Framework

NIST SP 800-53 Rev5

NIST SP 800-53 Rev 5 — Security and Privacy Controls

295 requirements · 158 connected unified controls

Version: Rev. 5
Published: 2020-09-23
Amendments: Release 5.2.0 (2025-08-27)

Requirements and control mappings

“Full” and “Partial” describe the catalog mapping to a unified control. A partial mapping includes the remaining requirement. These mappings do not establish an organization’s implementation or certification.

Access Control

Requirement	Unified control and mapping
AC-1Policy and Procedures	UC-GOV-31 — Maintain access control, identity, and personnel security policiesFull
AC-2Account Management	UC-ACCESS-01 — Provision and deprovision accounts through a managed lifecyclePartial Remaining requirement: periodic account review satisfied by the separate access review control
AC-3Access Enforcement	UC-ACCESS-05 — Enforce approved authorizations for information and functionsFull
AC-4Information Flow Enforcement	UC-DATA-11 — Control data flows, leakage, and cross-border transfersFull
AC-5Separation of Duties	UC-ACCESS-03 — Enforce least privilege, need-to-know, and segregation of dutiesFull
AC-6Least Privilege	UC-ACCESS-03 — Enforce least privilege, need-to-know, and segregation of dutiesFull
AC-7Unsuccessful Logon Attempts	UC-ACCESS-11 — Defend logons against brute-force and anomalous attemptsFull
AC-8System Use Notification	UC-ACCESS-13 — Notify users of system terms and previous logon activityFull
AC-9Previous Logon Notification	UC-ACCESS-13 — Notify users of system terms and previous logon activityFull
AC-10Concurrent Session Control	UC-ACCESS-12 — Lock, limit, and terminate user sessionsFull
AC-11Device Lock	UC-ACCESS-12 — Lock, limit, and terminate user sessionsFull
AC-12Session Termination	UC-ACCESS-12 — Lock, limit, and terminate user sessionsFull
AC-14Permitted Actions Without Identification or Authentication	UC-ACCESS-14 — Authorize public content and external information sharingFull
AC-16Security and Privacy Attributes	UC-ACCESS-05 — Enforce approved authorizations for information and functionsPartial Remaining requirement: defining permitted attribute values and auditing/periodically reviewing attribute associations
AC-17Remote Access	UC-NET-02 — Authorize and secure remote, wireless, and mobile accessFull
AC-18Wireless Access	UC-NET-02 — Authorize and secure remote, wireless, and mobile accessFull
AC-19Access Control for Mobile Devices	UC-NET-02 — Authorize and secure remote, wireless, and mobile accessFull
AC-20Use of External Systems	UC-ASSET-06 — Govern acceptable use of endpoints, off-site, and external systemsFull
AC-21Information Sharing	UC-ACCESS-14 — Authorize public content and external information sharingFull
AC-22Publicly Accessible Content	UC-ACCESS-14 — Authorize public content and external information sharingFull
AC-24Access Control Decisions	UC-ACCESS-05 — Enforce approved authorizations for information and functionsFull
AC-25Reference Monitor	UC-ACCESS-05 — Enforce approved authorizations for information and functionsFull

Awareness and Training

Requirement	Unified control and mapping
AT-1Policy and Procedures	UC-GOV-32 — Maintain security awareness and cyber-hygiene policiesFull
AT-2Literacy Training and Awareness	UC-TRAIN-01 — Deliver security awareness training to all personnelFull
AT-3Role-based Training	UC-TRAIN-02 — Train personnel with specialized security roles and dutiesFull
AT-4Training Records	UC-TRAIN-03 — Record training completion and measure effectivenessFull
AT-6Training Feedback	UC-TRAIN-03 — Record training completion and measure effectivenessFull

