2.2 security control structure

Security controls described in this publication have a well-defined organization and structure. For ease of use in the security control selection and specification process, controls are organized into eighteen families.^[30] Each family contains security controls related to the general security topic of the family. A two-character identifier uniquely identifies security control families, for example, PS (Personnel Security). Security controls may involve aspects of policy, oversight, supervision, manual processes, actions by individuals, or automated mechanisms implemented by information systems/devices. Table 1 lists the security control families and the associated family identifiers in the security control catalog.[31]</sup></sup>

TABLE 1: SECURITY CONTROL IDENTIFIERS AND FAMILY NAMES

The security control structure consists of the following components: (i) a control section; (ii) a supplemental guidance section; (iii) a control enhancements section; (iv) a references section; and (v) a priority and baseline allocation section. The following example from the Auditing and Accountability family illustrates the structure of a typical security control.

AU-3 CONTENT OF AUDIT RECORDS

Control: The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

Supplemental Guidance: Audit record content that may be necessary to satisfy the requirement of this control includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred). Related controls: AU-2, AU-8, AU-12, SI-11.

Control Enhancements:

1. content of audit records | additional audit information

The information system generates audit records containing the following additional information: [Assignment: organization-defined additional, more detailed information].

Supplemental Guidance: Detailed information that organizations may consider in audit records includes, for example, full-text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest.

1. content of audit records | centralized management of planned audit record content

The information system provides centralized management and configuration of the content to be captured in audit records generated by [Assignment: organization-defined information system components].

Supplemental Guidance: This control enhancement requires that the content to be captured in audit records be configured from a central location (necessitating automation). Organizations coordinate the selection of required audit content to support the centralized management and configuration capability provided by the information system. Related controls: AU-6, AU-7.

References: None.

Priority and Baseline Allocation:

The control section prescribes specific security-related activities or actions to be carried out by organizations or by information systems. The term information system refers to those functions that generally involve the implementation of information technology (e.g., hardware, software, and firmware). Conversely, the term organization refers to activities that are generally process-driven or entity-driven—that is, the security control is generally implemented through human or procedural-based actions. Security controls that use the term organization may still require some degree of automation to be fulfilled. Similarly, security controls that use the term information system may have some elements that are process-driven or entity-driven. Using the terms organization and/or information system does not preclude the application of security controls at any of the tiers in the risk management hierarchy (i.e., organization level, mission/business process level, information system level), as appropriate.

For some security controls in the control catalog, a degree of flexibility is provided by allowing organizations to define values for certain parameters associated with the controls. This flexibility is achieved through the use of assignment and selection statements embedded within the security controls and control enhancements. Assignment and selection statements provide organizations with the capability to tailor security controls and control enhancements based on: (i) security requirements to support organizational missions/business functions and operational needs; (ii) risk assessments and organizational risk tolerance; and (iii) security requirements originating in federal laws, Executive Orders, directives, policies, regulations, standards, or guidelines.^[32]</sup>

For example, organizations can specify additional information needed for audit records to support audit event processing. See the AU-3(1) example above (i.e., [Assignment: organization-defined additional, more detailed information]). These assignments may include particular actions to be taken by information systems in the event of audit failures, the frequency of conducting system backups, restrictions on password use, or the distribution list for organizational policies and procedures.^[33] Once specified,[34]</sup> the organization-defined values for assignment and selection statements become part of the security control, and the control implementation is assessed against the completed control statement. Assignment statements offer a high degree of flexibility by allowing organizations to specify parameter values, without requiring those values to be one of two or more specific predefined choices. In contrast, selection statements narrow the potential input values by providing a specific list of items from which organizations must choose.[35]</sup></sup>

