Calc test

Job ID: Calc-test-082225150827 2025-08-22 Completed

Upload Documents

Overall Alignment

82.8%

Excellent Coverage

Controls Aligned

275 / 332

275 out of 332 controls found

Frameworks

CIS NIST

Assessment frameworks applied

Key Controls

87 / 101

Critical controls identified

Overall Alignment

Framework Breakdown

Key Controls Status

Framework Compliance Overview

Framework	Total Controls	Aligned	Gaps	Compliance Progress
CIS	34	29	5	85.29% Excellent
NIST	298	246	52	82.55% Excellent
OVERALL	332	275	57	82.8%

Document Analysis Details

anonymized_2.1_IS_Acceptable_Use_Standard.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	37	3	8.11%
NIST	328	60	18.29%

anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	37	1	2.7%
NIST	328	61	18.6%

anonymized_3.0_IS_Information_Security_Policy_2.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	37	3	8.11%
NIST	328	92	28.05%

anonymized_2.0_IS_Acceptable_Use_Policy.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	37	2	5.41%
NIST	328	53	16.16%

37 Total Controls

Control ID	Control Name	Status	Evidence Section	Document
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	Asset Management – Establishes controls for asset identifica...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	Asset Management – Establishes controls for asset identifica...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
1.2	Address Unauthorized Assets	Aligned	Asset Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
1.2	Address Unauthorized Assets	Aligned	1.2 REQUIREMENTS - Access Control...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
1.2	Address Unauthorized Assets	Aligned	Asset Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
1.3	Utilize an Active Discovery Tool	Gap	Utilize an active discovery tool to identify assets connected to the enterprise’s network. Configure...
1.4	Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory	Aligned	MAINTAINANCE...	anonymized_7.1_IS_Asset_Management_Standard.pdf
1.5	Use a Passive Asset Discovery Tool	Gap	Use a passive discovery tool to identify assets connected to the enterprise’s network. Review and us...
2.1	Establish and Maintain a Software Inventory	Aligned	Inventory of Assets...	anonymized_7.0_IS_Asset_Management_Policy.pdf
2.2	Ensure Authorized Software is Currently Supported Key Control	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
2.2	Ensure Authorized Software is Currently Supported Key Control	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
2.3	Address Unauthorized Software	Aligned	Software...	anonymized_6.1_IS_Data_Security_Standards.pdf
2.4	Utilize Automated Software Inventory Tools	Aligned	Inventory of Assets...	anonymized_7.0_IS_Asset_Management_Policy.pdf
2.7	Allowlist Authorized Scripts	Gap	Use technical controls, such as digital signatures and version control, to ensure that only authoriz...
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	IT Asset (NEW) and other assets Retirement and Disposal...	anonymized_7.1_IS_Asset_Management_Standard.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	1.8 DATA RETENTION and 1.9 ROLES & RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
3.2	Establish and Maintain a Data Inventory	Gap	Establish and maintain a data inventory based on the enterprise’s data management process. Inventory...
3.3	Configure Data Access Control Lists	Aligned	Define desktop and end-user device security access controls....	anonymized_7.2_IS_End_User_Device_Standard.pdf
3.3	Configure Data Access Control Lists	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
3.3	Configure Data Access Control Lists	Aligned	Access Control...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
3.3	Configure Data Access Control Lists	Aligned	1.2.1 Access Control...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
3.4	Enforce Data Retention	Aligned	Disposal (in accordance with Retention Policy)...	anonymized_6.1_IS_Data_Security_Standards.pdf
3.4	Enforce Data Retention	Aligned	1.8 DATA RETENTION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
3.5	Securely Dispose of Data Key Control	Aligned	IT Asset Retirement and Disposal...	anonymized_7.1_IS_Asset_Management_Standard.pdf
3.5	Securely Dispose of Data Key Control	Aligned	V. Bring Your Own Device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
3.5	Securely Dispose of Data Key Control	Aligned	Disposal Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
3.5	Securely Dispose of Data Key Control	Aligned	Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
3.5	Securely Dispose of Data Key Control	Aligned	V. Bring Your Own Device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
3.6	Encrypt Data on End-User Devices	Aligned	Encrypt data on end-user devices containing sensitive data...	anonymized_6.1_IS_Data_Security_Standards.pdf
3.6	Encrypt Data on End-User Devices	Aligned	Devices should be password-protected and encrypted....	anonymized_7.2_IS_End_User_Device_Standard.pdf
3.6	Encrypt Data on End-User Devices	Aligned	Only USB sticks and other removable devices that have been a...	anonymized_7.2_IS_End_User_Device_Standard.pdf
3.6	Encrypt Data on End-User Devices	Aligned	vi. Encryption is to be used to protect the confidentiality ...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	IT Asset (NEW) and other assets Retirement and Disposal...	anonymized_7.1_IS_Asset_Management_Standard.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	1.5 DATA CLASSIFICATION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	Data Security classification policy...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	Definition of Confidentiality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	DOCUMENT CLASSIFICATION...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	Control: 3.7: Establish and maintain an overall data classif...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	Data Classification Policy...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
3.8	Document Data Flows Key Control	Gap	Document data flows. Data flow documentation includes service provider data flows and should be base... Critical Gap - Key Control Missing
3.9	Encrypt Data on Removable Media	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
3.9	Encrypt Data on Removable Media	Aligned	Encryption requirements for PII/NPI data on High-Risk Techno...	anonymized_6.1_IS_Data_Security_Standards.pdf
3.9	Encrypt Data on Removable Media	Aligned	Removable Storage Devices...	anonymized_7.2_IS_End_User_Device_Standard.pdf
3.9	Encrypt Data on Removable Media	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
3.11	Encrypt Sensitive Data at Rest	Aligned	Encrypt sensitive data at rest on servers, applications, and...	anonymized_6.1_IS_Data_Security_Standards.pdf
3.11	Encrypt Sensitive Data at Rest	Aligned	Devices should be password-protected and encrypted....	anonymized_7.2_IS_End_User_Device_Standard.pdf
3.11	Encrypt Sensitive Data at Rest	Aligned	Encryption for remote access sessions...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
3.12	Segment Data Processing and Storage Based on Sensitivity	Aligned	Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
3.13	Deploy a Data Loss Prevention Solution	Aligned	Inventory of Assets...	anonymized_7.0_IS_Asset_Management_Policy.pdf
3.13	Deploy a Data Loss Prevention Solution	Aligned	Implementation of Data Loss Prevention Mechanism...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	1.3 IT Asset (NEW) and other assets Retirement and Disposal...	anonymized_7.1_IS_Asset_Management_Standard.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	V. Bring Your Own Device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	Disposal (in accordance with Retention Policy)...	anonymized_6.1_IS_Data_Security_Standards.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
4.1	Establish and Maintain a Secure Configuration Process Key Control	Aligned	Secure Configuration of Enterprise Assets & Software...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
4.2	Establish and Maintain a Secure Configuration Process for Network Infrastructure	Aligned	1.11 MAINTENANCE...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
4.2	Establish and Maintain a Secure Configuration Process for Network Infrastructure	Aligned	Network Monitoring & Defense...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
4.3	Configure Automatic Session Locking on Enterprise Assets	Gap	Configure automatic session locking on enterprise assets after a defined period of inactivity. For g...
4.4	Implement and Manage a Firewall on Servers	Aligned	Section 6: Personal firewalls software should be installed a...	anonymized_7.2_IS_End_User_Device_Standard.pdf
4.5	Implement and Manage a Firewall on End-User Devices	Aligned	Section 6: Personal Firewalls...	anonymized_7.2_IS_End_User_Device_Standard.pdf
4.6	Securely Manage Enterprise Assets and Software	Gap	Securely manage enterprise assets and software. Example implementations include managing configurati...
4.7	Manage Default Accounts on Enterprise Assets and Software	Aligned	Service Accounts...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
4.9	Configure Trusted DNS Servers on Enterprise Assets	Aligned	System & Communications Protection\| Secure Name/address Reso...	anonymized_6.1_IS_Data_Security_Standards.pdf
4.11	Enforce Remote Wipe Capability on Portable End-User Devices Key Control	Aligned	V. Bring Your Own Device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
4.11	Enforce Remote Wipe Capability on Portable End-User Devices Key Control	Aligned	Disposal (in accordance with Retention Policy)...	anonymized_6.1_IS_Data_Security_Standards.pdf
4.11	Enforce Remote Wipe Capability on Portable End-User Devices Key Control	Aligned	Termination of employees and management of access privileges...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
4.11	Enforce Remote Wipe Capability on Portable End-User Devices Key Control	Aligned	V. Bring Your Own Device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
4.12	Separate Enterprise Workspaces on Mobile End-User Devices	Gap	Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example ...
5.1	Establish and Maintain an Inventory of Accounts Key Control	Aligned	Assets ownership and responsibilities...	anonymized_7.0_IS_Asset_Management_Policy.pdf
5.1	Establish and Maintain an Inventory of Accounts Key Control	Aligned	An Asset Owner should be responsible for: Ensuring that Asse...	anonymized_7.0_IS_Asset_Management_Policy.pdf
5.1	Establish and Maintain an Inventory of Accounts Key Control	Aligned	Service Accounts...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
5.1	Establish and Maintain an Inventory of Accounts Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.8.2.2	Labeling of Information	Aligned	Labeling of Information...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.4.1	Information Access Restriction	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf

328 Total Controls

Control ID	Control Name	Status	Evidence Section	Document
AC-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-1	Policy and Procedures	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	g. Ensure that information access controls are implemented t...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	i. Privileged users should understand their roles and respon...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	Access Control Policy...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	Information Access Controls...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	Ensure that information access controls are implemented...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	The purpose of this policy is to provide requirements contro...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	g. Ensure that information access controls are implemented t...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	g. Ensure that information access controls are implemented t...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	Information Access Controls...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	Access Control Policy...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	1.2.1 Access Control...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	The purpose of this policy is to provide requirements contro...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	Access Control Policy and Procedures...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-1	Policy and Procedures	Aligned	Control: AC-1: Access control policy and procedures...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	Access control policy and procedures...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-1	Policy and Procedures	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AC-1	Policy and Procedures	Aligned	Defining and periodically reviewing access restrictions and ...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AC-1	Policy and Procedures	Aligned	Acceptable Use of Assets...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AC-1	Policy and Procedures	Aligned	Acceptable Use of Assets...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AC-1	Policy and Procedures	Aligned	Assets ownership and responsibilities...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AC-1	Policy and Procedures	Aligned	Access control policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Cloud Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Access Control – Establishes controls to manage access to in...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Cloud Policy - Establishes controls that define the requirem...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	End-user Device Security Policy - Establishes controls that ...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Cloud Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Access Control...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Section 1.6 - EXCEPTION...	anonymized_7.1_IS_Asset_Management_Standard.pdf
AC-1	Policy and Procedures	Aligned	Access Control Policy and Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-1	Policy and Procedures	Aligned	Access control policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Network and Firewall Security Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Cloud Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Cloud Policy - Establishes controls that define the requirem...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	End-user Device Security Policy - Establishes controls that ...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Cloud Policy - Establishes controls that define the requirem...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-1	Policy and Procedures	Aligned	Segregation of duties...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-10	Concurrent Session Control	Gap	Organizations may define the maximum number of concurrent sessions for system accounts globally, by ...
AC-11	Device Lock Key Control	Aligned	User accounts, including privileged user accounts, should be...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-11	Device Lock Key Control	Aligned	Devices should be password-protected and encrypted....	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-11	Device Lock Key Control	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
AC-12	Session Termination	Aligned	Leaving Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-14	Permitted Actions Without Identification or Authentication Key Control	Aligned	Access Control Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-14	Permitted Actions Without Identification or Authentication Key Control	Aligned	Access Control Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Security & Privacy Attributes...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Defining and periodically reviewing access restrictions and ...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-17	Remote Access	Aligned	Access to Networks & Network Services...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-17	Remote Access	Aligned	Monitoring devices are typically employed at the managed int...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-17	Remote Access	Aligned	1.2 SYSTEM USE NOTIFICATION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-17	Remote Access	Aligned	All external connections to Test networks or Information Res...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-17	Remote Access	Aligned	All external connections to Test networks or Information Res...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-17	Remote Access	Aligned	Monitoring devices are typically employed at the managed int...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-17	Remote Access	Aligned	1.10 REMOTE ACCESS TO Test’s SYSTEMS...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-17	Remote Access	Aligned	A.9.4.4 - Access to Networks & Network Services...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-17	Remote Access	Aligned	A.9.4.1 - A.13.2.1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-17	Remote Access	Aligned	Remote access should be configured to use a strong authentic...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-17	Remote Access	Aligned	Encryption of external file transfers and data connections....	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-17	Remote Access	Aligned	1.2 SYSTEM USE NOTIFICATION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-17	Remote Access	Aligned	1.10 REMOTE ACCESS TO Test’s SYSTEMS...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-17	Remote Access	Aligned	End-user Device Security Policy - Establishes controls that ...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-17	Remote Access	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-18	Wireless Access	Aligned	Service Set Identifier (SSID)...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Section 9: Mobile Device Management...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Ensure that the security controls are in place while using m...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	1.14 BRING YOUR OWN DEVICE (BYOD)...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	implementation and operation of information security within ...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Remote access should be configured to use a strong authentic...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	1.2. Hardware, Software, Applications and Data - Inventory o...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Protection and control of mobile devices...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Section 9: Mobile Device Security Responsibilities...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	1.14 BRING YOUR OWN DEVICE (BYOD)...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	implementation and operation of information security within ...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	f) Access privileges of all users, especially those with the...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-2	Account Management Key Control	Aligned	Control: AC-2...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	General User Account...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access is based on an employee/contractor’s role and should ...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	i. Privileged users should understand their roles and respon...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Account Management...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	i. Privileged users should understand their roles and respon...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	User access to networks and network services...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.2.1 Access Control...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access is based on an employee/contractor’s role and should ...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	vi. Authorization process is developed and implemented to en...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Application Security Administrators...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Termination of access privileges...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Leaving Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Account Management Requirements...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-2	Account Management Key Control	Aligned	Account Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Account Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Account Management and User Privileges...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-2	Account Management Key Control	Aligned	Defining and periodically reviewing access restrictions and ...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AC-2	Account Management Key Control	Aligned	Access Control...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-2	Account Management Key Control	Aligned	End-user Device Security Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-2	Account Management Key Control	Aligned	End-user Device Security Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-2	Account Management Key Control	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
AC-2	Account Management Key Control	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-2	Account Management Key Control	Aligned	Account Management Requirements...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-2	Account Management Key Control	Aligned	Access Control...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-2	Account Management Key Control	Aligned	End-user Device Security Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-2	Account Management Key Control	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Account Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-20	Use of External Systems	Aligned	Section 9: Mobile Device Management...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-20	Use of External Systems	Aligned	Access Control \| Use of External Systems...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-20	Use of External Systems	Aligned	Many safeguards for mobile devices are reflected in other co...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-20	Use of External Systems	Aligned	Network services which are not required are formally documen...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-20	Use of External Systems	Aligned	AC-20 addresses mobile devices that are not organization-con...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-20	Use of External Systems	Aligned	Data transmission and external system usage guidelines...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-20	Use of External Systems	Aligned	Section 9: Mobile Device Security Responsibilities...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-21	Information Sharing Key Control	Aligned	Restricted Data...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-21	Information Sharing Key Control	Aligned	Classification of Information...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-21	Information Sharing Key Control	Aligned	1.2.1 Access Control...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-21	Information Sharing Key Control	Aligned	Information Sharing and Data Security Classification Policy...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-21	Information Sharing Key Control	Aligned	Information Transfer Policies & Procedures...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-21	Information Sharing Key Control	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-21	Information Sharing Key Control	Aligned	Information Sharing and Security Classification Policy...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-22	Publicly Accessible Content	Aligned	Public Data and Internal Use Only Data...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-22	Publicly Accessible Content	Aligned	c. Internet Use Restrictions...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-22	Publicly Accessible Content	Aligned	The purpose of this policy is to provide requirements contro...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-22	Publicly Accessible Content	Aligned	Control of proprietary information and sensitive material...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-22	Publicly Accessible Content	Aligned	c. Internet Use Restrictions...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-22	Publicly Accessible Content	Aligned	proprietary information, trade secrets or any other sensitiv...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-22	Publicly Accessible Content	Aligned	4.0 Organization of Information Security Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-23	Data Mining Protection	Aligned	Access Control Policy...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-23	Data Mining Protection	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-24	Access Control Decisions	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-24	Access Control Decisions	Aligned	1.2.1 Access Control...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-24	Access Control Decisions	Aligned	Access Control...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-24	Access Control Decisions	Aligned	Access Control...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-24	Access Control Decisions	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-25	Reference Monitor Key Control	Aligned	Access Control Policy...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-25	Reference Monitor Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-25	Reference Monitor Key Control	Aligned	Overview, Scope & Applicability...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-25	Reference Monitor Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control to Program Source Code...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	d) Authorizing access to Information Assets....	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Controls such as file access limitation, time limit for acce...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	f, g, h...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access to Information Resources should be controlled through...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Enforcement...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	1.2.1 Access Control...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access to Information Resources should be controlled through...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	iv. Control over User access to information services is enfo...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control \| Access Enforcement...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Controls such as file access limitation, time limit for acce...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access privileges of employees should be removed from all sy...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	1.10 REMOTE ACCESS TO Test’s SYSTEMS...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	1.2 GENERAL USER RESPONSIBILITIES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	A.9.4.4 - Access to Networks & Network Services...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Enforcement...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Segregation of duties...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control and User Privileges...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Overview and Scope & Applicability...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	1.1.3 Laptops...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Overview...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-3	Access Enforcement Key Control	Aligned	1.6 EXCEPTION...	anonymized_7.1_IS_Asset_Management_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Enforcing access restrictions for remote access....	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control \| Remote Access, Access Control \| Access Cont...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-3	Access Enforcement Key Control	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	1.10 REMOTE ACCESS TO Test’s SYSTEMS...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	1.2 GENERAL USER RESPONSIBILITIES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Data Custodian...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	c. Internet Use Restrictions...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	A.9.4.1 - A.13.2.1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Access Control Policies...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	c. Internet Use Restrictions...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	General User Account...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	This policy assigns and describes roles and responsibilities...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Separation of Duties...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Segregate conflicting duties and areas of responsibility...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Account Management and Password Protection Requirements...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-5	Separation of Duties Key Control	Aligned	1.3 SEGREGATION OF DUTIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Data Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-5	Separation of Duties Key Control	Aligned	Access Control Policies...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-5	Separation of Duties Key Control	Aligned	Account Management and User Responsibilities...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AC-5	Separation of Duties Key Control	Aligned	1.3 SEGREGATION OF DUTIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Segregation of duties...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-6	Least Privilege	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AC-6	Least Privilege	Aligned	Privileged (Application Administration) Account...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Least Privilege...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Access is based on an employee/contractor’s role and should ...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Least Privilege...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-6	Least Privilege	Aligned	Access Control Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-6	Least Privilege	Aligned	1.1.3 Laptops...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AC-6	Least Privilege	Aligned	Access Control Policies...	anonymized_6.1_IS_Data_Security_Standards.pdf
AC-6	Least Privilege	Aligned	Access Control Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-7	Unsuccessful Logon Attempts	Aligned	Unsuccessful Login Attempts...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-8	System Use Notification	Aligned	1.2 SYSTEM USE NOTIFICATION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-8	System Use Notification	Aligned	This policy assigns and describes roles and responsibilities...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-8	System Use Notification	Aligned	1.2 SYSTEM USE NOTIFICATION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-8	System Use Notification	Aligned	VII. Test adopts the NIST CSF and ISO 27001 standards as the...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AC-9	Previous Logon Notification	Aligned	1.2 SYSTEM USE NOTIFICATION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-9	Previous Logon Notification	Aligned	1.2 SYSTEM USE NOTIFICATION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AT-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AT-1	Policy and Procedures Key Control	Aligned	i. Privileged users should understand their roles and respon...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-1	Policy and Procedures Key Control	Aligned	Privileged User Responsibilities...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-1	Policy and Procedures Key Control	Aligned	Privileged users should understand their roles and responsib...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-1	Policy and Procedures Key Control	Aligned	i. Privileged users should understand their roles and respon...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-1	Policy and Procedures Key Control	Aligned	i. Privileged users should understand their roles and respon...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-1	Policy and Procedures Key Control	Aligned	1.7 INFORMATION SECURITY EDUCATION & TRAINING...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-1	Policy and Procedures Key Control	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-1	Policy and Procedures Key Control	Aligned	Awareness and training policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AT-1	Policy and Procedures Key Control	Aligned	Awareness and training policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AT-2	Literacy Training and Awareness	Aligned	Awareness and Training...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-2	Literacy Training and Awareness	Aligned	1.7 INFORMATION SECURITY EDUCATION & TRAINING...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-2	Literacy Training and Awareness	Aligned	Ensure that there is enough depth of expertise in critical f...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-2	Literacy Training and Awareness	Aligned	INFORMATION SECURITY AWARENESS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-2	Literacy Training and Awareness	Aligned	1.7 INFORMATION SECURITY EDUCATION & TRAINING...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-2	Literacy Training and Awareness	Aligned	Information Security Awareness, Education and Training...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AT-2	Literacy Training and Awareness	Aligned	Information Security Awareness, Education and Training...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness and Training...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Security Awareness & Skills Training...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	1.7 INFORMATION SECURITY EDUCATION & TRAINING...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Security Awareness & Skills Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Personnel Security \| External Personnel Security...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Information Security Awareness, Education and Training...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Information Security Awareness, Education and Training...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Security Awareness & Skills Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Role-based Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-4	Training Records	Gap	Documentation for specialized training may be maintained by individual supervisors at the discretion...
AT-6	Training Feedback	Gap	Training feedback includes awareness training results and role-based training results. Training resu...