Audit and Accountability

Requirement	Unified control and mapping
AU-1Policy and Procedures	UC-GOV-33 — Maintain logging, monitoring, and system integrity policiesFull
AU-2Event Logging	UC-LOG-01 — Log security-relevant events across all systemsFull
AU-3Content of Audit Records	UC-LOG-02 — Record complete audit content with synchronized clocksFull
AU-4Audit Log Storage Capacity	UC-LOG-03 — Protect audit logs and retain them for required periodsFull
AU-5Response to Audit Logging Process Failures	UC-LOG-03 — Protect audit logs and retain them for required periodsFull
AU-6Audit Record Review, Analysis, and Reporting	UC-LOG-05 — Correlate and analyze events centrally with threat intelFull
AU-7Audit Record Reduction and Report Generation	UC-LOG-05 — Correlate and analyze events centrally with threat intelFull
AU-8Time Stamps	UC-LOG-02 — Record complete audit content with synchronized clocksFull
AU-9Protection of Audit Information	UC-LOG-03 — Protect audit logs and retain them for required periodsFull
AU-10Non-repudiation	UC-FIN-04 — Authorize transactions with attributable approvalsFull
AU-11Audit Record Retention	UC-LOG-03 — Protect audit logs and retain them for required periodsFull
AU-12Audit Record Generation	UC-LOG-01 — Log security-relevant events across all systemsFull
AU-13Monitoring for Information Disclosure	UC-LOG-11 — Monitor external sources for unauthorized information disclosureFull
AU-14Session Audit	UC-LOG-07 — Monitor user sessions and personnel activityFull
AU-16Cross-organizational Audit Logging	UC-LOG-09 — Monitor providers and exchange audit data across organizationsFull

Assessment, Authorization, and Monitoring

Requirement	Unified control and mapping
CA-1Policy and Procedures	UC-GOV-22 — Assess control effectiveness and authorize systemsFull
CA-2Control Assessments	UC-AUDIT-21 — Assess control effectiveness through testing and monitoringFull
CA-3Information Exchange	UC-TPRM-03 — Bind vendors to security and privacy terms by contractFull
CA-5Plan of Action and Milestones	UC-RISK-14 — Track deficiencies to closure with remediation action plansFull
CA-6Authorization	UC-AUDIT-26 — Authorize systems and internal connections before operationFull
CA-7Continuous Monitoring	UC-LOG-04 — Continuously monitor systems for anomalous activityFull
CA-8Penetration Testing	UC-VULN-02 — Test security through independent penetration exercisesFull
CA-9Internal System Connections	UC-AUDIT-26 — Authorize systems and internal connections before operationPartial Remaining requirement: periodic review of each internal connection's continued need and termination when no longer required (CA-9(c)-(d))

Configuration Management

Requirement	Unified control and mapping
CM-1Policy and Procedures	UC-GOV-29 — Maintain secure acquisition, development, and maintenance policiesFull
CM-2Baseline Configuration	UC-CONFIG-01 — Harden systems to approved secure configuration baselinesFull
CM-3Configuration Change Control	UC-CONFIG-02 — Authorize, test, and approve changes before productionFull
CM-4Impact Analyses	UC-CONFIG-02 — Authorize, test, and approve changes before productionFull
CM-5Access Restrictions for Change	UC-CONFIG-03 — Separate environments and protect production data in testingFull
CM-6Configuration Settings	UC-CONFIG-01 — Harden systems to approved secure configuration baselinesFull
CM-7Least Functionality	UC-CONFIG-01 — Harden systems to approved secure configuration baselinesFull
CM-8System Component Inventory	UC-ASSET-01 — Maintain a complete inventory of systems, hardware, and softwareFull
CM-9Configuration Management Plan	UC-CONFIG-09 — Document configuration management policy, plan, and proceduresFull
CM-10Software Usage Restrictions	UC-CONFIG-05 — Permit only authorized software installation and useFull
CM-11User-installed Software	UC-CONFIG-05 — Permit only authorized software installation and useFull
CM-12Information Location	UC-CONFIG-10 — Map where information resides and how data is processedPartial Remaining requirement: documenting which users have access to components where information resides
CM-13Data Action Mapping	UC-CONFIG-10 — Map where information resides and how data is processedFull
CM-14Signed Components	UC-CONFIG-06 — Verify authenticity and integrity of hardware and softwareFull

Contingency Planning

Requirement	Unified control and mapping
CP-1Policy and Procedures	UC-GOV-34 — Maintain business continuity and contingency planning policyFull
CP-2Contingency Plan	UC-BCDR-01 — Maintain business continuity and disaster recovery plansFull
CP-3Contingency Training	UC-BCDR-10 — Test recovery capabilities and train contingency personnelFull
CP-4Contingency Plan Testing	UC-BCDR-10 — Test recovery capabilities and train contingency personnelFull
CP-6Alternate Storage Site	UC-BCDR-04 — Provide redundant and alternate processing, storage, and telecomFull
CP-7Alternate Processing Site	UC-BCDR-04 — Provide redundant and alternate processing, storage, and telecomFull
CP-8Telecommunications Services	UC-BCDR-04 — Provide redundant and alternate processing, storage, and telecomFull
CP-9System Backup	UC-BCDR-03 — Back up data and verify restorabilityFull
CP-10System Recovery and Reconstitution	UC-BCDR-07 — Execute recovery plans to restore systems and operationsFull
CP-11Alternate Communications Protocols	UC-BCDR-11 — Sustain operations via safe modes and alternate mechanismsFull
CP-12Safe Mode	UC-BCDR-11 — Sustain operations via safe modes and alternate mechanismsFull
CP-13Alternative Security Mechanisms	UC-BCDR-11 — Sustain operations via safe modes and alternate mechanismsFull

