
      title: Personally Identifiable Information Quality Operations
      statement: |
        a. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle {{ insert: param, si-18_prm_1 }}; and
        b. Correct or delete inaccurate or outdated personally identifiable information.
      parameters:
        si-18_prm_1:
          label: "organization-defined frequency"
    si-18.01:
      label: SI-18(1)
      parent_control: si-18
      title: Automation Support
      statement: |
        Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using {{ insert: param, si-18.1_prm_1 }}.
      parameters:
        si-18.1_prm_1:
          label: "organization-defined automated mechanisms"
    si-18.02:
      label: SI-18(2)
      parent_control: si-18
      title: Data Tags
      statement: |
        Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.
    si-18.03:
      label: SI-18(3)
      parent_control: si-18
      title: Collection
      statement: |
        Collect personally identifiable information directly from the individual.
    si-18.04:
      label: SI-18(4)
      parent_control: si-18
      title: Individual Requests
      statement: |
        Correct or delete personally identifiable information upon request by individuals or their designated representatives.
    si-18.05:
      label: SI-18(5)
      parent_control: si-18
      title: Notice of Correction or Deletion
      statement: |
        Notify {{ insert: param, si-18.5_prm_1 }} and individuals that the personally identifiable information has been corrected or deleted.
      parameters:
        si-18.5_prm_1:
          label: "organization-defined recipients of personally identifiable information"
    si-19: 
      label: SI-19
      title: De-identification
      statement: |
        a. Remove the following elements of personally identifiable information from datasets: {{ insert: param, si-19_prm_1 }}; and
        b. Evaluate {{ insert: param, si-19_prm_2 }} for effectiveness of de-identification.
      parameters:
        si-19_prm_1:
          label: "organization-defined elements of personally identifiable information"
        si-19_prm_2:
          label: "organization-defined frequency"
    si-19.01:
      label: SI-19(1)
      parent_control: si-19
      title: Collection
      statement: |
        De-identify the dataset upon collection by not collecting personally identifiable information.
    si-19.02:
      label: SI-19(2)
      parent_control: si-19
      title: Archiving
      statement: |
        Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived. 
    si-19.03:
      label: SI-19(3)
      parent_control: si-19
      title: Release
      statement: |
        Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release. 
    si-19.04:
      label: SI-19(4)
      parent_control: si-19
      title: Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
      statement: |
        Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.
    si-19.05:
      label: SI-19(5)
      parent_control: si-19
      title: Statistical Disclosure Control
      statement: |
        Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis. 
    si-19.06:
      label: SI-19(6)
      parent_control: si-19
      title: Differential Privacy
      statement: |
        Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
    si-19.07:
      label: SI-19(7)
      parent_control: si-19
      title: Validated Algorithms and Software
      statement: |
        Perform de-identification using validated algorithms and software that is validated to implement the algorithms. 
    si-19.08:
      label: SI-19(8)
      parent_control: si-19
      title: Motivated Intruder
      statement: |
        Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
    si-20: 
      label: SI-20
      title: Tainting
      statement: |
        Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: {{ insert: param, si-20_prm_1 }}.
      parameters:
        si-20_prm_1:
          label: "organization-defined systems or system components"
    si-21: 
      label: SI-21
      title: Information Refresh
      statement: |
        Refresh {{ insert: param, si-21_prm_1 }} at {{ insert: param, si-21_prm_2 }} or generate the information on demand and delete the information when no longer needed.
      parameters:
        si-21_prm_1:
          label: "organization-defined information"
        si-21_prm_2:
          label: "organization-defined frequencies"
    si-22: 
      label: SI-22
      title: Information Diversity
      statement: |
        a. Identify the following alternative sources of information for {{ insert: param, si-22_prm_1 }}: {{ insert: param, si-22_prm_2 }}; and
        b. Use an alternative information source for the execution of essential functions or services on {{ insert: param, si-22_prm_3 }} when the primary source of information is corrupted or unavailable.