AU-1	Policy and Procedures Key Control	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-1	Policy and Procedures Key Control	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AU-1	Policy and Procedures Key Control	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-1	Policy and Procedures Key Control	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AU-1	Policy and Procedures Key Control	Aligned	Ensuring the resolution of information security-related audi...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AU-1	Policy and Procedures Key Control	Aligned	1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
AU-1	Policy and Procedures Key Control	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-10	Non-repudiation	Aligned	Activity...	anonymized_6.1_IS_Data_Security_Standards.pdf
AU-11	Audit Record Retention Key Control	Aligned	1.8 DATA RETENTION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-12	Audit Record Generation	Gap	Audit records can be generated from many different system components. The event types specified in A...
AU-13	Monitoring for Information Disclosure	Aligned	Restricted Data...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Organizations monitor systems by observing audit activities ...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-13	Monitoring for Information Disclosure	Aligned	2.1 Acceptable Use Standard...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-13	Monitoring for Information Disclosure	Aligned	DOCUMENT CLASSIFICATION...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Organizations monitor systems by observing audit activities ...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Discussion on proprietary information and sensitive material...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-13	Monitoring for Information Disclosure	Aligned	DOCUMENT CLASSIFICATION...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AU-13	Monitoring for Information Disclosure	Aligned	7.2 End User Device Standard...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Overview and Scope & Applicability...	anonymized_7.2_IS_End_User_Device_Standard.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Confidentiality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Term Definitions...	anonymized_6.1_IS_Data_Security_Standards.pdf
AU-13	Monitoring for Information Disclosure	Aligned	2.1 Acceptable Use Standard...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Data Security classification policy...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-13	Monitoring for Information Disclosure	Aligned	Definition of Confidentiality and Information Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AU-14	Session Audit Key Control	Aligned	Monitoring of User’s device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-14	Session Audit Key Control	Aligned	b) Retrieve and share information with the authorities in re...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-14	Session Audit Key Control	Aligned	Monitoring of User’s device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-14	Session Audit Key Control	Aligned	b) Retrieve and share information with the authorities in re...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-16	Cross-organizational Audit Logging Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-2	Event Logging Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-2	Event Logging Key Control	Aligned	The reviews can be supported by audit logging controls, such...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AU-2	Event Logging Key Control	Aligned	c) Test should consider various means to ensure that initiat...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AU-2	Event Logging Key Control	Aligned	f) Mitigating or compensating controls should be established...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AU-2	Event Logging Key Control	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
AU-3	Content of Audit Records Key Control	Gap	Audit record content that may be necessary to support the auditing function includes event descripti... Critical Gap - Key Control Missing
AU-4	Audit Log Storage Capacity Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-4	Audit Log Storage Capacity Key Control	Aligned	NIST SP 800-53 Rev 5 AU-4 Audit & Accountability \| Audit Log...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-5	Response to Audit Logging Process Failures Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Access groupings will be developed and tested prior to the i...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Role Responsibility CISO or his/her designee...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-7	Audit Record Reduction and Report Generation Key Control	Gap	Audit record reduction is a process that manipulates collected audit log information and organizes i... Critical Gap - Key Control Missing
AU-8	Time Stamps	Gap	Time stamps generated by the system include date and time. Time is commonly expressed in Coordinated...
AU-9	Protection of Audit Information Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
AU-9	Protection of Audit Information Key Control	Aligned	Section on privileged account holders and log manipulation...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AU-9	Protection of Audit Information Key Control	Aligned	Operations Security – Establishes controls to ensure the sec...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AU-9	Protection of Audit Information Key Control	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
AU-9	Protection of Audit Information Key Control	Aligned	Internet Security & Usage Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CA-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CA-1	Policy and Procedures Key Control	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
CA-1	Policy and Procedures Key Control	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CA-1	Policy and Procedures Key Control	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
CA-1	Policy and Procedures Key Control	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
CA-1	Policy and Procedures Key Control	Aligned	Risk Policy, Cloud Policy, End-user Device Security Policy, ...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CA-1	Policy and Procedures Key Control	Aligned	Section 1.6 - Exceptions to the policy...	anonymized_7.1_IS_Asset_Management_Standard.pdf
CA-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CA-1	Policy and Procedures Key Control	Aligned	Risk Policy, Cloud Policy, End-user Device Security Policy, ...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CA-1	Policy and Procedures Key Control	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CA-2	Control Assessments Key Control	Aligned	Assessment, Authorization, and Monitoring \| Control Assessme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CA-2	Control Assessments Key Control	Aligned	Assessment, Authorization, and Monitoring \| Control Assessme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CA-2	Control Assessments Key Control	Aligned	Assessment, Authorization, and Monitoring \| Control Assessme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CA-3	Information Exchange Key Control	Aligned	External connections to Test networks or Information Resourc...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CA-3	Information Exchange Key Control	Aligned	A.9.4.1 - A.13.2.1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CA-3	Information Exchange Key Control	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
CA-3	Information Exchange Key Control	Aligned	Data transmission should be encrypted....	anonymized_6.1_IS_Data_Security_Standards.pdf
CA-5	Plan of Action and Milestones	Aligned	Account Remediation Project Plans...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CA-6	Authorization Key Control	Aligned	Authorization levels should be defined and documented....	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CA-6	Authorization Key Control	Aligned	Authorization and Record Keeping Procedures...	anonymized_7.2_IS_End_User_Device_Standard.pdf
CA-6	Authorization Key Control	Aligned	Authorization levels should be defined and documented....	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Continuous monitoring at the system level facilitates ongoin...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Network Monitoring & Defense...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Overview and Scope & Applicability...	anonymized_7.2_IS_End_User_Device_Standard.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Assessment, Authorization, and Monitoring \| Continuous Monit...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Assessment, Authorization, and Monitoring \| Continuous Monit...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Assessment, Authorization, and Monitoring \| Continuous Monit...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CA-8	Penetration Testing	Gap	Penetration testing is a specialized type of assessment conducted on systems or individual system co...
CA-9	Internal System Connections Key Control	Aligned	Overview and Scope & Applicability...	anonymized_7.2_IS_End_User_Device_Standard.pdf
CA-9	Internal System Connections Key Control	Aligned	1.2. Hardware, Software, Applications and Data...	anonymized_7.0_IS_Asset_Management_Policy.pdf
CM-1	Policy and Procedures	Aligned	1.11 MAINTENANCE and 1.12 EXCEPTION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management Policy and Procedures...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management Policy and Procedures...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
CM-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
CM-1	Policy and Procedures	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CM-1	Policy and Procedures	Aligned	Chunk: 1.4...	anonymized_7.2_IS_End_User_Device_Standard.pdf
CM-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-1	Policy and Procedures	Aligned	Security and privacy documentation requirements...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-1	Policy and Procedures	Aligned	Section 1.6 - EXCEPTION...	anonymized_7.1_IS_Asset_Management_Standard.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management Policy and Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
CM-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-1	Policy and Procedures	Aligned	The selection of a control baseline is determined by the nee...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-1	Policy and Procedures	Aligned	Documentation provides user and administrator guidance for t...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-10	Software Usage Restrictions	Gap	Software license tracking can be accomplished by manual or automated methods, depending on organizat...
CM-11	User-installed Software	Aligned	Installation of Software on User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CM-11	User-installed Software	Aligned	Installation of Software on User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CM-12	Information Location	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CM-12	Information Location	Aligned	Scope...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
CM-12	Information Location	Aligned	Overview and Scope & Applicability...	anonymized_7.1_IS_Asset_Management_Standard.pdf
CM-12	Information Location	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
CM-12	Information Location	Aligned	Scope...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
CM-13	Data Action Mapping	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CM-13	Data Action Mapping	Aligned	V. Bring Your Own Device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CM-13	Data Action Mapping	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
CM-13	Data Action Mapping	Aligned	V. Bring Your Own Device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CM-14	Signed Components	Aligned	Certificate...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CM-2	Baseline Configuration	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-2	Baseline Configuration	Aligned	Configuration Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-2	Baseline Configuration	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-3	Configuration Change Control Key Control	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-3	Configuration Change Control Key Control	Aligned	Controls can be viewed as descriptions of the safeguards...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-3	Configuration Change Control Key Control	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-3	Configuration Change Control Key Control	Aligned	In some cases, the selection and implementation of a control...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-4	Impact Analyses	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CM-4	Impact Analyses	Aligned	An analysis of the general information security practices ap...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-4	Impact Analyses	Aligned	(b) A gap analysis of general information security practices...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-4	Impact Analyses	Aligned	(c) An open 'Request for Comments' from business units, grou...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-4	Impact Analyses	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	Access groupings will be developed and tested prior to the i...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	Refer to the Access Control Policy for additional details....	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
CM-6	Configuration Settings	Aligned	IV. Maintaining Security while using Organizationally Owned ...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CM-6	Configuration Settings	Aligned	Configuration settings and their impact on security and priv...	anonymized_7.2_IS_End_User_Device_Standard.pdf
CM-6	Configuration Settings	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-6	Configuration Settings	Aligned	IV. Maintaining Security while using Organizationally Owned ...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
CM-6	Configuration Settings	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CM-7	Least Functionality	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-7	Least Functionality	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-8	System Component Inventory Key Control	Aligned	Control: CM-8...	anonymized_7.2_IS_End_User_Device_Standard.pdf
CM-8	System Component Inventory Key Control	Aligned	1.2. Hardware, Software, Applications and Data - Inventory o...	anonymized_7.0_IS_Asset_Management_Policy.pdf
CM-8	System Component Inventory Key Control	Aligned	Asset Management – Establishes controls for asset identifica...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-8	System Component Inventory Key Control	Aligned	Asset Management – Establishes controls for asset identifica...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-8	System Component Inventory Key Control	Aligned	NIST CSF Subcategory Control Reference Control Name...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management Activities...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Least Functionality...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures	Aligned	Contingency Planning Policy and Procedures...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CP-1	Policy and Procedures	Aligned	Contingency planning policy and procedures...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CP-1	Policy and Procedures	Aligned	Contingency Planning Policy and Procedures...	anonymized_7.2_IS_End_User_Device_Standard.pdf
CP-1	Policy and Procedures	Aligned	Divisions & Functions Policy Implementation...	anonymized_7.0_IS_Asset_Management_Policy.pdf
CP-1	Policy and Procedures	Aligned	Contingency planning policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures	Aligned	Contingency Planning Policy and Procedures...	anonymized_7.1_IS_Asset_Management_Standard.pdf
CP-1	Policy and Procedures	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
CP-1	Policy and Procedures	Aligned	Contingency planning policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures	Aligned	Contingency planning policy and procedures...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CP-10	System Recovery and Reconstitution	Gap	Recovery is executing contingency plan activities to restore organizational mission and business fun...
CP-11	Alternate Communications Protocols	Gap	Contingency plans and the contingency training or testing associated with those plans incorporate an...
CP-12	Safe Mode	Gap	For systems that support critical mission and business functionsâ€šÃ„Ã®including military operations...
CP-13	Alternative Security Mechanisms	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-13	Alternative Security Mechanisms	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-2	Contingency Plan	Aligned	Contingency Planning \| Contingency Plan...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CP-2	Contingency Plan	Aligned	CP-2 Contingency Planning \| Contingency Plan...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CP-2	Contingency Plan	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
CP-2	Contingency Plan	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-2	Contingency Plan	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-2	Contingency Plan	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-2	Contingency Plan	Aligned	Contingency planning policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-3	Contingency Training Key Control	Aligned	Contingency training provided by organizations...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CP-3	Contingency Training Key Control	Aligned	Contingency planning policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
CP-4	Contingency Plan Testing	Gap	Methods for testing contingency plans to determine the effectiveness of the plans and identify poten...
CP-6	Alternate Storage Site Key Control	Gap	Alternate storage sites are geographically distinct from primary storage sites and maintain duplicat... Critical Gap - Key Control Missing
CP-7	Alternate Processing Site Key Control	Gap	Alternate processing sites are geographically distinct from primary processing sites and provide pro... Critical Gap - Key Control Missing
CP-8	Telecommunications Services Key Control	Gap	Telecommunications services (for data and voice) for primary and alternate processing and storage si... Critical Gap - Key Control Missing
CP-9	System Backup Key Control	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
CP-9	System Backup Key Control	Aligned	Devices should be password-protected and encrypted....	anonymized_7.2_IS_End_User_Device_Standard.pdf
CP-9	System Backup Key Control	Aligned	1.2.1 Backup and 1.2.2 Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
CP-9	System Backup Key Control	Aligned	Encryption of PII/NPI data element under regulatory, legal o...	anonymized_6.1_IS_Data_Security_Standards.pdf
IA-1	Policy and Procedures Key Control	Aligned	Identification and authentication policy and procedures...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-1	Policy and Procedures Key Control	Aligned	Chunk: 1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
IA-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-1	Policy and Procedures Key Control	Aligned	Identification and authentication policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IA-10	Adaptive Authentication	Aligned	Section 7, Sub-section j, k, l...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-10	Adaptive Authentication	Aligned	Identification & Authentication \| Adaptive Authentication...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-10	Adaptive Authentication	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-10	Adaptive Authentication	Aligned	Section 7: Password Management and Authentication...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-11	Re-authentication Key Control	Aligned	Section 7, Sub-section j...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-11	Re-authentication Key Control	Aligned	Identification & Authentication \| Re-Authentication...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-11	Re-authentication Key Control	Aligned	Identification & Authentication \| Adaptive Authentication...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-11	Re-authentication Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-11	Re-authentication Key Control	Aligned	1.1.3 Laptops...	anonymized_7.2_IS_End_User_Device_Standard.pdf
IA-11	Re-authentication Key Control	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
IA-11	Re-authentication Key Control	Aligned	Section 7, Sub-section j...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-12	Identity Proofing Key Control	Aligned	Identification & Authentication \| Identity Proofing...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-12	Identity Proofing Key Control	Aligned	Identification & Authentication \| Identity Proofing...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-12	Identity Proofing Key Control	Aligned	Identification & Authentication \| Re-Authentication...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-12	Identity Proofing Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-12	Identity Proofing Key Control	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	1.6 DATA HANDLING...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Password Requirements and Multi-Factor Authentication...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	User access to networks and network services...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	1.10 REMOTE ACCESS TO Test’s SYSTEMS and 1.11 USER ID & PASS...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Identification and Authentication Requirements...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Access Control \| Remote Access...	anonymized_6.1_IS_Data_Security_Standards.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Identification and Authentication Requirements...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	1.10 REMOTE ACCESS TO Test’s SYSTEMS and 1.11 USER ID & PASS...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	Service Set Identifier (SSID)...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	Identifier (SSID)...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	9. Equipment and media containing confidential information s...	anonymized_7.2_IS_End_User_Device_Standard.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
IA-4	Identifier Management Key Control	Aligned	Service Set Identifier (SSID)...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
IA-4	Identifier Management Key Control	Aligned	Term Definitions related to User Accounts and Privileged Acc...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-4	Identifier Management Key Control	Aligned	Management of identifiers upon termination...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-4	Identifier Management Key Control	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
IA-5	Authenticator Management	Aligned	Section 7, Sub-section l...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-5	Authenticator Management	Aligned	Section 7.j, 7.k, 7.l...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-5	Authenticator Management	Aligned	Identification & Authentication \| Adaptive Authentication...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-5	Authenticator Management	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-5	Authenticator Management	Aligned	Account Management and Password Protection Requirements...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IA-5	Authenticator Management	Aligned	1.1.3 Laptops...	anonymized_7.2_IS_End_User_Device_Standard.pdf
IA-5	Authenticator Management	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
IA-5	Authenticator Management	Aligned	Section 7, Sub-section l...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-5	Authenticator Management	Aligned	Section 7 - Password Management and Multi-Factor Authenticat...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-5	Authenticator Management	Aligned	Account Management and Password Protection...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IA-6	Authentication Feedback	Gap	Authentication feedback from systems does not provide information that would allow unauthorized indi...
