CyberStrikeus/CyberStrike - Page 132

ps-3-1-classified-information

Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest cl

ps-3-2-formal-indoctrination

Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, ar

ps-3-3-information-requiring-special-protective-measures

Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection: Have valid access authorizat

ps-3-4-citizenship-requirements

Verify that individuals accessing a system processing, storing, or transmitting [organization-defined] meet [organization-defined].

ps-3-personnel-screening

Screen individuals prior to authorizing access to the system;

ps-4-1-post-employment-requirements

Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information;

ps-4-2-automated-actions

Use [organization-defined] to [organization-defined].

ps-4-personnel-termination

Upon termination of individual employment: Disable system access within [organization-defined]; Terminate or revoke any authenticators and credentials

ps-5-personnel-transfer

Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are r...

ps-6-1-information-requiring-special-protection

Information Requiring Special Protection

ps-6-2-classified-information-requiring-special-protection

Verify that access to classified information requiring special protection is granted only to individuals who: Have a valid access authorization that i

ps-6-3-post-employment-requirements

Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information;

ps-6-access-agreements

Develop and document access agreements for organizational systems;

ps-7-external-personnel-security

Establish personnel security requirements, including security roles and responsibilities for external providers;

ps-8-personnel-sanctions

Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures;

ps-9-position-descriptions

Incorporate security and privacy roles and responsibilities into organizational position descriptions.

pt-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] personally identifiable information processing and transparency p

pt-2-1-data-tagging

Attach data tags containing [organization-defined] to [organization-defined].

pt-2-2-automation

Manage enforcement of the authorized processing of personally identifiable information using [organization-defined].

pt-2-authority-to-process-personally-identifiable-information

Determine and document the [organization-defined] that permits the [organization-defined] of personally identifiable information;

pt-3-1-data-tagging

Attach data tags containing the following purposes to [organization-defined]: [organization-defined].

pt-3-2-automation

Track processing purposes of personally identifiable information using [organization-defined].

pt-3-personally-identifiable-information-processing-purposes

Identify and document the [organization-defined] for processing personally identifiable information;

pt-4-1-tailored-consent

Provide [organization-defined] to allow individuals to tailor processing permissions to selected elements of personally identifiable information.

pt-4-2-just-in-time-consent

Present [organization-defined] to individuals at [organization-defined] and in conjunction with [organization-defined].

pt-4-3-revocation

Implement [organization-defined] for individuals to revoke consent to the processing of their personally identifiable information.

pt-4-consent

Implement [organization-defined] for individuals to consent to the processing of their personally identifiable information prior to its collection tha

pt-5-1-just-in-time-notice

Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identi

pt-5-2-privacy-act-statements

Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act st

pt-5-privacy-notice

Provide notice to individuals about the processing of personally identifiable information that: Is available to individuals upon first interacting wit

pt-6-1-routine-uses

Review all routine uses published in the system of records notice at [organization-defined] to ensure continued accuracy, and to ensure that routine u

pt-6-2-exemption-rules

Review all Privacy Act exemptions claimed for the system of records at [organization-defined] to ensure they remain appropriate and necessary in accor

pt-6-system-of-records-notice

For systems that process information that will be maintained in a Privacy Act system of records: Draft system of records notices in accordance with OM

pt-7-1-social-security-numbers

When a system processes Social Security numbers: Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore altern

pt-7-2-first-amendment-information

Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by

pt-7-specific-categories-of-personally-identifiable-information

Apply [organization-defined] for specific categories of personally identifiable information.

pt-8-computer-matching-requirements

When a system or organization processes information for the purpose of conducting a matching program: Obtain approval from the Data Integrity Board to

ra-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] risk assessment policy that: Procedures to facilitate the impleme

ra-10-threat-hunting

Establish and maintain a cyber threat hunting capability to: Search for indicators of compromise in organizational systems; and Detect, track, and dis

ra-2-1-impact-level-prioritization

Conduct an impact-level prioritization of organizational systems to obtain additional granularity on system impact levels.