CyberStrikeus/CyberStrike - Page 123

cm-7-1-periodic-review

Review the system [organization-defined] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services;

cm-7-2-prevent-program-execution

Prevent program execution in accordance with [organization-defined].

cm-7-3-registration-compliance

Ensure compliance with [organization-defined].

cm-7-4-unauthorized-software-deny-by-exception

Identify [organization-defined];

cm-7-5-authorized-software-allow-by-exception

Identify [organization-defined];

cm-7-6-confined-environments-with-limited-privileges

Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [organizatio

cm-7-7-code-execution-in-protected-environments

Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [orga

cm-7-8-binary-or-machine-executable-code

Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code;

cm-7-9-prohibiting-the-use-of-unauthorized-hardware

Identify [organization-defined];

cm-7-least-functionality

Configure the system to provide only [organization-defined] ;

cm-8-1-updates-during-installation-and-removal

Update the inventory of system components as part of component installations, removals, and system updates.

cm-8-2-automated-maintenance

Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [organization-defined].

cm-8-3-automated-unauthorized-component-detection

Detect the presence of unauthorized hardware, software, and firmware components within the system using [organization-defined] [organization-define...

cm-8-4-accountability-information

Include in the system component inventory information, a means for identifying by [organization-defined] , individuals responsible and accountable for

cm-8-5-no-duplicate-accounting-of-components

No Duplicate Accounting of Components

cm-8-6-assessed-configurations-and-approved-deviations

Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.

cm-8-7-centralized-repository

Provide a centralized repository for the inventory of system components.

cm-8-8-automated-location-tracking

Support the tracking of system components by geographic location using [organization-defined].

cm-8-9-assignment-of-components-to-systems

Assign system components to a system;

cm-8-system-component-inventory

Develop and document an inventory of system components that: Accurately reflects the system; Includes all components within the system; Does not inclu

cm-9-1-assignment-of-responsibility

Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system develop

cm-9-configuration-management-plan

Develop, document, and implement a configuration management plan for the system that: Addresses roles, responsibilities, and configuration management

cp-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] contingency planning policy that: Procedures to facilitate the im

cp-10-1-contingency-plan-testing

Contingency Plan Testing

cp-10-2-transaction-recovery

Implement transaction recovery for systems that are transaction-based.

cp-10-3-compensating-security-controls

Addressed through tailoring.

cp-10-4-restore-within-time-period

Provide the capability to restore system components within [organization-defined] from configuration-controlled and integrity-protected information re

cp-10-5-failover-capability

Failover Capability

cp-10-6-component-protection

Protect system components used for recovery and reconstitution.

cp-10-system-recovery-and-reconstitution

Provide for the recovery and reconstitution of the system to a known state within [organization-defined] after a disruption, compromise, or failure.

cp-11-alternate-communications-protocols

Provide the capability to employ [organization-defined] in support of maintaining continuity of operations.

cp-12-safe-mode

When [organization-defined] are detected, enter a safe mode of operation with [organization-defined].

cp-13-alternative-security-mechanisms

Employ [organization-defined] for satisfying [organization-defined] when the primary means of implementing the security function is unavailable or com

cp-2-1-coordinate-with-related-plans

Coordinate contingency plan development with organizational elements responsible for related plans.

cp-2-2-capacity-planning

Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingen

cp-2-3-resume-mission-and-business-functions

Plan for the resumption of [organization-defined] mission and business functions within [organization-defined] of contingency plan activation.

cp-2-4-resume-all-mission-and-business-functions

Resume All Mission and Business Functions

cp-2-5-continue-mission-and-business-functions

Plan for the continuance of [organization-defined] mission and business functions with minimal or no loss of operational continuity and sustains that

cp-2-6-alternate-processing-and-storage-sites

Plan for the transfer of [organization-defined] mission and business functions to alternate processing and/or storage sites with minimal or no loss of

cp-2-7-coordinate-with-external-service-providers

Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.