IA-7	Cryptographic Module Authentication Key Control	Aligned	Section 7, Sub-section j, k, l...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	For Test’s implementation authentication, factors one throug...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	Section 7, Sub-section j, k, l...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Identification and Authentication of Non-Organizational User...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Requirements for User Account Management...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Identification and Authentication Requirements for Non-Organ...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Password Requirements and Multi-Factor Authentication...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	User Responsibilities and Password Protection...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IA-9	Service Identification and Authentication Key Control	Aligned	Identification & Authentication \| Adaptive Authentication...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IR-1	Policy and Procedures	Aligned	Detailed explanation of why the exception is necessary....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IR-1	Policy and Procedures	Aligned	Incident Response Policy and Procedures...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IR-1	Policy and Procedures	Aligned	Detailed explanation of why the exception is necessary....	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IR-1	Policy and Procedures	Aligned	Incident Response Policy and Procedures...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-1	Policy and Procedures	Aligned	Incident Response Policy and Procedures...	anonymized_7.2_IS_End_User_Device_Standard.pdf
IR-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Incident Response Policy and Procedures...	anonymized_7.1_IS_Asset_Management_Standard.pdf
IR-1	Policy and Procedures	Aligned	Incident Response Policy and Procedures...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
IR-1	Policy and Procedures	Aligned	Detailed explanation of why the exception is necessary....	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Incident Response Policy and Procedures...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-2	Incident Response Training	Aligned	Incident Response \| Incident Response Training...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IR-2	Incident Response Training	Aligned	Incident Response \| Incident Response Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-2	Incident Response Training	Aligned	Incident response training is associated with the assigned r...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-2	Incident Response Training	Aligned	Incident response training is associated with the assigned r...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-2	Incident Response Training	Aligned	Incident Response...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-2	Incident Response Training	Aligned	Incident Response Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-3	Incident Response Testing	Aligned	Events that may precipitate an update to incident response t...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-3	Incident Response Testing	Aligned	Evaluation of Policies...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-3	Incident Response Testing	Aligned	Events that may precipitate an update to incident response t...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-4	Incident Handling	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IR-4	Incident Handling	Aligned	Role Responsibility CISO or his/her designee...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IR-4	Incident Handling	Aligned	1.4 CONTACT WITH AUTHORITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-4	Incident Handling	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-4	Incident Handling	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IR-4	Incident Handling	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
IR-4	Incident Handling	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-4	Incident Handling	Aligned	1.4 CONTACT WITH AUTHORITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-4	Incident Handling	Aligned	Incident Response Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-5	Incident Monitoring	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
IR-5	Incident Monitoring	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-5	Incident Monitoring	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-5	Incident Monitoring	Aligned	Incident Response Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-6	Incident Reporting	Aligned	1.4 CONTACT WITH AUTHORITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-6	Incident Reporting	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-6	Incident Reporting	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-6	Incident Reporting	Aligned	1.4 CONTACT WITH AUTHORITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-7	Incident Response Assistance	Gap	Incident response support resources provided by organizations include help desks, assistance groups,...
IR-8	Incident Response Plan	Aligned	Incident response training includes user training in identif...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-8	Incident Response Plan	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-8	Incident Response Plan	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-8	Incident Response Plan	Aligned	Incident response training includes user training in identif...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-9	Information Spillage Response	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
IR-9	Information Spillage Response	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
MA-1	Policy and Procedures	Aligned	1.11 MAINTENANCE and 1.12 EXCEPTION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
MA-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MA-1	Policy and Procedures	Aligned	1.0 PURPOSE...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
MA-1	Policy and Procedures	Aligned	Detailed explanation of why the exception is necessary and D...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
MA-1	Policy and Procedures	Aligned	Maintenance policy and procedures address the controls in th...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
MA-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
MA-1	Policy and Procedures	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MA-1	Policy and Procedures	Aligned	Chunk: 1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
MA-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MA-1	Policy and Procedures	Aligned	Detailed explanation of why the exception is necessary and D...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
MA-1	Policy and Procedures	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MA-1	Policy and Procedures	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
MA-2	Controlled Maintenance Key Control	Aligned	1.3 IT Asset (NEW) and other assets Retirement and Disposal...	anonymized_7.1_IS_Asset_Management_Standard.pdf
MA-3	Maintenance Tools	Aligned	1.6 MAINTENANCE...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
MA-4	Nonlocal Maintenance	Aligned	1.6 DATA HANDLING...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
MA-4	Nonlocal Maintenance	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
MA-5	Maintenance Personnel Key Control	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
MA-5	Maintenance Personnel Key Control	Aligned	Control: MA-5: Maintenance personnel refers to individuals w...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
MA-5	Maintenance Personnel Key Control	Aligned	Leaving Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
MA-5	Maintenance Personnel Key Control	Aligned	Personnel Security \| External Personnel Security...	anonymized_7.0_IS_Asset_Management_Policy.pdf
MA-5	Maintenance Personnel Key Control	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MA-5	Maintenance Personnel Key Control	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MA-6	Timely Maintenance Key Control	Gap	Organizations specify the system components that result in increased risk to organizational operatio... Critical Gap - Key Control Missing
MA-7	Field Maintenance	Gap	Field maintenance is the type of maintenance conducted on a system or system component after the sys...
MP-1	Policy and Procedures	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
MP-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-1	Policy and Procedures	Aligned	Media protection policy and procedures...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
MP-1	Policy and Procedures	Aligned	Chunk: 1.12...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
MP-1	Policy and Procedures	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-1	Policy and Procedures	Aligned	Acceptable Use of Assets...	anonymized_7.0_IS_Asset_Management_Policy.pdf
MP-1	Policy and Procedures	Aligned	Media protection policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MP-1	Policy and Procedures	Aligned	Chunk: 1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
MP-1	Policy and Procedures	Aligned	Media Protection \| Media Marking, Media Storage, Media Trans...	anonymized_6.1_IS_Data_Security_Standards.pdf
MP-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-1	Policy and Procedures	Aligned	Media protection policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MP-2	Media Access	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-2	Media Access	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
MP-2	Media Access	Aligned	Media Protection \| Media Access...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-2	Media Access	Aligned	Media Protection \| Media Marking, Media Protection \| Media S...	anonymized_6.1_IS_Data_Security_Standards.pdf
MP-2	Media Access	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-2	Media Access	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
MP-3	Media Marking	Aligned	Media Protection \| Media Marking...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-3	Media Marking	Aligned	Media Protection \| Media Marking...	anonymized_6.1_IS_Data_Security_Standards.pdf
MP-4	Media Storage	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-4	Media Storage	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
MP-4	Media Storage	Aligned	Media Protection \| Media Storage...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-4	Media Storage	Aligned	Asset Management and Physical and Environmental Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MP-4	Media Storage	Aligned	Media Protection \| Media Storage...	anonymized_6.1_IS_Data_Security_Standards.pdf
MP-4	Media Storage	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-4	Media Storage	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
MP-4	Media Storage	Aligned	Physical and Environmental Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MP-5	Media Transport Key Control	Aligned	Disposal of Media, Physical Media Transfer...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
MP-5	Media Transport Key Control	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-5	Media Transport Key Control	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
MP-5	Media Transport Key Control	Aligned	Only USB sticks and other removable devices that have been a...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-5	Media Transport Key Control	Aligned	Media Protection \| Media Transport...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-5	Media Transport Key Control	Aligned	Asset Management – Establishes controls for asset identifica...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MP-5	Media Transport Key Control	Aligned	Backup Media...	anonymized_6.1_IS_Data_Security_Standards.pdf
MP-5	Media Transport Key Control	Aligned	Disposal (in accordance with Retention Policy) and procedure...	anonymized_6.1_IS_Data_Security_Standards.pdf
MP-5	Media Transport Key Control	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-5	Media Transport Key Control	Aligned	Asset Management and Cryptography...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
MP-6	Media Sanitization	Aligned	Media Protection \| Media Sanitization...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
MP-6	Media Sanitization	Aligned	Secure Disposal or Re-Use of Equipment...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
MP-6	Media Sanitization	Aligned	Disposal of Media...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
MP-6	Media Sanitization	Aligned	Leaving Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
MP-6	Media Sanitization	Aligned	Media Protection \| Media Sanitization...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-6	Media Sanitization	Aligned	Media Protection \| Media Sanitization...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-6	Media Sanitization	Aligned	1.2.2 Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
MP-6	Media Sanitization	Aligned	1.3 IT Asset (NEW) and other assets Retirement and Disposal...	anonymized_7.1_IS_Asset_Management_Standard.pdf
MP-6	Media Sanitization	Aligned	Disposal (in accordance with Retention Policy)...	anonymized_6.1_IS_Data_Security_Standards.pdf
MP-7	Media Use Key Control	Aligned	Disposal of Media, Physical Media Transfer, Removable Assets...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
MP-7	Media Use Key Control	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-7	Media Use Key Control	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
MP-7	Media Use Key Control	Aligned	Media Protection \| Media Use...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-7	Media Use Key Control	Aligned	Media Protection for High-Risk Technology Assets...	anonymized_6.1_IS_Data_Security_Standards.pdf
MP-7	Media Use Key Control	Aligned	1.3 RULES OF BEHAVIOR (ROB) - Acceptable Use...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MP-7	Media Use Key Control	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
MP-8	Media Downgrading	Aligned	Media Protection \| Media Downgrading...	anonymized_7.2_IS_End_User_Device_Standard.pdf
MP-8	Media Downgrading	Aligned	1.2.2 Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
MP-8	Media Downgrading	Aligned	Media Protection \| Media Downgrading...	anonymized_6.1_IS_Data_Security_Standards.pdf
PE-1	Policy and Procedures	Aligned	1.11 MAINTENANCE and 1.12 EXCEPTION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PE-1	Policy and Procedures	Aligned	h. Should ensure that physical access to assets is managed a...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	Physical Access Management...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	Ensure that physical access to assets is managed and protect...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	h. Should ensure that physical access to assets is managed a...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	h. Should ensure that physical access to assets is managed a...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	Physical Access Management...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	h. Should ensure that physical access to assets is managed a...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	h. Should ensure that physical access to assets is managed a...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	h. Should ensure that physical access to assets is managed a...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	1.12 EXCEPTION...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PE-1	Policy and Procedures	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PE-1	Policy and Procedures	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PE-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PE-1	Policy and Procedures	Aligned	Physical and environmental protection policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-1	Policy and Procedures	Aligned	1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
PE-1	Policy and Procedures	Aligned	Policy Exception Process...	anonymized_6.1_IS_Data_Security_Standards.pdf
PE-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PE-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PE-1	Policy and Procedures	Aligned	Physical and environmental protection policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-1	Policy and Procedures	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PE-10	Emergency Shutoff	Gap	Emergency power shutoff primarily applies to organizational facilities that contain concentrations o...
PE-11	Emergency Power	Gap	An uninterruptible power supply (UPS) is an electrical system or mechanism that provides emergency p...
PE-12	Emergency Lighting	Gap	The provision of emergency lighting applies primarily to organizational facilities that contain conc...
PE-13	Fire Protection	Gap	The provision of fire detection and suppression systems applies primarily to organizational faciliti...
PE-14	Environmental Controls	Aligned	Physical and Environmental Security Policy...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-14	Environmental Controls	Aligned	Physical & Environmental Protection...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PE-15	Water Damage Protection	Gap	The provision of water damage protection primarily applies to organizational facilities that contain...
PE-16	Delivery and Removal Key Control	Aligned	User access to networks and network services...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-16	Delivery and Removal Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PE-16	Delivery and Removal Key Control	Aligned	Physical and Environmental Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-16	Delivery and Removal Key Control	Aligned	Physical and Environmental Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-16	Delivery and Removal Key Control	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PE-17	Alternate Work Site Key Control	Gap	Alternate work sites include government facilities or the private residences of employees. While dis... Critical Gap - Key Control Missing
PE-18	Location of System Components Key Control	Gap	Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terror... Critical Gap - Key Control Missing
PE-19	Information Leakage	Aligned	Confidential Data...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	while PE-2 addresses physical access for individuals whose m...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	Leaving Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	Personnel Security \| External Personnel Security...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	Physical and Environmental Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	Physical and Environmental Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-20	Asset Monitoring and Tracking Key Control	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-21	Electromagnetic Pulse Protection	Gap	An electromagnetic pulse (EMP) is a short burst of electromagnetic energy that is spread over a rang...
PE-22	Component Marking Key Control	Aligned	Scope and Applicability...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PE-22	Component Marking Key Control	Aligned	1.14 BRING YOUR OWN DEVICE (BYOD)...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PE-22	Component Marking Key Control	Aligned	Overview...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PE-22	Component Marking Key Control	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
PE-23	Facility Location	Gap	Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terror...
PE-3	Physical Access Control Key Control	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-3	Physical Access Control Key Control	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PE-3	Physical Access Control Key Control	Aligned	Physical and Environmental Security – Establishes controls t...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-3	Physical Access Control Key Control	Aligned	Physical and Environmental Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-3	Physical Access Control Key Control	Aligned	Physical and Environmental Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PE-4	Access Control for Transmission	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PE-5	Access Control for Output Devices Key Control	Gap	Controlling physical access to output devices includes placing output devices in locked rooms or oth... Critical Gap - Key Control Missing
PE-6	Monitoring Physical Access Key Control	Aligned	Physical access monitoring includes publicly accessible area...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-6	Monitoring Physical Access Key Control	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PE-8	Visitor Access Records	Gap	Visitor access records include the names and organizations of individuals visiting, visitor signatur...
PE-9	Power Equipment and Cabling	Gap	Organizations determine the types of protection necessary for the power equipment and cabling employ...
PL-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PL-1	Policy and Procedures	Aligned	Chunk: 1.12...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PL-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PL-1	Policy and Procedures	Aligned	Policy Statement of intent that is implemented as a procedur...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PL-1	Policy and Procedures	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PL-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PL-1	Policy and Procedures	Aligned	Risk Policy, Cloud Policy, End-user Device Security Policy, ...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	1.6 EXCEPTION...	anonymized_7.1_IS_Asset_Management_Standard.pdf
PL-1	Policy and Procedures	Aligned	Policy exception process and requirements...	anonymized_6.1_IS_Data_Security_Standards.pdf
PL-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PL-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PL-1	Policy and Procedures	Aligned	Risk Policy, Cloud Policy, End-user Device Security Policy, ...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-10	Baseline Selection	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PL-10	Baseline Selection	Aligned	Control Baselines...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-10	Baseline Selection	Aligned	Control baselines are predefined sets of controls specifical...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-11	Baseline Tailoring	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PL-11	Baseline Tailoring	Aligned	Control: PL-11...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-11	Baseline Tailoring	Aligned	Tailoring Actions and Control Baselines...	anonymized_6.1_IS_Data_Security_Standards.pdf
PL-11	Baseline Tailoring	Aligned	Control: PL-11...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-11	Baseline Tailoring	Aligned	Tailoring Controls...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PL-2	System Security and Privacy Plans	Gap	System security and privacy plans are scoped to the system and system components within the defined ...
PL-4	Rules of Behavior Key Control	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PL-4	Rules of Behavior Key Control	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PL-4	Rules of Behavior Key Control	Aligned	Rules of Behavior...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PL-4	Rules of Behavior Key Control	Aligned	VII. Test adopts the NIST CSF and ISO 27001 standards as the...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-4	Rules of Behavior Key Control	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
PL-4	Rules of Behavior Key Control	Aligned	Rules of behavior for organizational users...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PL-4	Rules of Behavior Key Control	Aligned	VII. Test adopts the NIST CSF and ISO 27001 standards as the...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-7	Concept of Operations	Gap	The CONOPS may be included in the security or privacy plans for the system or in other system develo...