Identification and Authentication

Requirement	Unified control and mapping
IA-1Policy and Procedures	UC-GOV-31 — Maintain access control, identity, and personnel security policiesFull
IA-2Identification and Authentication (Organizational Users)	UC-ACCESS-09 — Authenticate all users with multi-factor authenticationFull
IA-3Device Identification and Authentication	UC-ACCESS-10 — Authenticate devices and services before granting connectionsFull
IA-4Identifier Management	UC-ACCESS-06 — Manage unique identities and identifiers end to endFull
IA-5Authenticator Management	UC-ACCESS-08 — Manage and protect authenticators across their lifecycleFull
IA-6Authentication Feedback	UC-ACCESS-08 — Manage and protect authenticators across their lifecycleFull
IA-7Cryptographic Module Authentication	UC-CRYPTO-02 — Use approved algorithms and validated cryptographic modulesPartial Remaining requirement: operator/role authentication to the cryptographic module itself, which mandating validated modules and approved algorithms does not by itself ensure (e.g., FIPS 140 Level 1 modules impose no operator authentication)
IA-8Identification and Authentication (Non-organizational Users)	UC-ACCESS-09 — Authenticate all users with multi-factor authenticationFull
IA-9Service Identification and Authentication	UC-ACCESS-10 — Authenticate devices and services before granting connectionsFull
IA-10Adaptive Authentication	UC-ACCESS-11 — Defend logons against brute-force and anomalous attemptsFull
IA-11Re-authentication	UC-ACCESS-12 — Lock, limit, and terminate user sessionsFull
IA-12Identity Proofing	UC-ACCESS-07 — Proof identities before binding credentialsFull

Incident Response

Requirement	Unified control and mapping
IR-1Policy and Procedures	UC-GOV-35 — Maintain incident response policy and proceduresFull
IR-2Incident Response Training	UC-IR-02 — Train responders and test the incident response capabilityFull
IR-3Incident Response Testing	UC-IR-02 — Train responders and test the incident response capabilityFull
IR-4Incident Handling	UC-IR-06 — Respond to, contain, and eradicate declared incidentsPartial Remaining requirement: IR-4's preparation and detection/analysis phases satisfied by the IR-planning and continuous-monitoring companion controls; this UC begins at incident declaration
IR-5Incident Monitoring	UC-IR-07 — Investigate incidents and preserve evidence and recordsFull
IR-6Incident Reporting	UC-IR-08 — Notify authorities and affected parties within deadlinesFull
IR-7Incident Response Assistance	UC-IR-03 — Provide channels to report events and obtain response helpFull
IR-8Incident Response Plan	UC-IR-01 — Maintain an approved incident response planFull
IR-9Information Spillage Response	UC-IR-11 — Respond to information spillage with defined proceduresFull

Maintenance

Requirement	Unified control and mapping
MA-1Policy and Procedures	UC-GOV-29 — Maintain secure acquisition, development, and maintenance policiesFull
MA-2Controlled Maintenance	UC-CONFIG-07 — Perform controlled, timely maintenance of systems and hardwareFull
MA-3Maintenance Tools	UC-CONFIG-08 — Control maintenance tools, personnel, and remote sessionsFull
MA-4Nonlocal Maintenance	UC-CONFIG-08 — Control maintenance tools, personnel, and remote sessionsFull
MA-5Maintenance Personnel	UC-CONFIG-08 — Control maintenance tools, personnel, and remote sessionsFull
MA-6Timely Maintenance	UC-CONFIG-07 — Perform controlled, timely maintenance of systems and hardwareFull
MA-7Field Maintenance	UC-CONFIG-07 — Perform controlled, timely maintenance of systems and hardwarePartial Remaining requirement: restricting or prohibiting field maintenance to designated trusted maintenance facilities