The supplemental guidance section provides non-prescriptive, additional information for a specific security control. Organizations can apply the supplemental guidance as appropriate, when defining, developing, and/or implementing security controls. The supplemental guidance can provide important considerations for implementing security controls in the context of operational environments, mission/business requirements, or assessments of risk and can also explain the purpose or meaning of particular controls. Security control enhancements may also contain supplemental guidance when the guidance is not applicable to the entire control but instead focused on a particular control enhancement. The supplemental guidance sections for security controls and control enhancements may contain a list of related controls. Related controls: (i) directly impact or support the implementation of a particular security control or control enhancement; (ii) address a closely related security capability; or (iii) are referenced in the supplemental guidance. Security control enhancements are by definition related to the base control. Related controls that are listed in the supplemental guidance for the base controls are not repeated in the supplemental guidance for the control enhancements. However, there may be related controls identified for control enhancements that are not listed in the base control.

The security control enhancements section provides statements of security capability to: (i) add functionality/specificity to a control; and/or (ii) increase the strength of a control. In both cases, control enhancements are used in information systems and environments of operation requiring greater protection than provided by the base control due to the potential adverse organizational impacts or when organizations seek additions to the base control functionality/specificity based on organizational assessments of risk. Security control enhancements are numbered sequentially within each control so that the enhancements can be easily identified when selected to supplement the base control. Each security control enhancement has a short subtitle to indicate the intended security capability provided by the control enhancement. In the AU-3 example, if the first control enhancement is selected, the control designation becomes AU-3(1). The numerical designation of a control enhancement is used only to identify the particular enhancement within the control. The designation is not indicative of either the strength of the control enhancement or any hierarchical relationship among the enhancements. Control enhancements are not intended to be selected independently (i.e., if a control enhancement is selected, then the corresponding base security control must also be selected). This intent is reflected in the baseline specifications in Appendix D and in the baseline allocation section under each control in Appendix F.

The references section includes a list of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines (e.g., OMB Circulars/Memoranda, Homeland Security Presidential Directives, FIPS Publications, and NIST Special Publications) that are relevant to a particular security control.^[36] The references provide federal legislative and policy mandates as well as supporting information for the implementation of security controls and control enhancements. The references section also contains pertinent websites for organizations to use in obtaining additional information for security control implementation and assessment.</sup>

The priority and security control baseline allocation section provides: (i) the recommended priority codes used for sequencing decisions during security control implementation; and (ii) the initial allocation of security controls and control enhancements to the baselines. Organizations can use the priority code designation associated with each security control to assist in making sequencing decisions for control implementation (i.e., a Priority Code 1 [P1] control has a higher priority for implementation than a Priority Code 2 [P2] control, a Priority Code 2 [P2] control has a higher priority for implementation than a Priority Code 3 [P3] control, and a Priority Code 0 [P0] indicates the security control is not selected in any baseline). This recommended sequencing prioritization helps to ensure that the foundational security controls upon which other controls depend are implemented first, thus enabling organizations to deploy controls in a more structured and timely manner in accordance with available resources. The implementation of security controls by sequence priority code does not imply the achievement of any defined level of risk mitigation until all of the security controls in the security plan have been implemented. The priority codes are intended only for implementation sequencing, not for making security control selection decisions.

2.3 security control baselines

Organizations are required to adequately mitigate the risk arising from use of information and information systems in the execution of missions and business functions. A significant challenge for organizations is to determine the most cost-effective, appropriate set of security controls, which if implemented and determined to be effective, would mitigate risk while complying with security requirements defined by applicable federal laws, Executive Orders, regulations, policies, directives, or standards (e.g., FISMA, OMB Circular A-130, HSPD-12, FIPS Publication 200). There is no one correct set of security controls that addresses all organizational security concerns in all situations. Selecting the most appropriate set of security controls for a specific situation or information system to adequately mitigate risk is an important task that requires a fundamental understanding of organizational mission/business priorities, the mission and business functions the information systems will support, and the environments of operation where the systems will reside. With that understanding, organizations can demonstrate how to most effectively assure the confidentiality, integrity, and availability of organizational information and information systems in a manner that supports mission/business needs while demonstrating due diligence. Selecting, implementing, and maintaining an appropriate set of security controls to adequately protect the information systems employed by organizations requires strong collaboration with system owners to understand ongoing changes to missions/business functions, environments of operation, and how the systems are used.