PL-8	Security and Privacy Architectures	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PL-9	Central Management Key Control	Aligned	Control: PL-9: Central management refers to organization-wid...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PL-9	Central Management Key Control	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PM-1	Information Security Program Plan	Aligned	Program Management \| Information Security Program Plan...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-1	Information Security Program Plan	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PM-1	Information Security Program Plan	Aligned	Security and privacy programs collaborate on the development...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-1	Information Security Program Plan	Aligned	Security and privacy program policies and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-1	Information Security Program Plan	Aligned	Program Management \| Information Security Program Plan...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-10	Authorization Process Key Control	Aligned	Role Responsibility Information Technology...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PM-10	Authorization Process Key Control	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-10	Authorization Process Key Control	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	1.0 PURPOSE...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Protection needs are technology-independent capabilities tha...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Control: PM-11...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Control: PM-11...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-12	Insider Threat Program	Aligned	Program Management \| Information Security Program Leadership...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-12	Insider Threat Program	Aligned	Program Management \| Information Security Program Leadership...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-13	Security and Privacy Workforce	Aligned	Program Management \| Security & Privacy Workforce...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PM-13	Security and Privacy Workforce	Aligned	Program Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-13	Security and Privacy Workforce	Aligned	Program Management \| Security Awareness & Skills Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-13	Security and Privacy Workforce	Aligned	Program Management \| Security & Privacy Workforce...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-13	Security and Privacy Workforce	Aligned	Information Security Awareness, Education and Training...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-13	Security and Privacy Workforce	Aligned	Information Security Awareness, Education and Training...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-13	Security and Privacy Workforce	Aligned	Program Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-13	Security and Privacy Workforce	Aligned	Program Management \| Security & Privacy Workforce...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-14	Testing, Training, and Monitoring	Aligned	System & Communications Protection \| Security Awareness & Sk...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PM-14	Testing, Training, and Monitoring	Aligned	1.7 INFORMATION SECURITY EDUCATION & TRAINING...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-14	Testing, Training, and Monitoring	Aligned	1.2 GENERAL USER RESPONSIBILITIES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PM-14	Testing, Training, and Monitoring	Aligned	Overview and Scope & Applicability...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PM-14	Testing, Training, and Monitoring	Aligned	1.3 MANAGEMENT DIRECTION FOR INFORMATION SECURITY...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-14	Testing, Training, and Monitoring	Aligned	1.2 GENERAL USER RESPONSIBILITIES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PM-15	Security and Privacy Groups and Associations	Aligned	Role Responsibility...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-15	Security and Privacy Groups and Associations	Aligned	1.4 CONTACT WITH AUTHORITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-16	Threat Awareness Program	Gap	Because of the constantly changing and increasing sophistication of adversaries, especially the adva...
PM-17	Protecting Controlled Unclassified Information on External Systems	Aligned	1.0 PURPOSE...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PM-17	Protecting Controlled Unclassified Information on External Systems	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
PM-18	Privacy Program Plan	Gap	A privacy program plan is a formal document that provides an overview of an organizationâ€šÃ„Ã´s pri...
PM-19	Privacy Program Leadership Role	Gap	The privacy officer is an organizational official. For federal agenciesâ€šÃ„Ã®as defined by applicab...
PM-2	Information Security Program Leadership Role	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PM-2	Information Security Program Leadership Role	Aligned	Program Management \| Information Security Program Leadership...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-2	Information Security Program Leadership Role	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PM-2	Information Security Program Leadership Role	Aligned	Program Management \| Information Security Program Leadership...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-20	Dissemination of Privacy Program Information	Gap	For federal agencies, the webpage is located at www.[agency].gov/privacy. Federal agencies include p...
PM-21	Accounting of Disclosures Key Control	Gap	The purpose of accounting of disclosures is to allow individuals to learn to whom their personally i... Critical Gap - Key Control Missing
PM-22	Personally Identifiable Information Quality Management	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
PM-23	Data Governance Body Key Control	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PM-23	Data Governance Body Key Control	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
PM-24	Data Integrity Board	Gap	A Data Integrity Board is the board of senior officials designated by the head of a federal agency a...
PM-25	Minimization of Personally Identifiable Information Used in Testing, Training, and Research	Aligned	Confidential Data...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PM-25	Minimization of Personally Identifiable Information Used in Testing, Training, and Research	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
PM-26	Complaint Management	Gap	Complaints, concerns, and questions from individuals can serve as valuable sources of input to organ...
PM-27	Privacy Reporting	Aligned	1.4 CONTACT WITH AUTHORITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-28	Risk Framing	Gap	Risk framing is most effective when conducted at the organization level and in consultation with sta...
PM-29	Risk Management Program Leadership Roles	Aligned	Role Responsibility...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-29	Risk Management Program Leadership Roles	Aligned	Role Responsibility...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-3	Information Security and Privacy Resources	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-3	Information Security and Privacy Resources	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-30	Supply Chain Risk Management Strategy	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-30	Supply Chain Risk Management Strategy	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-31	Continuous Monitoring Strategy	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-31	Continuous Monitoring Strategy	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PM-32	Purposing	Aligned	1.0 PURPOSE...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PM-32	Purposing	Aligned	1.0 PURPOSE...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PM-4	Plan of Action and Milestones Process	Gap	The plan of action and milestones is a key organizational document and is subject to reporting requi...
PM-5	System Inventory	Aligned	1.2. Hardware, Software, Applications and Data Inventory of ...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PM-5	System Inventory	Aligned	NIST CSF Subcategory Control Reference Control Name...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-6	Measures of Performance	Gap	Measures of performance are outcome-based metrics used by an organization to measure the effectivene...
PM-7	Enterprise Architecture	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-7	Enterprise Architecture	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-8	Critical Infrastructure Plan	Gap	Protection strategies are based on the prioritization of critical assets and resources. The requirem...
PM-9	Risk Management Strategy	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-9	Risk Management Strategy	Aligned	Risk Policy - Establishes controls to ensure identification,...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-9	Risk Management Strategy	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-9	Risk Management Strategy	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-9	Risk Management Strategy	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PM-9	Risk Management Strategy	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PS-1	Policy and Procedures Key Control	Aligned	Personnel Security...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-1	Policy and Procedures Key Control	Aligned	Chunk: 1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
PS-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	anonymized_6.1_IS_Data_Security_Standards.pdf
PS-1	Policy and Procedures Key Control	Aligned	Role Responsibility Information Technology Department and CI...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PS-1	Policy and Procedures Key Control	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-2	Position Risk Designation Key Control	Aligned	Control: PS-2: Position risk designations reflect Office of ...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-2	Position Risk Designation Key Control	Aligned	Personnel Security \| Position Descriptions...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-2	Position Risk Designation Key Control	Aligned	Personnel Security \| Position Descriptions...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-2	Position Risk Designation Key Control	Aligned	1.0 Scope & Applicability...	anonymized_6.1_IS_Data_Security_Standards.pdf
PS-2	Position Risk Designation Key Control	Aligned	Personnel Security \| Position Descriptions...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-3	Personnel Screening Key Control	Aligned	1.2 SCOPE & APPLICABILITY...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-3	Personnel Screening Key Control	Aligned	1.3 BACKGROUND CHECKS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-3	Personnel Screening Key Control	Aligned	1.2 SCOPE & APPLICABILITY...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-3	Personnel Screening Key Control	Aligned	Personnel Security...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-4	Personnel Termination Key Control	Aligned	User accounts management upon employment status changes...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-4	Personnel Termination Key Control	Aligned	User account locking and deletion upon termination...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-4	Personnel Termination Key Control	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-4	Personnel Termination Key Control	Aligned	Return of Assets...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-4	Personnel Termination Key Control	Aligned	1.5 ENFORCEMENT/COMPLIANCE...	anonymized_7.1_IS_Asset_Management_Standard.pdf
PS-5	Personnel Transfer	Aligned	User accounts, including privileged user accounts, entitleme...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-5	Personnel Transfer	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-6	Access Agreements	Aligned	Segregation of duties...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-7	External Personnel Security Key Control	Aligned	Coordination and oversight of third-party relationships...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-7	External Personnel Security Key Control	Aligned	Personnel Security...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-7	External Personnel Security Key Control	Aligned	Personnel Security \| External Personnel Security...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-7	External Personnel Security Key Control	Aligned	Coordination and oversight of third-party relationships...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-8	Personnel Sanctions	Aligned	1.10 ENFORCEMENT...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PS-8	Personnel Sanctions	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PS-8	Personnel Sanctions	Aligned	1.8 DISCIPLINARY PROCESS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-8	Personnel Sanctions	Aligned	ENFORCEMENT/COMPLIANCE...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PS-8	Personnel Sanctions	Aligned	Personnel Security...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-8	Personnel Sanctions	Aligned	1.4 ENFORCEMENT/COMPLIANCE...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-8	Personnel Sanctions	Aligned	Personnel Security \| Personnel Sanctions...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-8	Personnel Sanctions	Aligned	Section XI and XII regarding disciplinary actions and except...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PS-8	Personnel Sanctions	Aligned	ENFORCEMENT/COMPLIANCE...	anonymized_7.1_IS_Asset_Management_Standard.pdf
PS-8	Personnel Sanctions	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	anonymized_6.1_IS_Data_Security_Standards.pdf
PS-8	Personnel Sanctions	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PS-8	Personnel Sanctions	Aligned	Disciplinary Actions and Exceptions...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PS-9	Position Descriptions Key Control	Aligned	Role Responsibility...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-9	Position Descriptions Key Control	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PS-9	Position Descriptions Key Control	Aligned	Personnel Security \| Position Descriptions...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-9	Position Descriptions Key Control	Aligned	Personnel Security...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-9	Position Descriptions Key Control	Aligned	Personnel Security \| Position Descriptions...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-9	Position Descriptions Key Control	Aligned	Personnel Security \| Position Descriptions...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PS-9	Position Descriptions Key Control	Aligned	Information Security Roles & Responsibilities...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PS-9	Position Descriptions Key Control	Aligned	Role Responsibility Information Technology Department...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PS-9	Position Descriptions Key Control	Aligned	Information Security Roles & Responsibilities...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PS-9	Position Descriptions Key Control	Aligned	Personnel Security \| Position Descriptions...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PT-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PT-1	Policy and Procedures	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PT-1	Policy and Procedures	Aligned	1.0 PURPOSE...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
PT-1	Policy and Procedures	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PT-1	Policy and Procedures	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
PT-1	Policy and Procedures	Aligned	Acceptable Use of Assets...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PT-1	Policy and Procedures	Aligned	1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
PT-1	Policy and Procedures	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
PT-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
PT-1	Policy and Procedures	Aligned	Control: PT-1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PT-2	Authority to Process Personally Identifiable Information Key Control	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PT-2	Authority to Process Personally Identifiable Information Key Control	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
PT-3	Personally Identifiable Information Processing Purposes Key Control	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
PT-4	Consent	Aligned	1.2 GENERAL USER RESPONSIBILITIES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PT-4	Consent	Aligned	1.2 GENERAL USER RESPONSIBILITIES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
PT-5	Privacy Notice	Gap	Privacy notices help inform individuals about how their personally identifiable information is being...
PT-6	System of Records Notice	Gap	The PRIVACT requires that federal agencies publish a system of records notice in the Federal Registe...
PT-7	Specific Categories of Personally Identifiable Information Key Control	Aligned	Restricted Data...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
PT-7	Specific Categories of Personally Identifiable Information Key Control	Aligned	Term Definitions...	anonymized_6.1_IS_Data_Security_Standards.pdf
PT-8	Computer Matching Requirements	Gap	The PRIVACT establishes requirements for federal and non-federal agencies if they engage in a matchi...
RA-1	Policy and Procedures	Aligned	1.1 SCOPE & APPLICABILITY...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
RA-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-1	Policy and Procedures	Aligned	Risk Assessment Policy and Procedures...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
RA-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-1	Policy and Procedures	Aligned	Risk assessment policy and procedures...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-1	Policy and Procedures	Aligned	Chunk: 1.4...	anonymized_7.2_IS_End_User_Device_Standard.pdf
RA-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
RA-1	Policy and Procedures	Aligned	Risk Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures	Aligned	Risk Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures	Aligned	Risk Policy - Establishes controls to ensure identification,...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures	Aligned	Risk Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures	Aligned	Chunk: 1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
RA-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-1	Policy and Procedures	Aligned	Risk Policy - Establishes controls to ensure identification,...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures	Aligned	Risk Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures	Aligned	Risk Policy - Establishes controls to ensure identification,...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures	Aligned	Risk Policy - Establishes controls to ensure identification,...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-1	Policy and Procedures	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-10	Threat Hunting	Aligned	Threat hunting is an active means of cyber defense...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
RA-10	Threat Hunting	Aligned	Threat Hunting...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	1.0 PURPOSE...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
RA-2	Security Categorization	Aligned	Classification of Information...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-2	Security Categorization	Aligned	Security categorization of information and systems guides th...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-2	Security Categorization	Aligned	Such analysis is conducted as part of security categorizatio...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-2	Security Categorization	Aligned	Security categorization processes facilitate the development...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Security Categorization...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Risk assessments can also be conducted at various steps in t...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Such analysis is conducted as part of security categorizatio...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Risk Categorization...	anonymized_7.0_IS_Asset_Management_Policy.pdf
RA-2	Security Categorization	Aligned	VII. Test adopts the NIST CSF and ISO 27001 standards as the...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-2	Security Categorization	Aligned	Classification of Information...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-2	Security Categorization	Aligned	Risk Assessment \| Security Categorization...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-2	Security Categorization	Aligned	Security Categorization...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-2	Security Categorization	Aligned	Security categorization process as an organization-wide acti...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Security Categorization...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Organizations can conduct risk assessments at all three leve...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Such analysis is conducted as part of security categorizatio...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	VII. Test adopts the NIST CSF and ISO 27001 standards as the...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-2	Security Categorization	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-3	Risk Assessment Key Control	Aligned	Risk assessments consider threats, vulnerabilities, likeliho...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-3	Risk Assessment Key Control	Aligned	1.0 PURPOSE...	anonymized_7.0_IS_Asset_Management_Policy.pdf
RA-3	Risk Assessment Key Control	Aligned	1.3 MANAGEMENT DIRECTION FOR INFORMATION SECURITY...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-3	Risk Assessment Key Control	Aligned	Risk assessments consider threats, vulnerabilities, likeliho...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-3	Risk Assessment Key Control	Aligned	1.3 MANAGEMENT DIRECTION FOR INFORMATION SECURITY...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-3	Risk Assessment Key Control	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability monitoring includes scanning for patch levels;...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability monitoring includes scanning for patch levels;...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability Monitoring...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Continuous Vulnerability Management...	anonymized_7.2_IS_End_User_Device_Standard.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability monitoring includes scanning for patch levels;...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Risk Assessment \| Security Categorization...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability Monitoring and Analysis...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Continuous Vulnerability Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-6	Technical Surveillance Countermeasures Survey	Gap	A technical surveillance countermeasures survey is a service provided by qualified personnel to dete...
RA-7	Risk Response	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-7	Risk Response	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-8	Privacy Impact Assessments	Aligned	Privacy Impact Assessment Overview...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-8	Privacy Impact Assessments	Aligned	Privacy Impact Assessment...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-9	Criticality Analysis Key Control	Aligned	Control assessments, such as red team exercises, provide add...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-9	Criticality Analysis Key Control	Aligned	Criticality analysis is performed when an architecture or de...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-9	Criticality Analysis Key Control	Aligned	Risk assessment is an ongoing activity carried out throughou...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-9	Criticality Analysis Key Control	Aligned	Criticality analysis is performed when an architecture or de...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-9	Criticality Analysis Key Control	Aligned	Criticality Analysis...	anonymized_7.0_IS_Asset_Management_Policy.pdf