Media Protection

Requirement	Unified control and mapping
MP-1Policy and Procedures	UC-GOV-30 — Maintain asset, media, and physical protection policiesFull
MP-2Media Access	UC-ASSET-04 — Control storage media through use, storage, and destructionFull
MP-3Media Marking	UC-ASSET-03 — Classify, prioritize, and label information and assetsFull
MP-4Media Storage	UC-DATA-10 — Protect physical media containing sensitive dataFull
MP-5Media Transport	UC-DATA-10 — Protect physical media containing sensitive dataFull
MP-6Media Sanitization	UC-ASSET-04 — Control storage media through use, storage, and destructionFull
MP-7Media Use	UC-ASSET-04 — Control storage media through use, storage, and destructionFull
MP-8Media Downgrading	UC-DATA-10 — Protect physical media containing sensitive dataFull

Physical and Environmental Protection

Requirement	Unified control and mapping
PE-1Policy and Procedures	UC-GOV-30 — Maintain asset, media, and physical protection policiesFull
PE-2Physical Access Authorizations	UC-PHYS-01 — Restrict physical access to facilities and secure areasFull
PE-3Physical Access Control	UC-PHYS-01 — Restrict physical access to facilities and secure areasFull
PE-4Access Control for Transmission	UC-PHYS-06 — Protect power and communications cabling from damage and tapsFull
PE-5Access Control for Output Devices	UC-PHYS-09 — Prevent information exposure at desks, screens, and outputsFull
PE-6Monitoring Physical Access	UC-PHYS-02 — Monitor physical access and retain visitor and entry recordsFull
PE-8Visitor Access Records	UC-PHYS-02 — Monitor physical access and retain visitor and entry recordsFull
PE-9Power Equipment and Cabling	UC-PHYS-06 — Protect power and communications cabling from damage and tapsFull
PE-10Emergency Shutoff	UC-PHYS-05 — Provide emergency power, lighting, and resilient utilitiesFull
PE-11Emergency Power	UC-PHYS-05 — Provide emergency power, lighting, and resilient utilitiesFull
PE-12Emergency Lighting	UC-PHYS-05 — Provide emergency power, lighting, and resilient utilitiesFull
PE-13Fire Protection	UC-PHYS-03 — Protect facilities against fire, water, and environmental hazardsPartial Remaining requirement: fire detection/suppression systems must be supported by an independent energy source
PE-14Environmental Controls	UC-PHYS-03 — Protect facilities against fire, water, and environmental hazardsFull
PE-15Water Damage Protection	UC-PHYS-03 — Protect facilities against fire, water, and environmental hazardsFull
PE-16Delivery and Removal	UC-PHYS-10 — Control and track asset delivery, removal, and movementFull
PE-17Alternate Work Site	UC-PHYS-11 — Secure alternate work sitesFull
PE-18Location of System Components	UC-PHYS-04 — Site facilities and equipment to minimize hazards and exposureFull
PE-19Information Leakage	UC-PHYS-07 — Shield systems from electromagnetic leakage and pulse threatsFull
PE-20Asset Monitoring and Tracking	UC-PHYS-10 — Control and track asset delivery, removal, and movementPartial Remaining requirement: tracking assets within defined controlled areas, not only outside them
PE-21Electromagnetic Pulse Protection	UC-PHYS-07 — Shield systems from electromagnetic leakage and pulse threatsFull
PE-22Component Marking	UC-PHYS-12 — Mark hardware components with handling designationsFull
PE-23Facility Location	UC-PHYS-04 — Site facilities and equipment to minimize hazards and exposureFull

Planning

Requirement	Unified control and mapping
PL-1Policy and Procedures	UC-GOV-14 — Establish and maintain approved security policies and proceduresFull
PL-2System Security and Privacy Plans	UC-GOV-18 — Document and approve system security and privacy plansFull
PL-4Rules of Behavior	UC-GOV-07 — Hold individuals accountable for control responsibilitiesFull
PL-7Concept of Operations	UC-GOV-18 — Document and approve system security and privacy plansFull
PL-8Security and Privacy Architectures	UC-GOV-19 — Maintain enterprise security and privacy architectureFull
PL-9Central Management	UC-GOV-16 — Select and tailor a risk-based control baselineFull
PL-10Baseline Selection	UC-GOV-16 — Select and tailor a risk-based control baselineFull
PL-11Baseline Tailoring	UC-GOV-16 — Select and tailor a risk-based control baselineFull

