NIST SP 800-53 Rev 5

Requires each type of remote access to the system to be governed by documented usage restrictions, connection and configuration requirements and implementation guidance, and to be explicitly authorized before any remote connection is permitted.

Requires documented configuration settings, connection rules and implementation guidance for mobile devices the organization controls, including their use away from controlled areas, and explicit authorization before any such device connects to an organizational system.

Requires terms to be established, or existing external system relationships identified, before authorized individuals may reach the system from external systems or handle organizational information on them, or alternatively requires organization-defined types of external system to be prohibited outright.

Requires an accurate inventory of system components that covers every component, avoids duplicate or cross system accounting, is held at the granularity needed for tracking and reporting, carries the information the organization has defined for accountability, and is reviewed and updated on a defined frequency.

Requires an alternate storage site to be established with the agreements needed to store and retrieve backup information, and requires that site to provide controls equivalent to those protecting the primary site.

Requires alternate telecommunications services, with the necessary agreements, to allow defined system operations for essential functions to resume within a defined period when primary telecommunications are unavailable at either the primary or the alternate site.

Requires backups of user-level information, system-level information and system documentation including security and privacy documentation, each at an organization-defined frequency, and requires the confidentiality, integrity and availability of the backup information itself to be protected.

Requires the system to be recoverable and reconstitutable to a known state within an organization-defined period consistent with its recovery time and recovery point objectives after disruption, compromise or failure.

Requires organization-defined media types to be physically controlled and securely stored within organization-defined controlled areas, and requires that protection to continue until the media is destroyed or sanitised using approved equipment, techniques and procedures.

Requires organization-defined media types to be protected and controlled by defined controls while in transit outside controlled areas, accountability for the media to be maintained throughout, transport activity to be documented, and transport to be carried out only by authorized personnel.

Requires organization-defined media to be sanitised before disposal, before it leaves organizational control and before reuse, using defined techniques, with the mechanism chosen to match the sensitivity of the information the media held in strength and integrity.

Requires physical access authorizations to be enforced at defined entry and exit points by verifying authorization before entry and controlling ingress and egress with defined mechanisms or guards, physical access audit logs to be kept, publicly accessible areas to be controlled, visitors to be escorted and their activity controlled in defined circumstances, keys and combinations to be secured with inventories and changes made on defined events and frequencies.

Requires physical access to the facility to be monitored so that physical security incidents are detected and responded to, physical access logs to be reviewed at a defined frequency and on defined events, and review and investigation results to be coordinated with the incident response capability.

Requires the alternate work sites permitted for employees to be identified and documented, organization-defined controls to be applied at those sites, the effectiveness of those controls to be assessed, and a means to be provided for employees there to contact information security and privacy personnel about incidents.

Location of System Components. Position system components within the facility to minimize potential damage from [organization-defined] and to minimize the opportunity for unauthorized access

Requires communications to be monitored and controlled at external managed interfaces and at key internal interfaces, publicly accessible components to sit in subnetworks physically or logically separated from internal networks, and connections to external networks or systems to pass only through managed interfaces built from boundary protection devices arranged per the security architecture.

Requires integrity verification tools to be employed to detect unauthorized changes to organization-defined software, firmware and information, and requires organization-defined actions to be taken when such unauthorized changes are detected.