RA-9	Criticality Analysis Key Control	Aligned	1.3 MANAGEMENT DIRECTION FOR INFORMATION SECURITY...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
RA-9	Criticality Analysis Key Control	Aligned	Risk Assessment \| Security Categorization...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-9	Criticality Analysis Key Control	Aligned	Criticality Analysis...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
RA-9	Criticality Analysis Key Control	Aligned	Risk assessment is an ongoing activity carried out throughou...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-9	Criticality Analysis Key Control	Aligned	Criticality analysis is performed when an architecture or de...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
RA-9	Criticality Analysis Key Control	Aligned	1.3 MANAGEMENT DIRECTION FOR INFORMATION SECURITY...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-1	Policy and Procedures	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SA-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SA-1	Policy and Procedures	Aligned	1.12 EXCEPTION...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SA-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SA-1	Policy and Procedures	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-1	Policy and Procedures	Aligned	1.4...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SA-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SA-1	Policy and Procedures	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-1	Policy and Procedures	Aligned	1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SA-1	Policy and Procedures	Aligned	Policy Exceptions and Implementation...	anonymized_6.1_IS_Data_Security_Standards.pdf
SA-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SA-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SA-1	Policy and Procedures	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-1	Policy and Procedures	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-10	Developer Configuration Management	Aligned	System & Services Acquisition \| Developer Configuration Mana...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-10	Developer Configuration Management	Aligned	Configuration Management \| Configuration Management Plan...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-10	Developer Configuration Management	Aligned	System & Services Acquisition \| Developer Configuration Mana...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-10	Developer Configuration Management	Aligned	System & Services Acquisition \| Developer Configuration Mana...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-10	Developer Configuration Management	Aligned	System & Services Acquisition \| Developer Configuration Mana...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-10	Developer Configuration Management	Aligned	System & Services Acquisition \| Developer Configuration Mana...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-10	Developer Configuration Management	Aligned	Configuration Management \| Developer Configuration Managemen...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-11	Developer Testing and Evaluation	Aligned	1.1.1 General Controls...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SA-15	Development Process, Standards, and Tools	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-15	Development Process, Standards, and Tools	Aligned	Configuration Management \| Configuration Settings...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-16	Developer-provided Training	Aligned	1.7 INFORMATION SECURITY EDUCATION & TRAINING...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SA-17	Developer Security and Privacy Architecture and Design	Gap	Developer security and privacy architecture and design are directed at external developers, although...
SA-2	Allocation of Resources	Aligned	In exceptional cases Divisions & Functions may implement a l...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SA-2	Allocation of Resources	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-2	Allocation of Resources	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-20	Customized Development of Critical Components	Aligned	System & Services Acquisition \| Customized Development of Cr...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SA-20	Customized Development of Critical Components	Aligned	SA-20: Organizations determine that certain system component...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SA-20	Customized Development of Critical Components	Aligned	Supply Chain Risk Management Plans...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SA-21	Developer Screening Key Control	Aligned	1.2 SCOPE & APPLICABILITY...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SA-22	Unsupported System Components	Gap	Support for system components includes software patches, firmware updates, replacement parts, and ma...
SA-23	Specialization Key Control	Gap	It is often necessary for a system or system component that supports mission-essential services or f... Critical Gap - Key Control Missing
SA-3	System Development Life Cycle	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-3	System Development Life Cycle	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-3	System Development Life Cycle	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-3	System Development Life Cycle	Aligned	Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SA-3	System Development Life Cycle	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-3	System Development Life Cycle	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-4	Acquisition Process	Aligned	Security and privacy functional requirements are typically d...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SA-4	Acquisition Process	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SA-4	Acquisition Process	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SA-4	Acquisition Process	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SA-4	Acquisition Process	Aligned	Security and privacy functional requirements...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-4	Acquisition Process	Aligned	Section 1.6 - EXCEPTION...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SA-4	Acquisition Process	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SA-4	Acquisition Process	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SA-4	Acquisition Process	Aligned	Security and privacy functional requirements are typically d...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-5	System Documentation	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-5	System Documentation	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-5	System Documentation	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Systems security and privacy engineering principles are clos...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Control: SA-8...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Control: SA-8...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	System & Communications Protection \| Boundary Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Systems security and privacy engineering principles are clos...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	VII. Test adopts the NIST CSF and ISO 27001 standards as the...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-9	External System Services Key Control	Aligned	Coordination and oversight of third-party relationships...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-9	External System Services Key Control	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-9	External System Services Key Control	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SA-9	External System Services Key Control	Aligned	Coordination and oversight of third-party relationships...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-1	Policy and Procedures	Aligned	1.11 MAINTENANCE and 1.12 EXCEPTION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SC-1	Policy and Procedures	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SC-1	Policy and Procedures	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-1	Policy and Procedures	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SC-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-1	Policy and Procedures	Aligned	In exceptional cases Divisions & Functions may implement a l...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-1	Policy and Procedures	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-1	Policy and Procedures	Aligned	1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SC-1	Policy and Procedures	Aligned	System and communications protection policy and procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SC-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SC-1	Policy and Procedures	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-1	Policy and Procedures	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-10	Network Disconnect	Gap	Network disconnect applies to internal and external networks. Terminating network connections associ...
SC-11	Trusted Path	Gap	Trusted paths are mechanisms by which users can communicate (using input devices such as keyboards) ...
SC-12	Cryptographic Key Establishment and Management	Aligned	9.0 Cryptographic Policy...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-12	Cryptographic Key Establishment and Management	Aligned	Encryption is to be used to protect the confidentiality of r...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-12	Cryptographic Key Establishment and Management	Aligned	Cryptography – Establishes controls for proper and effective...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-12	Cryptographic Key Establishment and Management	Aligned	Cryptography...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-12	Cryptographic Key Establishment and Management	Aligned	Cryptography...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-13	Cryptographic Protection	Aligned	9.0 Cryptographic Policy...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-13	Cryptographic Protection	Aligned	Section v and vi...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-13	Cryptographic Protection	Aligned	Cryptography – Establishes controls for proper and effective...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-13	Cryptographic Protection	Aligned	Cryptography...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-15	Collaborative Computing Devices and Applications	Aligned	System & Communications Protection \| Collaborative Computing...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-16	Transmission of Security and Privacy Attributes	Aligned	Restricted Data...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-16	Transmission of Security and Privacy Attributes	Aligned	1.2.1 Access Control...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-16	Transmission of Security and Privacy Attributes	Aligned	Confidentiality or Non-Disclosure Agreements, Securing Appli...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SC-16	Transmission of Security and Privacy Attributes	Aligned	Data Security classification policy...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SC-16	Transmission of Security and Privacy Attributes	Aligned	Assets ownership and responsibilities...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-16	Transmission of Security and Privacy Attributes	Aligned	Term Definitions...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-16	Transmission of Security and Privacy Attributes	Aligned	proprietary information, trade secrets or any other sensitiv...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SC-17	Public Key Infrastructure Certificates	Aligned	9.0 Cryptography Policy...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-18	Mobile Code	Aligned	f. Ensure that the security controls are in place while usin...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-18	Mobile Code	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SC-18	Mobile Code	Aligned	1.4 SECURITY & PROPRIETARY INFORMATION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SC-2	Separation of System and User Functionality	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-2	Separation of System and User Functionality	Aligned	User access to networks and network services...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	System & Communications Protection \| Secure Name/Address Res...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	System & Communications Protection \| Secure Name/address Res...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	System & Communications Protection\| Secure Name/address Reso...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	System & Communications Protection\| Secure Name/address Reso...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Aligned	System & Communications Protection \| Secure Name/Address Res...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Aligned	System & Communications Protection\| Secure Name/address Reso...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Aligned	System & Communications Protection\| Secure Name/address Reso...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Aligned	System & Communications Protection\| Architecture and Provisi...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Aligned	System & Communications Protection \| Secure Name/Address Res...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Aligned	System & Communications Protection\| Secure Name/address Reso...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Aligned	System & Communications Protection\| Secure Name/address Reso...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-23	Session Authenticity	Aligned	System & Communications Protection\| Session Authenticity...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-23	Session Authenticity	Aligned	All external connections to Test networks or Information Res...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-23	Session Authenticity	Aligned	System & Communications Protection\| Session Authenticity...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-24	Fail in Known State	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-24	Fail in Known State	Aligned	Information Security Aspects of Business Continuity Manageme...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-25	Thin Nodes	Gap	The deployment of system components with minimal functionality reduces the need to secure every endp...
SC-26	Decoys	Gap	Decoys (i.e., honeypots, honeynets, or deception nets) are established to attract adversaries and de...
SC-27	Platform-independent Applications	Gap	Platforms are combinations of hardware, firmware, and software components used to execute software a...
SC-28	Protection of Information at Rest Key Control	Aligned	Controls can be viewed as descriptions of the safeguards and...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	1.4 DATA CUSTODIAN RESPONSIBILITIES...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Encryption is to be used to protect the confidentiality of r...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Information Resources which are necessary for their work, an...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Encryption is to be used to protect the confidentiality of r...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Devices should be password-protected and encrypted....	anonymized_7.2_IS_End_User_Device_Standard.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Only USB sticks and other removable devices that have been a...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Asset Management, Access Control, Cryptography...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Encryption of PII/NPI data under regulatory, legal or contra...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Asset Management, Access Control, Cryptography...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-29	Heterogeneity	Gap	Increasing the diversity of information technologies within organizational systems reduces the impac...
SC-3	Security Function Isolation	Aligned	System & Communications Protection \| Boundary Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-30	Concealment and Misdirection	Gap	Concealment and misdirection techniques can significantly reduce the targeting capabilities of adver...
SC-31	Covert Channel Analysis	Gap	Developers are in the best position to identify potential areas within systems that might lead to co...
SC-32	System Partitioning	Gap	System partitioning is part of a defense-in-depth protection strategy. Organizations determine the d...
SC-34	Non-modifiable Executable Programs	Gap	The operating environment for a system contains the code that hosts applications, including operatin...
SC-35	External Malicious Code Identification	Aligned	Section 6: Unacceptable Uses of Test’s Systems...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SC-36	Distributed Processing and Storage	Gap	Distributing processing and storage across multiple physical locations or logical domains provides a...
SC-37	Out-of-band Channels Key Control	Aligned	System & Communications Protection\| Out-of-Band Channels...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-37	Out-of-band Channels Key Control	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-37	Out-of-band Channels Key Control	Aligned	System & Communications Protection\| Out-of-Band Channels...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-38	Operations Security	Aligned	Scope & Applicability...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-38	Operations Security	Aligned	Operations Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-38	Operations Security	Aligned	Operations Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-39	Process Isolation	Gap	Systems can maintain separate execution domains for each executing process by assigning each process...
SC-4	Information in Shared System Resources	Aligned	Leaving Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SC-4	Information in Shared System Resources	Aligned	1.2.2 Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-40	Wireless Link Protection	Aligned	Section 10 and 11 regarding approved end-user devices and th...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SC-41	Port and I/O Device Access	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SC-41	Port and I/O Device Access	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SC-42	Sensor Capability and Data Key Control	Aligned	Monitoring of User’s device and Installation of Software on ...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SC-42	Sensor Capability and Data Key Control	Aligned	Ensure that the security controls are in place while using m...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-42	Sensor Capability and Data Key Control	Aligned	Monitoring of User’s device and Installation of Software on ...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SC-43	Usage Restrictions	Aligned	Usage Restrictions and Compliance...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SC-43	Usage Restrictions	Aligned	Overview, Scope & Applicability...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SC-43	Usage Restrictions	Aligned	Acceptable Use of Assets...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-43	Usage Restrictions	Aligned	1.2 Endpoint Security Device Management...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SC-43	Usage Restrictions	Aligned	Usage Restrictions and Compliance...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SC-44	Detonation Chambers	Gap	Detonation chambers, also known as dynamic execution environments, allow organizations to open email...
SC-45	System Time Synchronization	Gap	Time synchronization of system clocks is essential for the correct execution of many system services...
SC-46	Cross Domain Policy Enforcement	Gap	For logical policy enforcement mechanisms, organizations avoid creating a logical path between inter...
SC-47	Alternate Communications Paths	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SC-47	Alternate Communications Paths	Aligned	Information Security Incident Management and Information Sec...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-47	Alternate Communications Paths	Aligned	Information Security Incident Management and Information Sec...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-48	Sensor Relocation	Gap	Adversaries may take various paths and use different approaches as they move laterally through an or...
SC-49	Hardware-enforced Separation and Policy Enforcement	Gap	System owners may require additional strength of mechanism and robustness to ensure domain separatio...
SC-5	Denial-of-service Protection	Aligned	System & Communications Protection\| Denial-of-Service Protec...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-5	Denial-of-service Protection	Aligned	Denial-of-service events may occur due to a variety of inter...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-5	Denial-of-service Protection	Aligned	System & Communications Protection\| Denial-of-Service Protec...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	1.6 EXCEPTION...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	1.4 MAINTAINANCE and 1.5 EXCEPTIONS...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-51	Hardware-based Protection	Gap	None....
SC-6	Resource Availability	Gap	Priority protection prevents lower-priority processes from delaying or interfering with the system t...
SC-7	Boundary Protection	Aligned	System & Communications Protection\| Boundary Protection...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-7	Boundary Protection	Aligned	System & Communications Protection \| Secure Name/Address Res...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-7	Boundary Protection	Aligned	System monitoring capabilities are achieved through a variet...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-7	Boundary Protection	Aligned	a. Appropriate controls for User access to networks and netw...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-7	Boundary Protection	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-7	Boundary Protection	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-7	Boundary Protection	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-7	Boundary Protection	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-7	Boundary Protection	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SC-7	Boundary Protection	Aligned	Network and Firewall Security Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-7	Boundary Protection	Aligned	System & Communications Protection\| Boundary Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-7	Boundary Protection	Aligned	System & Communications Protection \| Boundary Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-7	Boundary Protection	Aligned	System & Communications Protection \| Resource Availability...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SC-7	Boundary Protection	Aligned	Network and Firewall Security Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SC-7	Boundary Protection	Aligned	Access to Networks & Network Services...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	The application of systems security and privacy engineering ...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	Contingency Planning \| Telecommunications Services...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	All external connections to Test networks or Information Res...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	Encryption is to be used to protect the confidentiality of r...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	Protecting the confidentiality and integrity of transmitted ...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	In certain offices, encrypted USB devices are required....	anonymized_7.2_IS_End_User_Device_Standard.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	Voice Communications Equipment Protection...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	Protection of system backup information while in transit....	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	Contingency Planning \| Telecommunications Services...	anonymized_6.1_IS_Data_Security_Standards.pdf