Program Management

Requirement	Unified control and mapping
PM-1Information Security Program Plan	UC-GOV-15 — Operate a management-approved information security programFull
PM-2Information Security Program Leadership Role	UC-GOV-09 — Appoint accountable security leadership (CISO)Full
PM-3Information Security and Privacy Resources	UC-GOV-11 — Allocate adequate resources and budget for securityFull
PM-4Plan of Action and Milestones Process	UC-RISK-14 — Track deficiencies to closure with remediation action plansFull
PM-5System Inventory	UC-ASSET-01 — Maintain a complete inventory of systems, hardware, and softwareFull
PM-6Measures of Performance	UC-GOV-22 — Assess control effectiveness and authorize systemsFull
PM-7Enterprise Architecture	UC-GOV-19 — Maintain enterprise security and privacy architectureFull
PM-8Critical Infrastructure Plan	UC-GOV-34 — Maintain business continuity and contingency planning policyPartial Remaining requirement: a dedicated critical-infrastructure and key-resources protection plan addressing security and privacy, beyond naming critical infrastructure as a disruption source
PM-9Risk Management Strategy	UC-GOV-17 — Establish enterprise risk management strategy and appetiteFull
PM-10Authorization Process	UC-GOV-22 — Assess control effectiveness and authorize systemsFull
PM-11Mission and Business Process Definition	UC-RISK-04 — Define objectives and business context for risk assessmentFull
PM-12Insider Threat Program	UC-GOV-37 — Operate insider-threat and threat-awareness programsFull
PM-13Security and Privacy Workforce	UC-TRAIN-02 — Train personnel with specialized security roles and dutiesFull
PM-14Testing, Training, and Monitoring	UC-AUDIT-21 — Assess control effectiveness through testing and monitoringFull
PM-15Security and Privacy Groups and Associations	UC-GOV-23 — Maintain contacts with authorities and special interest groupsFull
PM-16Threat Awareness Program	UC-GOV-37 — Operate insider-threat and threat-awareness programsPartial Remaining requirement: PM-16 requires cross-organization (inter-organizational) threat-intelligence sharing, not only internal dissemination
PM-17Protecting Controlled Unclassified Information on External Systems	UC-TPRM-01 — Operate a third-party security risk management programFull
PM-18Privacy Program Plan	UC-GOV-25 — Operate a privacy program with accountable leadershipFull
PM-19Privacy Program Leadership Role	UC-GOV-25 — Operate a privacy program with accountable leadershipFull
PM-20Dissemination of Privacy Program Information	UC-GOV-25 — Operate a privacy program with accountable leadershipFull
PM-21Accounting of Disclosures	UC-GOV-27 — Manage privacy complaints and account for disclosuresFull
PM-22Personally Identifiable Information Quality Management	UC-GOV-26 — Enforce personal-data processing principles and minimizationFull
PM-23Data Governance Body	UC-GOV-20 — Govern data as an asset with accountable oversight bodiesFull
PM-24Data Integrity Board	UC-GOV-20 — Govern data as an asset with accountable oversight bodiesFull
PM-25Minimization of Personally Identifiable Information Used in Testing, Training, and Research	UC-GOV-26 — Enforce personal-data processing principles and minimizationFull
PM-26Complaint Management	UC-GOV-27 — Manage privacy complaints and account for disclosuresFull
PM-27Privacy Reporting	UC-GOV-25 — Operate a privacy program with accountable leadershipFull
PM-28Risk Framing	UC-RISK-03 — Define risk appetite, tolerance, and risk assessment criteriaFull
PM-29Risk Management Program Leadership Roles	UC-GOV-09 — Appoint accountable security leadership (CISO)Full
PM-30Supply Chain Risk Management Strategy	UC-TPRM-01 — Operate a third-party security risk management programFull
PM-31Continuous Monitoring Strategy	UC-GOV-33 — Maintain logging, monitoring, and system integrity policiesPartial Remaining requirement: implementing the monitoring program - ongoing monitoring, correlation/analysis, response actions, and status reporting - satisfied by the continuous-monitoring companion control (CA-7 home)
PM-32Purposing	UC-GOV-18 — Document and approve system security and privacy plansFull

Personnel Security

Requirement	Unified control and mapping
PS-1Policy and Procedures	UC-GOV-31 — Maintain access control, identity, and personnel security policiesFull
PS-2Position Risk Designation	UC-HR-01 — Screen personnel commensurate with position riskFull
PS-3Personnel Screening	UC-HR-01 — Screen personnel commensurate with position riskFull
PS-4Personnel Termination	UC-HR-03 — Secure termination and transfer of personnelFull
PS-5Personnel Transfer	UC-HR-03 — Secure termination and transfer of personnelFull
PS-6Access Agreements	UC-HR-02 — Formalize security responsibilities in employment termsFull
PS-7External Personnel Security	UC-HR-05 — Hold third-party personnel to equivalent security termsFull
PS-8Personnel Sanctions	UC-HR-04 — Enforce a formal disciplinary process for violationsFull
PS-9Position Descriptions	UC-HR-02 — Formalize security responsibilities in employment termsFull