      parameters:
        si-22_prm_1:
          label: "organization-defined essential functions and services"
        si-22_prm_2:
          label: "organization-defined alternative information sources"
        si-22_prm_3:
          label: "organization-defined systems or system components"
    si-23: 
      label: SI-23
      title: Information Fragmentation
      statement: |
        Based on {{ insert: param, si-23_prm_1 }}:
          a. Fragment the following information: {{ insert: param, si-23_prm_2 }}; and
          b. Distribute the fragmented information across the following systems or system components: {{ insert: param, si-23_prm_3 }}.
      parameters:
        si-23_prm_1:
          label: "organization-defined circumstances"
        si-23_prm_2:
          label: "organization-defined information"
        si-23_prm_3:
          label: "organization-defined systems or system components"
sr:
  title: Supply Chain Risk Management
  controls:
    sr-01: 
      label: SR-1
      title: Policy and Procedures
      statement: |
        a. Develop, document, and disseminate to {{ insert: param, sr-1_prm_1 }}:
          1.  {{ insert: param, sr-1_prm_2 }} supply chain risk management policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
          2. Procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls;
        b. Designate an {{ insert: param, sr-1_prm_3 }} to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures; and
        c. Review and update the current supply chain risk management:
          1. Policy {{ insert: param, sr-1_prm_4 }} and following {{ insert: param, sr-1_prm_5 }}; and
          2. Procedures {{ insert: param, sr-1_prm_6 }} and following {{ insert: param, sr-1_prm_7 }}.
      parameters:
        sr-1_prm_1:
          label: "organization-defined personnel or roles"
        sr-1_prm_2:
          how-many: one or more
          choice:
            - "Organization-level"
            - "Mission/business process-level"
            - "System-level"
        sr-1_prm_3:
          label: "organization-defined official"
        sr-1_prm_4:
          label: "organization-defined frequency"
        sr-1_prm_5:
          label: "organization-defined events"
        sr-1_prm_6:
          label: "organization-defined frequency"
        sr-1_prm_7:
          label: "organization-defined events"
    sr-02: 
      label: SR-2
      title: Supply Chain Risk Management Plan
      statement: |
        a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: {{ insert: param, sr-2_prm_1 }};
        b. Review and update the supply chain risk management plan {{ insert: param, sr-2_prm_2 }} or as required, to address threat, organizational or environmental changes; and
        c. Protect the supply chain risk management plan from unauthorized disclosure and modification.
      parameters:
        sr-2_prm_1:
          label: "organization-defined systems, system components, or system services"
        sr-2_prm_2:
          label: "organization-defined frequency"
    sr-02.01:
      label: SR-2(1)
      parent_control: sr-02
      title: Establish Scrm Team
      statement: |
        Establish a supply chain risk management team consisting of {{ insert: param, sr-2.1_prm_1 }} to lead and support the following SCRM activities: {{ insert: param, sr-2.1_prm_2 }}.
      parameters:
        sr-2.1_prm_1:
          label: "organization-defined personnel, roles, and responsibilities"
        sr-2.1_prm_2:
          label: "organization-defined supply chain risk management activities"
    sr-03: 
      label: SR-3
      title: Supply Chain Controls and Processes
      statement: |
        a. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of {{ insert: param, sr-3_prm_1 }} in coordination with {{ insert: param, sr-3_prm_2 }};
        b. Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: {{ insert: param, sr-3_prm_3 }}; and
        c. Document the selected and implemented supply chain processes and controls in {{ insert: param, sr-3_prm_4 }}.
      parameters:
        sr-3_prm_1:
          label: "organization-defined system or system component"
        sr-3_prm_2:
          label: "organization-defined supply chain personnel"
        sr-3_prm_3:
          label: "organization-defined supply chain controls"
        sr-3_prm_4:
          choice:
            - "security and privacy plans"
            - "supply chain risk management plan"
            - " {{ insert: param, sr-3_prm_5 }} "
        sr-3_prm_5:
          label: "organization-defined document"
    sr-03.01:
      label: SR-3(1)
      parent_control: sr-03
      title: Diverse Supply Base
      statement: |
        Employ a diverse set of sources for the following system components and services: {{ insert: param, sr-3.1_prm_1 }}.