SC-8	Transmission Confidentiality and Integrity	Aligned	Control: SC-8: Protecting the confidentiality and integrity ...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SI-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-1	Policy and Procedures	Aligned	1.7 WORDING and 1.8 GLOSSARY...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SI-1	Policy and Procedures	Aligned	1.12 EXCEPTION...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-1	Policy and Procedures	Aligned	1.4 EXCEPTION...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SI-1	Policy and Procedures	Aligned	Policy Exception Process...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SI-1	Policy and Procedures	Aligned	Internet Security & Usage Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures	Aligned	Internet Security & Usage Policy – Establishes controls that...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures	Aligned	Internet Security & Usage Policy...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures	Aligned	1.6...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SI-1	Policy and Procedures	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-1	Policy and Procedures	Aligned	Internet Security & Usage Policy – Establishes controls that...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures	Aligned	Internet Security & Usage Policy – Establishes controls that...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SI-10	Information Input Validation	Aligned	Checks into a system or report to ensure the logical consist...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SI-11	Error Handling	Gap	Organizations consider the structure and content of error messages. The extent to which systems can ...
SI-12	Information Management and Retention	Aligned	1.8 DATA RETENTION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SI-12	Information Management and Retention	Aligned	Control: SI-12: Information management and retention require...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SI-12	Information Management and Retention	Aligned	Information Management and Retention...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-12	Information Management and Retention	Aligned	Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SI-12	Information Management and Retention	Aligned	1.3 IT Asset (NEW) and other assets Retirement and Disposal...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SI-12	Information Management and Retention	Aligned	Disposal (in accordance with Retention Policy)...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-12	Information Management and Retention	Aligned	Information management and retention requirements cover the ...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-13	Predictable Failure Prevention	Gap	While MTTF is primarily a reliability issue, predictable failure prevention is intended to address p...
SI-14	Non-persistence	Gap	Implementation of non-persistent components and services mitigates risk from advanced persistent thr...
SI-15	Information Output Filtering	Gap	Certain types of attacks, including SQL injections, produce output results that are unexpected or in...
SI-16	Memory Protection	Gap	Some adversaries launch attacks with the intent of executing code in non-executable regions of memor...
SI-17	Fail-safe Procedures	Gap	Failure conditions include the loss of communications among critical system components or between sy...
SI-18	Personally Identifiable Information Quality Operations	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-19	De-identification	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-19	De-identification	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-2	Flaw Remediation	Aligned	IV. Maintaining Security while using Organizationally Owned ...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-2	Flaw Remediation	Aligned	1.5 ORGANIZATIONALY OWNED & MANAGED INFO SYSTEMS & ASSETS...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SI-2	Flaw Remediation	Aligned	IV. Maintaining Security while using Organizationally Owned ...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-2	Flaw Remediation	Aligned	1.5 ORGANIZATIONALY OWNED & MANAGED INFO SYSTEMS & ASSETS...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SI-20	Tainting	Aligned	1.8 DISCIPLINARY PROCESS...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-20	Tainting	Aligned	Requirements for handling suspicious emails...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SI-20	Tainting	Aligned	Requirements for handling suspicious emails...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SI-21	Information Refresh	Aligned	1.8 DATA RETENTION...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SI-21	Information Refresh	Aligned	1.2.2 Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SI-22	Information Diversity Key Control	Gap	Actions taken by a system service or a function are often driven by the information it receives. Cor... Critical Gap - Key Control Missing
SI-23	Information Fragmentation	Aligned	1.1 Data Handling Procedures...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-3	Malicious Code Protection	Aligned	Section 4: Posting Test information on public Internet sites...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-3	Malicious Code Protection	Aligned	Malicious code protection mechanisms include both signature-...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SI-3	Malicious Code Protection	Aligned	Section 4: All PCs and laptops should be equipped with up-to...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SI-3	Malicious Code Protection	Aligned	System & Communications Protection \| Boundary Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-3	Malicious Code Protection	Aligned	Malicious code protection mechanisms include both signature-...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-4	System Monitoring	Aligned	1.2 SYSTEM USE NOTIFICATION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-4	System Monitoring	Aligned	Network Monitoring & Defense...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SI-4	System Monitoring	Aligned	System monitoring includes external and internal monitoring....	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-4	System Monitoring	Aligned	System Monitoring Overview...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SI-4	System Monitoring	Aligned	Overview, Scope & Applicability...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SI-4	System Monitoring	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SI-4	System Monitoring	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-4	System Monitoring	Aligned	1.2 SYSTEM USE NOTIFICATION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-4	System Monitoring	Aligned	Organizations may determine that, in response to the detecti...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-4	System Monitoring	Aligned	System monitoring includes external and internal monitoring....	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SI-5	Security Alerts, Advisories, and Directives Key Control	Aligned	Role Responsibility...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SI-6	Security and Privacy Function Verification	Aligned	1.9 LEAVING Test...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-6	Security and Privacy Function Verification	Aligned	1.2 SYSTEM USE NOTIFICATION...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Integrity Checks...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Monitoring of User’s device and Installation of Software on ...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	1.2. Hardware, Software, Applications and Data - Inventory o...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	System & Communications Protection \| Boundary Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Installation of Software on User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-8	Spam Protection	Aligned	Section 6: Unacceptable Uses of Test's Systems...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-8	Spam Protection	Aligned	Section 6: Personal firewalls software should be installed a...	anonymized_7.2_IS_End_User_Device_Standard.pdf
SI-8	Spam Protection	Aligned	Network Controls...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SI-8	Spam Protection	Aligned	System & Communications Protection \| Boundary Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
SI-8	Spam Protection	Aligned	Section 6 - Unacceptable Uses of Test’s Systems...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SI-8	Spam Protection	Aligned	1.4 SECURITY & PROPRIETARY INFORMATION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SR-1	Policy and Procedures	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SR-1	Policy and Procedures	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SR-1	Policy and Procedures	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SR-1	Policy and Procedures	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
SR-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SR-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SR-1	Policy and Procedures	Aligned	Supply chain risk management policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-1	Policy and Procedures	Aligned	1.6 EXCEPTION...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SR-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SR-1	Policy and Procedures	Aligned	Supply chain risk management policy and procedures...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-1	Policy and Procedures	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-10	Inspection of Systems or Components	Gap	The inspection of systems or systems components for tamper resistance and detection addresses physic...
SR-11	Component Authenticity	Gap	Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-...
SR-12	Component Disposal	Aligned	Disposal of Media...	anonymized_6.0_IS_Data_Security_Policy_1.pdf
SR-12	Component Disposal	Aligned	V. Bring Your Own Device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SR-12	Component Disposal	Aligned	1.2.2 Asset Disposal & Re-Use...	anonymized_7.0_IS_Asset_Management_Policy.pdf
SR-12	Component Disposal	Aligned	1.3 IT Asset (NEW) and other assets Retirement and Disposal...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SR-12	Component Disposal	Aligned	Disposal (in accordance with Retention Policy)...	anonymized_6.1_IS_Data_Security_Standards.pdf
SR-12	Component Disposal	Aligned	V. Bring Your Own Device...	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
SR-2	Supply Chain Risk Management Plan	Aligned	Supply Chain Risk Management Overview...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SR-2	Supply Chain Risk Management Plan	Aligned	Program Management \| Information Security Program Leadership...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-2	Supply Chain Risk Management Plan	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-2	Supply Chain Risk Management Plan	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-2	Supply Chain Risk Management Plan	Aligned	Supply Chain Risk Management Overview...	anonymized_2.0_IS_Acceptable_Use_Policy.pdf
SR-2	Supply Chain Risk Management Plan	Aligned	System Acquisition, Development and Maintenance; Vendor Risk...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-2	Supply Chain Risk Management Plan	Aligned	Program Management \| Service Provider Management...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-3	Supply Chain Controls and Processes Key Control	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-3	Supply Chain Controls and Processes Key Control	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-4	Provenance Key Control	Gap	Every system and system component has a point of origin and may be changed throughout its existence.... Critical Gap - Key Control Missing
SR-5	Acquisition Strategies, Tools, and Methods	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-5	Acquisition Strategies, Tools, and Methods	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-5	Acquisition Strategies, Tools, and Methods	Aligned	IT Asset Procurement...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SR-5	Acquisition Strategies, Tools, and Methods	Aligned	System Acquisition, Development and Maintenance...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-6	Supplier Assessments and Reviews Key Control	Aligned	Coordination and oversight of third-party relationships...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-6	Supplier Assessments and Reviews Key Control	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-6	Supplier Assessments and Reviews Key Control	Aligned	Vendor Risk Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-6	Supplier Assessments and Reviews Key Control	Aligned	Coordination and oversight of third-party relationships...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-7	Supply Chain Operations Security	Aligned	Asset Management Policy and Supplier Relationship Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-7	Supply Chain Operations Security	Aligned	Operations Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-7	Supply Chain Operations Security	Aligned	Operations Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-7	Supply Chain Operations Security	Aligned	Coordination and oversight of third-party relationships...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-8	Notification Agreements Key Control	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-8	Notification Agreements Key Control	Aligned	IT Asset Procurement...	anonymized_7.1_IS_Asset_Management_Standard.pdf
SR-8	Notification Agreements Key Control	Aligned	Information Security Incident Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
SR-8	Notification Agreements Key Control	Aligned	Coordination and oversight of third-party relationships...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-9	Tamper Resistance and Detection	Gap	Anti-tamper technologies, tools, and techniques provide a level of protection for systems, system co...
MA-2b	Controlled Maintenance	Aligned	Installation of Software on User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
MA-2b	Controlled Maintenance	Aligned	Installation of Software on User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-17(1)	Remote Access	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-17(1)	Remote Access	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AC-17(1)	Remote Access	Aligned	Section c) and e)...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AU-6(1)	Audit Review, Analysis, and Reporting	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-6(1)	Audit Review, Analysis, and Reporting	Aligned	Monitoring of User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
AU-6(1)	Audit Review, Analysis, and Reporting	Aligned	Section f)...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CM-3(1)	Configuration Change Control	Aligned	Installation of Software on User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
A.16	Application Software Security	Aligned	Control: A.16...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
A.16	Application Software Security	Aligned	Service Provider Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
15	Service Provider Management	Aligned	Service Provider Management...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
15	Service Provider Management	Aligned	Supply chain risk management (SCRM) activities include ident...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.11.1.4	Protecting Against External & Environmental Threats	Aligned	Protecting Against External & Environmental Threats...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
A.11.1.4	Protecting Against External & Environmental Threats	Aligned	Control: SC-7...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.11.1.4	Protecting Against External & Environmental Threats	Aligned	Threat actions that may increase security or privacy risks i...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.11.1.4	Protecting Against External & Environmental Threats	Aligned	Management of Privileged Access Rights...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.11.1.4	Protecting Against External & Environmental Threats	Aligned	Physical & Environmental Protection...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.11.1.4	Protecting Against External & Environmental Threats	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.6.1.2	Segregation of Duties	Aligned	Supply chain OPSEC expands the scope of OPSEC to include sup...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Supply chain information includes user identities; uses for ...	anonymized_8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Policy...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Mission and business process definitions and the associated ...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	System and communications protection policy and procedures...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Physical & Environmental Protection...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.9.1.1	Access Control Policy	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.9.1.1	Access Control Policy	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.9.1.1	Access Control Policy	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.9.1.1	Access Control Policy	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.9.1.2	Access to Networks & Network Services	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.2	Access to Networks & Network Services	Aligned	Network Monitoring & Defense...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.2	Access to Networks & Network Services	Aligned	Network Monitoring & Defense...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.2	Access to Networks & Network Services	Aligned	Network Monitoring & Defense...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.2	Access to Networks & Network Services	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.2	Access to Networks & Network Services	Aligned	Network Monitoring & Defense...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.2	Access to Networks & Network Services	Aligned	Control: SC-7...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.2	Access to Networks & Network Services	Aligned	NIST CSF...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.4.1	Information Access Restriction	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.4.1	Information Access Restriction	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.4.1	Information Access Restriction	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.4.1	Information Access Restriction	Aligned	Access Control Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.4.1	Information Access Restriction	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.13.1.1	Network Controls	Aligned	Network Monitoring & Defense...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.13.1.1	Network Controls	Aligned	Network Monitoring & Defense...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.13.1.1	Network Controls	Aligned	Control: SC-7...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.13.1.1	Network Controls	Aligned	A.13.1.1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.13.1.1	Network Controls	Aligned	Network Controls...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.13.1.1	Network Controls	Aligned	A.13.1.1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.13.1.3	Segregation in Networks	Aligned	Network Monitoring & Defense...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2g	Account Management	Aligned	Managers...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.2.3	Access to Networks & Network Services	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.2.3	Access to Networks & Network Services	Aligned	Access Control Management...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.10.1.1	Policy on the Utilization of Cryptographic Controls	Aligned	NIST CSF...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
A.10.1.1	Policy on the Utilization of Cryptographic Controls	Aligned	A.10.1.1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.10.1.1	Policy on the Utilization of Cryptographic Controls	Aligned	A.10.1.1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.10.1.1	Policy on the Utilization of Cryptographic Controls	Aligned	Access to Networks & Network Services...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.10.1.1	Policy on the Utilization of Cryptographic Controls	Aligned	A.10.1.1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-6(9)	Access Control Policy	Aligned	Access Control Policy...	anonymized_5.0_IS_Human_Resource_Security_Policy_1.pdf
ID.AM-6	Security Awareness & Skills Training	Aligned	1.11 CONTROL REFERENCES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
ID.AM-6	Security Awareness & Skills Training	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
ID.AM-6	Security Awareness & Skills Training	Aligned	Control References...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
ID.AM-6	Security Awareness & Skills Training	Aligned	1.11 CONTROL REFERENCES...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
ID.AM-6	Security Awareness & Skills Training	Aligned	Policy...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.7.1.2	Terms & Conditions of Employment	Aligned	Information Security Awareness, Education and Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.13.2.1	Policy on the Utilization of Cryptographic Controls	Aligned	Policy on the Utilization of Cryptographic Controls...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.13.2.1	Policy on the Utilization of Cryptographic Controls	Aligned	Segregation in Networks...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.13.2.1	Policy on the Utilization of Cryptographic Controls	Aligned	A.13.2.1...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PR.DS-5	Data Protection	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
PR.DS-5	Data Protection	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.11.2.1	Equipment Siting & Protection	Aligned	Physical & Environmental Protection...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.11.2.1	Equipment Siting & Protection	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
A.11.2.1	Equipment Siting & Protection	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	anonymized_7.0_IS_Asset_Management_Policy.pdf
ID.GV-1	Governance	Aligned	Information Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
ID.GV-1	Governance	Aligned	1.10 CONTROL REFERENCES...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
ID.GV-1	Governance	Aligned	Definition of Information Security...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PR.IP-7	Vulnerability Management	Aligned	Continuous vulnerability monitoring tools that use instrumen...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
AM-1	Asset Management	Aligned	Asset Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
PR.IP-6	Privacy Engineering Principles	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
PR.IP-6	Privacy Engineering Principles	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
PR.IP-6	Privacy Engineering Principles	Aligned	System & Communications Protection \| Boundary Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
PR.IP-6	Privacy Engineering Principles	Aligned	System & Communications Protection \| Boundary Protection...	anonymized_6.1_IS_Data_Security_Standards.pdf
PR.IP-6	Privacy Engineering Principles	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
PR.IP-6	Privacy Engineering Principles	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
PR.IP-6	Privacy Engineering Principles	Aligned	System & Information Integrity \| System Monitoring...	anonymized_6.1_IS_Data_Security_Standards.pdf
CM-2(2)	Configuration Change Control	Aligned	Installation of Software on User’s device....	anonymized_2.1_IS_Acceptable_Use_Standard.pdf
A.5.1.1	Policies for Information Security	Aligned	1.10 CONTROL REFERENCES...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
3.1	Asset Management Key Control	Aligned	Asset Management...	anonymized_3.0_IS_Information_Security_Policy_2.pdf
A.7.2.2	Information Security Awareness, Education and Training	Aligned	Information Security Awareness, Education and Training...	anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf

