CyberStrikeus/CyberStrike - Page 121

au-9-4-access-by-subset-of-privileged-users

Authorize access to management of audit logging functionality to only [organization-defined].

au-9-5-dual-authorization

Enforce dual authorization for [organization-defined] of [organization-defined].

au-9-6-read-only-access

Authorize read-only access to audit information to [organization-defined].

au-9-7-store-on-component-with-different-operating-system

Store audit information on a component running a different operating system than the system or component being audited.

au-9-protection-of-audit-information

Protect audit information and audit logging tools from unauthorized access, modification, and deletion;

ca-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] assessment, authorization, and monitoring policy that: Procedures

ca-2-1-independent-assessors

Employ independent assessors or assessment teams to conduct control assessments.

ca-2-2-specialized-assessments

Include as part of control assessments, [organization-defined], [organization-defined], [organization-defined].

ca-2-3-leveraging-results-from-external-organizations

Leverage the results of control assessments performed by [organization-defined] on [organization-defined] when the assessment meets [organization-defi

ca-2-control-assessments

Select the appropriate assessor or assessment team for the type of assessment to be conducted;

ca-3-1-unclassified-national-security-system-connections

Unclassified National Security System Connections

ca-3-2-classified-national-security-system-connections

Classified National Security System Connections

ca-3-3-unclassified-non-national-security-system-connections

Unclassified Non-national Security System Connections

ca-3-4-connections-to-public-networks

Connections to Public Networks

ca-3-5-restrictions-on-external-system-connections

Restrictions on External System Connections

ca-3-6-transfer-authorizations

Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or pri

ca-3-7-transitive-information-exchanges

Identify transitive (downstream) information exchanges with other systems through the systems identified in [CA-3a](#ca-3_smt.a) ;

ca-3-information-exchange

Approve and manage the exchange of information between the system and other systems using [organization-defined];

ca-4-security-certification

Security Certification

ca-5-1-automation-support-for-accuracy-and-currency

Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using [organization-defined].

ca-5-plan-of-action-and-milestones

Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or def...

ca-6-1-joint-authorization-intra-organization

Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorizati

ca-6-2-joint-authorization-inter-organization

Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organi

ca-6-authorization

Assign a senior official as the authorizing official for the system;

ca-7-1-independent-assessment

Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.

ca-7-2-types-of-assessments

Types of Assessments

ca-7-3-trend-analyses

Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in

ca-7-4-risk-monitoring

Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: Effectiveness monitoring; Compliance mon

ca-7-5-consistency-analysis

Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: [organization-de

ca-7-6-automation-support-for-monitoring

Ensure the accuracy, currency, and availability of monitoring results for the system using [organization-defined].

ca-7-continuous-monitoring

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitor

ca-8-1-independent-penetration-testing-agent-or-team

Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.

ca-8-2-red-team-exercises

Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules o

ca-8-3-facility-penetration-testing

Employ a penetration testing process that includes [organization-defined] [organization-defined] attempts to bypass or circumvent controls associated

ca-8-penetration-testing

Conduct penetration testing [organization-defined] on [organization-defined].

ca-9-1-compliance-checks

Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection.

ca-9-internal-system-connections

Authorize internal connections of [organization-defined] to the system;

cm-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] configuration management policy that: Procedures to facilitate th

cm-10-1-open-source-software

Establish the following restrictions on the use of open-source software: [organization-defined].

cm-10-software-usage-restrictions

Use software and associated documentation in accordance with contract agreements and copyright laws;