Personally Identifiable Information Processing and Transparency

Requirement	Unified control and mapping
PT-1Policy and Procedures	UC-GOV-26 — Enforce personal-data processing principles and minimizationPartial Remaining requirement: PT-family policy governance of transparency mechanisms - consent, privacy notices, and system-of-records notices - satisfied by the companion notice and consent controls
PT-2Authority to Process Personally Identifiable Information	UC-DATA-01 — Process personal data only under a documented lawful basisFull
PT-3Personally Identifiable Information Processing Purposes	UC-DATA-03 — Limit personal-data use to stated purposes and minimum necessaryFull
PT-4Consent	UC-DATA-02 — Obtain and honor consent for collection, use, and disclosureFull
PT-5Privacy Notice	UC-DATA-05 — Provide privacy notices and transparency to data subjectsFull
PT-6System of Records Notice	UC-DATA-05 — Provide privacy notices and transparency to data subjectsFull
PT-7Specific Categories of Personally Identifiable Information	UC-DATA-04 — Restrict processing of special categories of personal dataFull
PT-8Computer Matching Requirements	UC-DATA-18 — Govern automated matching of PII under formal agreementsFull

Risk Assessment

Requirement	Unified control and mapping
RA-1Policy and Procedures	UC-GOV-17 — Establish enterprise risk management strategy and appetiteFull
RA-2Security Categorization	UC-RISK-18 — Categorize systems and components by impact and criticalityFull
RA-3Risk Assessment	UC-RISK-06 — Perform periodic enterprise risk assessmentsFull
RA-5Vulnerability Monitoring and Scanning	UC-VULN-01 — Scan for vulnerabilities and track advisories on a defined cadenceFull
RA-7Risk Response	UC-RISK-09 — Select, plan, and implement risk treatmentsFull
RA-8Privacy Impact Assessments	UC-RISK-16 — Conduct privacy impact assessments for high-risk processingPartial Remaining requirement: RA-8 mandates PIAs for any PII-processing IT and new collections, not only high-risk
RA-9Criticality Analysis	UC-RISK-18 — Categorize systems and components by impact and criticalityFull
RA-10Threat Hunting	UC-RISK-17 — Operate threat intelligence and threat huntingFull

System and Services Acquisition

Requirement	Unified control and mapping
SA-1Policy and Procedures	UC-GOV-29 — Maintain secure acquisition, development, and maintenance policiesFull
SA-2Allocation of Resources	UC-SDLC-02 — Plan and resource development programs and projectsFull
SA-3System Development Life Cycle	UC-SDLC-01 — Follow a secure development lifecycle with approval gatesFull
SA-4Acquisition Process	UC-TPRM-03 — Bind vendors to security and privacy terms by contractFull
SA-5System Documentation	UC-SDLC-08 — Maintain current system documentation and knowledgeFull
SA-8Security and Privacy Engineering Principles	UC-SDLC-04 — Engineer systems with secure architecture and designPartial Remaining requirement: privacy engineering principles in r5 scope (e.g., data minimization and privacy-by-default in design) satisfied by the software privacy-by-design companion control
SA-9External System Services	UC-TPRM-08 — Govern security of external and cloud service useFull
SA-10Developer Configuration Management	UC-SDLC-06 — Maintain configuration control over systems and codeFull
SA-11Developer Testing and Evaluation	UC-VULN-04 — Test software security during development and acceptanceFull
SA-15Development Process, Standards, and Tools	UC-SDLC-01 — Follow a secure development lifecycle with approval gatesFull
SA-16Developer-provided Training	UC-SDLC-09 — Prepare and train users for new and changed systemsFull
SA-17Developer Security and Privacy Architecture and Design	UC-SDLC-04 — Engineer systems with secure architecture and designPartial Remaining requirement: developer privacy architecture and design description (SA-17 spans security AND privacy architecture) satisfied by the software privacy-by-design companion control
SA-20Customized Development of Critical Components	UC-SDLC-11 — Apply specialized development to critical componentsFull
SA-21Developer Screening	UC-SDLC-10 — Oversee outsourced development and vet developersFull
SA-22Unsupported System Components	UC-SDLC-12 — Manage solution assets and retire unsupported componentsFull
SA-23Specialization	UC-SDLC-11 — Apply specialized development to critical componentsFull

