NIST 800-53 & NIST 800-171 Compliance Software

AC-6 Least Privilege

• a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and
• b. Authorizes wireless access to the information system prior to allowing such connections.

Restricts the connection of classified mobile devices to classified information systems in accordance with [Assignment: organization-defined security policies].

Audit and Accountability

AU-3 Content of Audit Records

The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

• a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and
• b. Reports findings to [Assignment: organization-defined personnel or roles].

• The information system: a. Uses internal system clocks to generate timestamps for audit records; and
• b. Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: organization-defined granularity of time measurement].
• AU-14 Session Audit: The information system provides the capability for authorized users to select a user session to capture/record or view/hear.
• Session audits include, for example, tracking websites visited and recording information and/or file transfers

AU-4 Audit Storage Capacity

The organization allocates audit record storage capacity in accordance with [Assignment: organization-defined audit record storage requirements].

AU-11 Audit Record Retention:

The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

AU-15 Alternate Audit Capability:

Configuration Management

CM-7 Least Functionality

The organization:

•  a. Configures the information system to provide only essential capabilities; and
• b. Prohibits or restricts the use of the following functions, ports, protocols, and/or services: [Assignment: organization-defined prohibited or restricted functions, ports, protocols, and/or services].

The organization employs an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the information system

The organization:

• a. Uses software and associated documentation in accordance with contract agreements and copyright laws;
• b. Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and
• c. Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

The organization:

• a. Establishes [Assignment: organization-defined policies] governing the installation of software by users;
• b. Enforces software installation policies through [Assignment: organization-defined methods]; and
• c. Monitors policy compliance at [Assignment: organization-defined frequency].

Incident Response

The organization tracks and documents information system security incidents.

Media Protection

MP-7 Media Use:

Systems and Services Acquisition

SA-9 External Information System Services | Processing, Storage, and Service Location

The organization restricts the location of [Selection (one or more): information processing; information/data; information system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or conditions].

Supplemental Guidance: The location of information processing, information/data storage, or information system services that are critical to organizations can have a direct impact on the ability of those organizations to successfully execute their missions/business functions. This situation exists when external providers control the location of processing, storage or services.

The criteria external providers use for the selection of processing, storage, or service locations may be different from organizational criteria. For example, organizations may want to ensure that data/information storage locations are restricted to certain locations to facilitate incident response activities (e.g., forensic analyses, after-the-fact investigations) in case of information security breaches/compromises.

• a. Establishes usage restrictions and implementation guidance for [Assignment: organization-defined information system components] based on the potential to cause damage to the information system if used maliciously; and
• b. Authorizes, monitors, and controls the use of such components within the information system.