      parameters:
        sr-3.1_prm_1:
          label: "organization-defined system components and services"
    sr-03.02:
      label: SR-3(2)
      parent_control: sr-03
      title: Limitation of Harm
      statement: |
        Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain: {{ insert: param, sr-3.2_prm_1 }}.
      parameters:
        sr-3.2_prm_1:
          label: "organization-defined controls"
    sr-03.03:
      label: SR-3(3)
      parent_control: sr-03
      title: Sub-tier Flow Down
      statement: |
        Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.
    sr-04: 
      label: SR-4
      title: Provenance
      statement: |
        Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: {{ insert: param, sr-4_prm_1 }}.
      parameters:
        sr-4_prm_1:
          label: "organization-defined systems, system components, and associated data"
    sr-04.01:
      label: SR-4(1)
      parent_control: sr-04
      title: Identity
      statement: |
        Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components: {{ insert: param, sr-4.1_prm_1 }}.
      parameters:
        sr-4.1_prm_1:
          label: "organization-defined supply chain elements, processes, and personnel associated with organization-defined systems and critical system components"
    sr-04.02:
      label: SR-4(2)
      parent_control: sr-04
      title: Track and Trace
      statement: |
        Establish and maintain unique identification of the following systems and critical system components for tracking through the supply chain: {{ insert: param, sr-4.2_prm_1 }}.
      parameters:
        sr-4.2_prm_1:
          label: "organization-defined systems and critical system components"
    sr-04.03:
      label: SR-4(3)
      parent_control: sr-04
      title: Validate as Genuine and Not Altered
      statement: |
        Employ the following controls to validate that the system or system component received is genuine and has not been altered: {{ insert: param, sr-4.3_prm_1 }}.
      parameters:
        sr-4.3_prm_1:
          label: "organization-defined controls"
    sr-04.04:
      label: SR-4(4)
      parent_control: sr-04
      title: Supply Chain Integrity — Pedigree
      statement: |
        Employ {{ insert: param, sr-4.4_prm_1 }} and conduct {{ insert: param, sr-4.4_prm_2 }} to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission-essential technologies, products, and services.
      parameters:
        sr-4.4_prm_1:
          label: "organization-defined controls"
        sr-4.4_prm_2:
          label: "organization-defined analysis"
    sr-05: 
      label: SR-5
      title: Acquisition Strategies, Tools, and Methods
      statement: |
        Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: {{ insert: param, sr-5_prm_1 }}.
      parameters:
        sr-5_prm_1:
          label: "organization-defined acquisition strategies, contract tools, and procurement methods"
    sr-05.01:
      label: SR-5(1)
      parent_control: sr-05
      title: Adequate Supply
      statement: |
        Employ the following controls to ensure an adequate supply of {{ insert: param, sr-5.1_prm_1 }}: {{ insert: param, sr-5.1_prm_2 }}.
      parameters:
        sr-5.1_prm_1:
          label: "organization-defined critical system components"
        sr-5.1_prm_2:
          label: "organization-defined controls"
    sr-05.02:
      label: SR-5(2)
      parent_control: sr-05
      title: Assessments Prior to Selection, Acceptance, Modification, or Update
      statement: |
        Assess the system, system component, or system service prior to selection, acceptance, modification, or update.
    sr-06: 
      label: SR-6
      title: Supplier Assessments and Reviews
      statement: |
        Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide {{ insert: param, sr-6_prm_1 }}.
      parameters:
        sr-6_prm_1:
          label: "organization-defined frequency"
    sr-06.01:
      label: SR-6(1)
      parent_control: sr-06
      title: Testing and Analysis
      statement: |
        Employ {{ insert: param, sr-6.1_prm_1 }} of the following supply chain elements, processes, and actors associated with the system, system component, or system service: {{ insert: param, sr-6.1_prm_2 }}.