System and Communications Protection

Requirement	Unified control and mapping
SC-1Policy and Procedures	UC-GOV-36 — Maintain communications security and cryptography policiesFull
SC-2Separation of System and User Functionality	UC-NET-04 — Isolate system, user, and security functionsFull
SC-3Security Function Isolation	UC-NET-04 — Isolate system, user, and security functionsFull
SC-4Information in Shared System Resources	UC-NET-05 — Prevent leakage via shared resources and covert channelsFull
SC-5Denial-of-service Protection	UC-NET-08 — Maintain communications availability under attack and failureFull
SC-6Resource Availability	UC-BCDR-05 — Manage capacity to meet availability requirementsFull
SC-7Boundary Protection	UC-NET-01 — Segment networks and defend the external boundaryFull
SC-8Transmission Confidentiality and Integrity	UC-CRYPTO-01 — Encrypt data at rest and in transitPartial Remaining requirement: confidentiality of internal-network transmission - the statement scopes transit encryption to open/public/external networks, while SC-8 applies to internal paths as well
SC-10Network Disconnect	UC-NET-03 — Provide trusted channels and control session lifecycleFull
SC-11Trusted Path	UC-NET-03 — Provide trusted channels and control session lifecycleFull
SC-12Cryptographic Key Establishment and Management	UC-CRYPTO-03 — Manage cryptographic keys and certificates across their lifecycleFull
SC-13Cryptographic Protection	UC-CRYPTO-02 — Use approved algorithms and validated cryptographic modulesFull
SC-15Collaborative Computing Devices and Applications	UC-NET-12 — Restrict communication-capable devices, ports, and sensorsFull
SC-16Transmission of Security and Privacy Attributes	UC-NET-14 — Enforce policy on cross-domain information exchangeFull
SC-17Public Key Infrastructure Certificates	UC-CRYPTO-03 — Manage cryptographic keys and certificates across their lifecyclePartial Remaining requirement: restricting managed trust stores to organization-approved trust anchors only
SC-18Mobile Code	UC-NET-13 — Control mobile code and web contentFull
SC-20Secure Name/Address Resolution Service (Authoritative Source)	UC-NET-07 — Secure name resolution and time servicesFull
SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)	UC-NET-07 — Secure name resolution and time servicesFull
SC-22Architecture and Provisioning for Name/Address Resolution Service	UC-NET-07 — Secure name resolution and time servicesFull
SC-23Session Authenticity	UC-NET-03 — Provide trusted channels and control session lifecycleFull
SC-24Fail in Known State	UC-NET-08 — Maintain communications availability under attack and failureFull
SC-25Thin Nodes	UC-NET-09 — Reduce attack surface through resilient architectureFull
SC-26Decoys	UC-NET-10 — Deploy deception and dynamic detection capabilitiesFull
SC-28Protection of Information at Rest	UC-CRYPTO-01 — Encrypt data at rest and in transitFull
SC-29Heterogeneity	UC-NET-09 — Reduce attack surface through resilient architectureFull
SC-30Concealment and Misdirection	UC-NET-11 — Conceal operational information from adversariesFull
SC-31Covert Channel Analysis	UC-NET-05 — Prevent leakage via shared resources and covert channelsFull
SC-32System Partitioning	UC-NET-04 — Isolate system, user, and security functionsFull
SC-34Non-modifiable Executable Programs	UC-NET-06 — Enforce separation with hardware and software mechanismsFull
SC-35External Malicious Code Identification	UC-NET-10 — Deploy deception and dynamic detection capabilitiesFull
SC-36Distributed Processing and Storage	UC-NET-09 — Reduce attack surface through resilient architectureFull
SC-37Out-of-band Channels	UC-NET-03 — Provide trusted channels and control session lifecycleFull
SC-38Operations Security	UC-NET-11 — Conceal operational information from adversariesFull
SC-39Process Isolation	UC-SDLC-04 — Engineer systems with secure architecture and designFull
SC-40Wireless Link Protection	UC-NET-02 — Authorize and secure remote, wireless, and mobile accessFull
SC-41Port and I/O Device Access	UC-NET-12 — Restrict communication-capable devices, ports, and sensorsFull
SC-42Sensor Capability and Data	UC-NET-12 — Restrict communication-capable devices, ports, and sensorsFull
SC-43Usage Restrictions	UC-NET-12 — Restrict communication-capable devices, ports, and sensorsFull
SC-44Detonation Chambers	UC-NET-10 — Deploy deception and dynamic detection capabilitiesFull
SC-45System Time Synchronization	UC-NET-07 — Secure name resolution and time servicesFull
SC-46Cross Domain Policy Enforcement	UC-NET-14 — Enforce policy on cross-domain information exchangeFull
SC-47Alternate Communications Paths	UC-NET-08 — Maintain communications availability under attack and failureFull
SC-48Sensor Relocation	UC-NET-10 — Deploy deception and dynamic detection capabilitiesFull
SC-49Hardware-enforced Separation and Policy Enforcement	UC-NET-06 — Enforce separation with hardware and software mechanismsFull
SC-50Software-enforced Separation and Policy Enforcement	UC-NET-06 — Enforce separation with hardware and software mechanismsFull
SC-51Hardware-based Protection	UC-NET-06 — Enforce separation with hardware and software mechanismsFull