AI Justification

The section explicitly mentions the ability to remotely wipe data from personal devices that are part of the BYOD program, which aligns with the control's requirement for enterprise-owned devices.

anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf CIS

1 matches found

Document Content

Matched Section

anonymized_2.0_IS_Acceptable_Use_Policy.pdf CIS

2 matches found

Document Content

Matched Section

Section: Data Classification Policy
Content: proprietary information, trade secrets or any other sensitive material covered by Data Security classification policy. This includes but is not limited to blogging and social media usage.

AI Justification

The text discusses sensitive material and mentions a Data Security classification policy, which aligns with establishing and maintaining a data classification scheme.

Document Content

The text discusses the need for policies and procedures related to assessment, authorization, and monitoring, which aligns with the CA-1 control requirements.

Document Content

Matched Section

Section: Installation of Software on User’s device.
Content: User agrees to install required software on his/her device, including but not limited to, antivirus/antimalware, operating system upgrades, and software that accesses and collects data stored in a Test managed application.

AI Justification

The section discusses the user's agreement to install required software and not interfere with it, which aligns with the control's focus on managing software installations.

Document Content

Matched Section

The text discusses the importance of maintenance policies and procedures in relation to security and privacy assurance, which aligns with control MA-1.

Document Content

Matched Section

AI Justification

The text discusses the importance of media protection policies and procedures, including the approval process for exceptions, which aligns with the control's focus on establishing and maintaining such policies.

Document Content

Document Content

Matched Section

AI Justification

The requirement for users to install specific software and not interfere with it aligns with the need for configuration management controls.

Document Content

Document Content

Matched Section

Section: Classification of Information
Content: Classification of Information

AI Justification

The text discusses the process of security categorization, its importance in understanding potential adverse impacts, and the involvement of various organizational roles, which aligns directly with the RA-2 control.

Document Content

Matched Section

The text discusses the derivation of security and privacy requirements and the flexibility in implementing controls based on risk, which aligns with the essence of SA-4.

Document Content

Matched Section

The text discusses the importance of having policies and procedures for system and information integrity, including the process for handling exceptions to these policies.

Document Content

Matched Section

AI Justification

The chunk discusses the importance of maintaining security through updates and reporting issues related to automatic updates, which aligns with the need to remediate system flaws.

Document Content

Matched Section

The chunk discusses monitoring of user devices and the installation of required software, which relates to ensuring the integrity of software and preventing unauthorized changes.

Document Content

Matched Section

Section: 1.2 SYSTEM USE NOTIFICATION
Content: a. When accessing Test systems, all users should be presented a system use notification message upon login. Where such messages are not able to be presented to the user, Test should actively monitor the system and activity to maintain system security and availability and to ensure appropriate and legitimate usage.

AI Justification

The section discusses system use notifications and monitoring activities to ensure security and compliance, which aligns with the transitional states and notifications described in SI-6.

Document Content

The chunk discusses the need to define, document, implement, and maintain policies for controlling access to and use of information resources, which aligns with understanding where information is processed and stored.

Document Content

Matched Section

AI Justification

The text discusses user consent regarding the use of Test's systems and the monitoring of their activities, which aligns with the principles of consent as outlined in control PT-4.

Document Content

Matched Section

The text discusses the importance of policies and procedures related to system and services acquisition, including the need for exceptions to be approved and documented, which aligns with the control's focus on establishing such policies.

Document Content

Matched Section

Section: SA-20: Organizations determine that certain system components likely cannot be trusted due to specific threats to and vulnerabilities in those components for which there are no viable security controls to adequately mitigate risk.
Content: Control: SA-20: Organizations determine that certain system components likely cannot be trusted due to specific threats to and vulnerabilities in those components for which there are no viable security controls to adequately mitigate risk. Reimplementation or custom development of such components may satisfy requirements for higher assurance and is carried out by initiating changes to system components (including hardware, software, and firmware) such that the standard attacks by adversaries are less likely to succeed. In situations where no alternative sourcing is available and organizations choose not to reimplement or custom develop critical system components, additional controls can be employed. Controls include enhanced auditing, restrictions on source code and system utility access, and protection from deletion of system and application files.

AI Justification

The chunk directly references the control SA-20, which discusses the need for organizations to determine trust levels of system components and the potential for reimplementation or custom development.

Document Content

Matched Section

AI Justification

The chunk discusses the process of defining and implementing security requirements and exceptions, which aligns with the concept of deriving security and privacy functional requirements.

Document Content

Matched Section

Section: Systems security and privacy engineering principles are closely related to and implemented throughout the system development life cycle.
Content: Systems security and privacy engineering principles are closely related to and implemented throughout the system development life cycle (see SA-3). Organizations can apply systems security and privacy engineering principles to new systems under development or to systems undergoing upgrades. For existing systems, organizations apply systems security and privacy engineering principles to system upgrades and modifications to the extent feasible, given the current state of hardware, software, and firmware components within those systems.

AI Justification

The text discusses the implementation of security and privacy engineering principles throughout the system development life cycle, which aligns directly with control SA-8.

Document Content

Matched Section

The text discusses the importance of having policies and procedures for managing supply chain risks, which aligns with the control's focus on establishing such policies.

Document Content

Matched Section

Section: Supply Chain Risk Management Overview
Content: The dependence on products, systems, and services from external providers, as well as the nature of the relationships with those providers, present an increasing level of risk to an organization. Threat actions that may increase security or privacy risks include unauthorized production, the insertion or use of counterfeits, tampering, theft, insertion of malicious software and hardware, and poor manufacturing and development practices in the supply chain.

AI Justification

The text discusses the risks associated with external providers and the importance of managing supply chain risks, which aligns directly with the SR-2 control.

Document Content

Matched Section

The chunk discusses the establishment of controls for managing information security incidents, which aligns with the requirements for documenting incidents as outlined in IR-5.

Document Content

Matched Section

AI Justification

The section discusses the management of information security incidents, which includes reporting and communication aspects, aligning with the requirements of incident reporting outlined in IR-6.

Document Content

Matched Section

The text discusses the roles and access requirements of maintenance personnel, which aligns with the control's focus on maintenance activities and access authorizations.

Document Content

Matched Section

The chunk discusses controls related to physical and environmental security, which aligns with the need for physical access authorizations.

Document Content

Matched Section

AI Justification

The chunk discusses the establishment of controls to prevent unauthorized physical access, which aligns with the requirements of PE-3.

Document Content

Matched Section

Section: Physical and environmental protection policy and procedures
Content: Control: PE-1: Physical and environmental protection policy and procedures address the controls in the PE family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures.

AI Justification

The text discusses the establishment of policies and procedures related to physical and environmental protection, which aligns with the requirements of control PE-1.

Document Content

Matched Section

The chunk discusses various policies related to information security, which aligns with the need for planning policies and procedures as outlined in control PL-1.

Document Content

Matched Section

Section: Control: PL-11
Content: The concept of tailoring allows organizations to specialize or customize a set of baseline controls by applying a defined set of tailoring actions. Tailoring actions facilitate such specialization and customization by allowing organizations to develop security and privacy plans that reflect their specific mission and business functions, the environments where their systems operate, the threats and vulnerabilities that can affect their systems, and any other conditions or situations that can impact their mission or business success.

AI Justification

The text discusses the concept of tailoring controls to meet specific organizational needs, which aligns with the control's focus on customizing baseline controls.

Document Content

Matched Section

AI Justification

The text discusses establishing acceptable use policies and information security policies, which relate to the rules of behavior for users.

The chunk discusses the importance of maintaining an inventory of systems, which aligns with the guidance provided in PM-5 regarding system inventories.

Document Content

Matched Section

AI Justification

The mention of system inventory in the context of organizational systems aligns with CM-8, which focuses on maintaining an inventory of system components.

Document Content

Matched Section

Section: System Acquisition, Development and Maintenance
Content: Establishes controls to ensure that information security is an integral part of information systems across the entire lifecycle and information security is designed and implemented within the development lifecycle of information systems.

AI Justification

The chunk discusses the integration of information security into the entire lifecycle of information systems, which aligns with the requirement for integrating security and privacy considerations into the enterprise architecture.

Document Content

Matched Section

The text discusses the importance of policies and procedures for system and services acquisition, aligning directly with the control's focus on establishing such policies.

Document Content

Matched Section

AI Justification

The mention of establishing controls for information security across the lifecycle suggests resource allocation for security measures.

Document Content

Matched Section

AI Justification

The text mentions the need for effective management of information security incidents, which aligns with the incident response control.

Document Content

Matched Section

The text discusses the importance of system documentation in understanding the implementation and operation of controls, which aligns with the objectives of SA-5.

Document Content

The chunk discusses the importance of maintaining information security throughout the lifecycle of information systems, which aligns with the concept of ensuring systems can fail in a known state to prevent loss of confidentiality, integrity, or availability.

Document Content

Matched Section

Section: Asset Management, Access Control, Cryptography
Content: Asset Management – Establishes controls for asset identification, inventory, ownership and handling. Defines appropriate level of protection requirement and accountabilities for information assets. (g) Access Control – Establishes controls to manage access to information assets and information processing facilities via defined business requirements. (h) Cryptography – Establishes controls for proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information.

AI Justification

The chunk discusses the establishment of controls for asset management, access control, and cryptography, which are relevant to the protection of information at rest, particularly regarding confidentiality and integrity.

Document Content

Matched Section

AI Justification

The text discusses the importance of establishing policies and procedures for system and communications protection, aligning directly with the SC-1 control.

Document Content

Document Content

Matched Section

Section: Compliance
Content: Compliance – Establishes controls to ensure compliance with legal, statutory,

AI Justification

The text emphasizes the need for policies and procedures at the organizational level, which relates to security planning.

Document Content

Matched Section

The chunk discusses the importance of integrating information security into the entire lifecycle of information systems, which aligns with managing risks associated with supply chain elements and processes.

Document Content

Matched Section

Section: System Acquisition, Development and Maintenance; Vendor Risk Management
Content: System Acquisition, Development and Maintenance – Establishes controls to ensure that information security is an integral part of information systems across the entire lifecycle and information security is designed and implemented within the development lifecycle of information systems. (m) Vendor Risk Management – Establishes controls to maintain an agreed level of information security and service delivery.

AI Justification

The text discusses the importance of managing supply chain risks, which aligns with the control's focus on the risks associated with external providers and the need for coordinated efforts in risk management.

Document Content

The chunk refers to security awareness and skills training, which is directly related to the need for education and training in information security.

Document Content

Matched Section

The text discusses the importance of contingency planning policies and procedures, their development, and their relationship with security and privacy programs.

Document Content

Matched Section

Section: Access Control Policy
Content: Organizations can satisfy the identification and authentication requirements by complying with the requirements in HSPD 12. Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in AC-14 and that occur through the authorized use of group authenticators without individual authentication.

AI Justification

The text discusses the requirements for unique identification and authentication of users, including the use of passwords, physical authenticators, and biometrics.

The text discusses the establishment and requirements of insider threat programs, which aligns directly with control PM-12.

Document Content

Matched Section

Calc test

Overall Alignment

Controls Aligned

Frameworks

Key Controls

Overall Alignment

Framework Breakdown

Key Controls Status

Compliance Summary & Framework Analysis

Framework Compliance Overview

Document Analysis Details

anonymized_2.1_IS_Acceptable_Use_Standard.pdf 2 frameworks

anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf 2 frameworks

anonymized_3.0_IS_Information_Security_Policy_2.pdf 2 frameworks

anonymized_2.0_IS_Acceptable_Use_Policy.pdf 2 frameworks

CIS Framework Checklist Complete control verification 85.3% Complete

NIST Framework Checklist Complete control verification 82.5% Complete

Detailed Document Analysis

anonymized_2.1_IS_Acceptable_Use_Standard.pdf CIS

3.5 Secure Data Disposal... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

3.9 Encrypt data on removable media... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

4.11 Remotely wipe enterprise data... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

anonymized_4.0_IS_Organization_of_Information_Security_Policy_1.pdf CIS

3.7 Data Classification Scheme... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

anonymized_3.0_IS_Information_Security_Policy_2.pdf CIS

1.2 Asset Management... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

1.1 Asset Management... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

3.7 Data Classification Scheme... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

anonymized_2.0_IS_Acceptable_Use_Policy.pdf CIS

3.7 Data Classification Scheme... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

2.2 Software Inventory Management... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

anonymized_2.1_IS_Acceptable_Use_Standard.pdf NIST

AC-1 Access Control Policy... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

AC-2 Account Management... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

AC-22 Access Control Policy... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

AC-19 Access Control Policy... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

AC-20 Mobile Device Management... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

AC-3 Access Control Policies... Click to view evidence details Matched