To assist organizations in making the appropriate selection of security controls for information systems, the concept of baseline controls is introduced. Baseline controls are the starting point for the security control selection process described in this document and are chosen based on the security category and associated impact level of information systems determined in accordance with FIPS Publication 199 and FIPS Publication 200, respectively.^[37] Appendix D provides a listing of the security control baselines. Three security control baselines have been identified corresponding to the low-impact, moderate-impact, and high-impact information systems using the high water mark defined in FIPS Publication 200 and used in Section 3.1 of this document to provide an initial set of security controls for each impact level.[38]</sup></sup>

Appendix F provides a comprehensive catalog of security controls for information systems and organizations, arranged by control families. Chapter Three provides additional information on how to use FIPS Publication 199 security categories and FIPS Publication 200 system impact levels in applying the tailoring guidance to the baseline security controls to achieve adequate risk mitigation.Tailoring guidance, described in Section 3.2, helps organizations to customize the security control baselines selected using the results from organizational assessments of risk. Baseline tailoring actions include: (i) identifying and designating common controls; (ii) applying scoping considerations; (iii) selecting compensating controls; (iv) assigning specific values to security control parameters; (v) supplementing initial baselines with additional security controls or control enhancements; and (vi) providing additional information for control implementation.

Implementation Tip

There are security controls and control enhancements that appear in the security control catalog (Appendix F) that are found in only higher-impact baselines or are not used in any of the baselines. These additional security controls and control enhancements for information systems are available to organizations and can be used in tailoring security control baselines to achieve the needed level of protection in accordance with organizational assessments of risk. The set of security controls in the security plan must be sufficient to adequately mitigate risks to organizational operations and assets, individuals, other organizations, and the Nation based on the organizational risk tolerance.

³⁰. Of the eighteen security control families in NIST Special Publication 800-53, seventeen families are described in the security control catalog in Appendix F, and are closely aligned with the seventeen minimum security requirements for federal information and information systems in FIPS Publication 200. One additional family (Program Management [PM] family) provides controls for information security programs required by FISMA. This family, while not specifically referenced in FIPS Publication 200, provides security controls at the organization level rather than the information system level. See Appendix G for a description of and implementation guidance for the PM controls. ↩

³¹. Privacy controls listed in Appendix J, have an organization and structure similar to security controls, including the use of two-character identifiers for the eight privacy families. ↩

³². In general, organization-defined parameters used in assignment and selection statements in the basic security controls apply also to all control enhancements associated with those controls. ↩

³³. Organizations determine whether specific assignment or selection statements are completed at Tier 1 (organization level), Tier 2 (mission/business process level), Tier 3 (information system level), or a combination thereof. ↩

³⁴. Organizations may choose to define specific values for security control parameters in policies, procedures, or guidance (which may be applicable to more than one information system) referencing the source documents in the security plan in lieu of explicitly completing the assignment/selection statements within the control as part of the plan. ↩

³⁵. Security controls are generally designed to be technology- and implementation-independent, and therefore do not contain specific requirements in these areas. Organizations provide such requirements as deemed necessary in the security plan for the information system. ↩

³⁶. Publications listed in the references section refer to the most recent versions of the publications. References are provided to assist organizations in applying the security controls and are not intended to be inclusive or complete. ↩

³⁷. CNSS Instruction 1253 provides guidance on security control baselines for national security systems. ↑ ↩

³⁸. The baseline security controls contained in Appendix D are not necessarily absolutes in that the guidance described in Section 3.2 provides organizations with the ability to tailor controls in accordance with the terms and conditions established by their authorizing officials and documented in their respective security plans. ↩