CyberStrikeus/CyberStrike - Page 137

sa-9-3-establish-and-maintain-trust-relationship-with-providers

Establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or con

sa-9-4-consistent-interests-of-consumers-and-providers

Take the following actions to verify that the interests of [organization-defined] are consistent with and reflect organizational interests: [organizat

sa-9-5-processing-storage-and-service-location

Restrict the location of [organization-defined] to [organization-defined] based on [organization-defined].

sa-9-6-organization-controlled-cryptographic-keys

Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.

sa-9-7-organization-controlled-integrity-checking

Provide the capability to check the integrity of information while it resides in the external system.

sa-9-8-processing-and-storage-location-us-jurisdiction

Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the U

sa-9-external-system-services

Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: ...

sc-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] system and communications protection policy that: Procedures to f

sc-10-network-disconnect

Terminate the network connection associated with a communications session at the end of the session or after [organization-defined] of inactivity.

sc-11-1-irrefutable-communications-path

Provide a trusted communications path that is irrefutably distinguishable from other communications paths;

sc-11-trusted-path

Provide a [organization-defined] isolated trusted communications path for communications between the user and the trusted components of the system;

sc-12-1-availability

Maintain availability of information in the event of the loss of cryptographic keys by users.

sc-12-2-symmetric-keys

Produce, control, and distribute symmetric cryptographic keys using [organization-defined] key management technology and processes.

sc-12-3-asymmetric-keys

Produce, control, and distribute asymmetric cryptographic keys using [organization-defined].

sc-12-4-pki-certificates

PKI Certificates

sc-12-5-pki-certificates-hardware-tokens

PKI Certificates / Hardware Tokens

sc-12-6-physical-control-of-keys

Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.

sc-12-cryptographic-key-establishment-and-management

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements:

sc-13-1-fips-validated-cryptography

FIPS-validated Cryptography

sc-13-2-nsa-approved-cryptography

NSA-approved Cryptography

sc-13-3-individuals-without-formal-access-approvals

Individuals Without Formal Access Approvals

sc-13-4-digital-signatures

Digital Signatures

sc-13-cryptographic-protection

Determine the [organization-defined] ;

sc-14-public-access-protections

Public Access Protections

sc-15-1-physical-or-logical-disconnect

Provide [organization-defined] disconnect of collaborative computing devices in a manner that supports ease of use.

sc-15-2-blocking-inbound-and-outbound-communications-traffic

Blocking Inbound and Outbound Communications Traffic

sc-15-3-disabling-and-removal-in-secure-work-areas

Disable or remove collaborative computing devices and applications from [organization-defined] in [organization-defined].

sc-15-4-explicitly-indicate-current-participants

Provide an explicit indication of current participants in [organization-defined].

sc-15-collaborative-computing-devices-and-applications

Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [organization-defined] ;

sc-16-1-integrity-verification

Verify the integrity of transmitted security and privacy attributes.

sc-16-2-anti-spoofing-mechanisms

Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the securit

sc-16-3-cryptographic-binding

Implement [organization-defined] to bind security and privacy attributes to transmitted information.

sc-16-transmission-of-security-and-privacy-attributes

Associate [organization-defined] with information exchanged between systems and between system components.

sc-17-public-key-infrastructure-certificates

Issue public key certificates under an [organization-defined] or obtain public key certificates from an approved service provider;

sc-18-1-identify-unacceptable-code-and-take-corrective-actions

Identify [organization-defined] and take [organization-defined].

sc-18-2-acquisition-development-and-use

Verify that the acquisition, development, and use of mobile code to be deployed in the system meets [organization-defined].

sc-18-3-prevent-downloading-and-execution

Prevent the download and execution of [organization-defined].

sc-18-4-prevent-automatic-execution

Prevent the automatic execution of mobile code in [organization-defined] and enforce [organization-defined] prior to executing the code.

sc-18-5-allow-execution-only-in-confined-environments

Allow execution of permitted mobile code only in confined virtual machine environments.

sc-18-mobile-code

Define acceptable and unacceptable mobile code and mobile code technologies;