      parameters:
        sr-6.1_prm_1:
          how-many: one or more
          choice:
            - "organizational analysis"
            - "independent third-party analysis"
            - "organizational testing"
            - "independent third-party testing"
        sr-6.1_prm_2:
          label: "organization-defined supply chain elements, processes, and actors"
    sr-07: 
      label: SR-7
      title: Supply Chain Operations Security
      statement: |
        Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: {{ insert: param, sr-7_prm_1 }}.
      parameters:
        sr-7_prm_1:
          label: "organization-defined Operations Security (OPSEC) controls"
    sr-08: 
      label: SR-8
      title: Notification Agreements
      statement: |
        Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the {{ insert: param, sr-8_prm_1 }}.
      parameters:
        sr-8_prm_1:
          how-many: one or more
          choice:
            - "notification of supply chain compromises"
            - "results of assessments or audits"
            - " {{ insert: param, sr-8_prm_2 }} "
        sr-8_prm_2:
          label: "organization-defined information"
    sr-09: 
      label: SR-9
      title: Tamper Resistance and Detection
      statement: |
        Implement a tamper protection program for the system, system component, or system service.
    sr-09.01:
      label: SR-9(1)
      parent_control: sr-09
      title: Multiple Stages of System Development Life Cycle
      statement: |
        Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.
    sr-10: 
      label: SR-10
      title: Inspection of Systems or Components
      statement: |
        Inspect the following systems or system components {{ insert: param, sr-10_prm_1 }} to detect tampering: {{ insert: param, sr-10_prm_4 }}.
      parameters:
        sr-10_prm_1:
          how-many: one or more
          choice:
            - "at random"
            - "at {{ insert: param, sr-10_prm_2 }}, upon {{ insert: param, sr-10_prm_3 }} "
        sr-10_prm_2:
          label: "organization-defined frequency"
        sr-10_prm_3:
          label: "organization-defined indications of need for inspection"
        sr-10_prm_4:
          label: "organization-defined systems or system components"
    sr-11: 
      label: SR-11
      title: Component Authenticity
      statement: |
        a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
        b. Report counterfeit system components to {{ insert: param, sr-11_prm_1 }}. 
      parameters:
        sr-11_prm_1:
          how-many: one or more
          choice:
            - "source of counterfeit component"
            - " {{ insert: param, sr-11_prm_2 }} "
            - " {{ insert: param, sr-11_prm_3 }} "
        sr-11_prm_2:
          label: "organization-defined external reporting organizations"
        sr-11_prm_3:
          label: "organization-defined personnel or roles"
    sr-11.01:
      label: SR-11(1)
      parent_control: sr-11
      title: Anti-counterfeit Training
      statement: |
        Train {{ insert: param, sr-11.1_prm_1 }} to detect counterfeit system components (including hardware, software, and firmware).
      parameters:
        sr-11.1_prm_1:
          label: "organization-defined personnel or roles"
    sr-11.02:
      label: SR-11(2)
      parent_control: sr-11
      title: Configuration Control for Component Service and Repair
      statement: |
        Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: {{ insert: param, sr-11.2_prm_1 }}.
      parameters:
        sr-11.2_prm_1:
          label: "organization-defined system components"
    sr-11.03:
      label: SR-11(3)
      parent_control: sr-11
      title: Anti-counterfeit Scanning
      statement: |
        Scan for counterfeit system components {{ insert: param, sr-11.3_prm_1 }}.
      parameters:
        sr-11.3_prm_1:
          label: "organization-defined frequency"
    sr-12: 
      label: SR-12
      title: Component Disposal
      statement: |
        Dispose of {{ insert: param, sr-12_prm_1 }} using the following techniques and methods: {{ insert: param, sr-12_prm_2 }}.
      parameters:
        sr-12_prm_1:
          label: "organization-defined data, documentation, tools, or system components"
        sr-12_prm_2:
          label: "organization-defined techniques and methods"