System and Information Integrity

Requirement	Unified control and mapping
SI-1Policy and Procedures	UC-GOV-33 — Maintain logging, monitoring, and system integrity policiesFull
SI-2Flaw Remediation	UC-VULN-03 — Remediate identified flaws within defined timeframesFull
SI-3Malicious Code Protection	UC-VULN-05 — Block malware, spam, and phishing across all systemsFull
SI-4System Monitoring	UC-LOG-04 — Continuously monitor systems for anomalous activityFull
SI-5Security Alerts, Advisories, and Directives	UC-VULN-01 — Scan for vulnerabilities and track advisories on a defined cadenceFull
SI-6Security and Privacy Function Verification	UC-VULN-06 — Verify software, firmware, and information integrityFull
SI-7Software, Firmware, and Information Integrity	UC-VULN-06 — Verify software, firmware, and information integrityFull
SI-8Spam Protection	UC-VULN-05 — Block malware, spam, and phishing across all systemsFull
SI-10Information Input Validation	UC-SDLC-05 — Enforce secure coding and input validation standardsFull
SI-11Error Handling	UC-VULN-07 — Harden runtime error handling, output filtering, and memoryFull
SI-12Information Management and Retention	UC-DATA-09 — Retain personal and confidential data per schedule, then destroy itFull
SI-13Predictable Failure Prevention	UC-VULN-08 — Engineer systems to fail predictably and safelyFull
SI-14Non-persistence	UC-VULN-09 — Employ non-persistence and information-resilience techniquesFull
SI-15Information Output Filtering	UC-VULN-07 — Harden runtime error handling, output filtering, and memoryFull
SI-16Memory Protection	UC-VULN-07 — Harden runtime error handling, output filtering, and memoryFull
SI-17Fail-safe Procedures	UC-VULN-08 — Engineer systems to fail predictably and safelyFull
SI-18Personally Identifiable Information Quality Operations	UC-DATA-07 — Keep personal data accurate and honor correction requestsFull
SI-19De-identification	UC-DATA-12 — De-identify, mask, or pseudonymize personal dataFull
SI-20Tainting	UC-VULN-11 — Embed taint mechanisms to detect data exfiltrationFull
SI-21Information Refresh	UC-VULN-09 — Employ non-persistence and information-resilience techniquesFull
SI-22Information Diversity	UC-VULN-09 — Employ non-persistence and information-resilience techniquesFull
SI-23Information Fragmentation	UC-VULN-09 — Employ non-persistence and information-resilience techniquesFull

Supply Chain Risk Management

Requirement	Unified control and mapping
SR-1Policy and Procedures	UC-TPRM-01 — Operate a third-party security risk management programFull
SR-2Supply Chain Risk Management Plan	UC-TPRM-01 — Operate a third-party security risk management programFull
SR-3Supply Chain Controls and Processes	UC-TPRM-01 — Operate a third-party security risk management programFull
SR-4Provenance	UC-TPRM-07 — Verify component authenticity, provenance, and integrityFull
SR-5Acquisition Strategies, Tools, and Methods	UC-TPRM-02 — Perform risk-based due diligence before engaging vendorsFull
SR-6Supplier Assessments and Reviews	UC-TPRM-04 — Monitor vendor performance, services, and riskFull
SR-7Supply Chain Operations Security	UC-TPRM-09 — Protect supply chain information through OPSECFull
SR-8Notification Agreements	UC-TPRM-05 — Include suppliers in incident notification and responseFull
SR-9Tamper Resistance and Detection	UC-TPRM-07 — Verify component authenticity, provenance, and integrityFull
SR-10Inspection of Systems or Components	UC-TPRM-07 — Verify component authenticity, provenance, and integrityFull
SR-11Component Authenticity	UC-TPRM-07 — Verify component authenticity, provenance, and integrityFull
SR-12Component Disposal	UC-TPRM-06 — Manage secure termination and disposal at relationship endFull