{"text_format":"1","workbook":"xlsx","n_sheets":3,"sheets":["Instructions","Risk Findings","Values Lists"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Instructions","index":0,"n_rows":12,"n_cols":16,"rows_kept":12,"cut":false,"hidden":false,"merged":[[5,1,5,10],[7,1,7,10],[9,1,9,8],[11,1,11,7]]}
["Agency","Agency Finding Reference Field","Name","Finding","Affected Applications","Source Override","Policy - Section Name","Magnitude of Impact","Probability of Occurence","Finding Date","Actual Remediation Date","Remediation Overview","Initial Planned Due Date","Responsible Person(s)","Remediation Status","Archer Finding ID"]
["Value Selection","Agency provided tracking ID","Name of finding","Description of finding","List the applications affected by this finding. Separate the application name by semi-colons.","Finding Origin. Value Selection","SEC501 Section ID. Value Selection. You may select multiple values.","Will this risk have a high, medium or low impact. Value Selection","Will this risk have a high, medium or low impact. Value Selection ","The date when the finding was submitted to CSRM. The date format is MM/DD/YYYY","This date is used to calculate closure. The date format is MM/DD/YYYY","Description of remediation steps to be taken","When will the remediation be completed. The date format is MM/DD/YYYY","Who is responsible for the remediation. If listing multiple people, please separate them by semi-colons.","Value Selection","Archer Identifier (if applicable)"]
[]
[]
[null,"Instructions:"]
[null,"Please fill out Risk Findings tab and send in to commonwealthsecurity@vita.virginia.gov"]
[]
[null,"This sheet is intended to provide a description of each field header.  If it is labeled \"Value Selection\", that indicates that a value can be selected from a drop-down menu."]
[]
[null,"Also the Headings on each column will provide a description and any special comumn formatting"]
[]
[null,"All columns highlighted are required"]

{"sheet":"Risk Findings","index":1,"n_rows":1,"n_cols":16,"rows_kept":1,"cut":false,"hidden":false,"merged":[]}
["Agency","Agency Finding Reference Field","Name","Finding","Affected Applications","Source Override","Policy - Section Name","Magnitude of Impact","Probability of Occurence","Finding Date","Actual Remediation Date","Remediation Overview","Initial Planned Due Date","Responsible Person(s)","Remediation Status","Archer Finding ID"]

{"sheet":"Values Lists","index":2,"n_rows":346,"n_cols":6,"rows_kept":346,"cut":false,"hidden":false,"merged":[]}
["Agency Name","Risk Values","Policy - Section Name","Source Override","Remediation Status","Risk ID"]
["Alcoholic Beverage Control","High","SEC530 AC-1 - Access Control Policy and Procedures","Audit","Not Started","RSK-1 Access Control"]
["Assistive Technology Loan Fund Authority","Medium","SEC530 AC-10 - Concurrent Session Control","Risk","Underway","RSK-2 Access Enforcement"]
["Atos","Low","SEC530 AC-11 - Device Lock","Scans","Complete","RSK-3 Account Management"]
["Auditor of Public Accounts",null,"SEC530 AC-11-CE - Device Lock",null,null,"RSK-4 Application Management"]
["Board of Accountancy",null,"SEC530 AC-12 - Session termination",null,null,"RSK-5 Automation Strategy"]
["Board of Bar Examiners",null,"SEC530 AC-12-CE - Session termination",null,null,"RSK-6 Change Management"]
["Capitol Police",null,"SEC530 AC-14 - Permitted Actions Without Identification Or Authentication",null,null,"RSK-7 Communication Channels"]
["Christopher Newport University",null,"SEC530 AC-17 - Remote Access",null,null,"RSK-8 Configuration Management"]
["Circuit Courts",null,"SEC530 AC-17-CE - Remote Access",null,null,"RSK-9 Data Retention, Backup and Recovery"]
["City of Bristol",null,"SEC530 AC-17-COV - Remote Access",null,null,"RSK-10 Exception Management"]
["Commonwealths Attorneys Services Council",null,"SEC530 AC-18 - Wireless Access",null,null,"RSK-11 Executive Sponsorship"]
["Compensation Board",null,"SEC530 AC-18-CE - Wireless Access",null,null,"RSK-12 External Compliance"]
["Court of Appeals",null,"SEC530 AC-18-COV - Wireless Access",null,null,"RSK-13 External Service Provider Management"]
["Department for Aging and Rehabilitative Services",null,"SEC530 AC-19 - Access Control for Mobile Devices",null,null,"RSK-14 Final Solution Delivery"]
["Department for the Deaf and Hard of Hearing",null,"SEC530 AC-19-CE - Access Control for Mobile Devices",null,null,"RSK-15 Financial Oversight"]
["Department of Accounts",null,"SEC530 AC-2 - Account Management",null,null,"RSK-16 Findings Management"]
["Department of Aviation",null,"SEC530 AC-20 - Use of External Information Systems",null,null,"RSK-17 Functional Oversight"]
["Department of Behavioral Health and Development Services",null,"SEC530 AC-20-CE - Use of External Information Systems",null,null,"RSK-18 Incident Management"]
["Department of Blind and Visually Impaired",null,"SEC530 AC-20-COV - Use of External Information Systems",null,null,"RSK-19 Information Classification and Protection"]
["Department of Business Assistance",null,"SEC530 AC-21 - Information Sharing",null,null,"RSK-20 Internal Controls"]
["Department of Conservation and Recreation",null,"SEC530 AC-21-CE - Information Sharing",null,null,"RSK-21 Internal Service Level Agreements"]
["Department of Corrections",null,"SEC530 AC-22 - Publicly Accessible Content",null,null,"RSK-22 Governance Monitoring"]
["Department of Criminal Justice Services",null,"SEC530 AC-2-CE - Account Management",null,null,"RSK-23 Least Privilege"]
["Department of Education",null,"SEC530 AC-2-COV - Account Management",null,null,"RSK-24 Management Commitment"]
["Department of Elections",null,"SEC530 AC-2-COV-CE - Account Management",null,null,"RSK-25 Operational Cost Management"]
["Department of Environmental Quality",null,"SEC530 AC-3 - Access Enforcement",null,null,"RSK-26 Operations Management"]
["Department of Fire Programs",null,"SEC530 AC-3-CE - Access Enforcement",null,null,"RSK-27 Performance and Capacity Management"]
["Department of Forensic Science",null,"SEC530 AC-4 - Information Flow Enforcement",null,null,"RSK-28 Performance Monitoring"]
["Department of Forestry",null,"SEC530 AC-5 - Separation of Duties",null,null,"RSK-29 Policy Management"]
["Department of General Services",null,"SEC530 AC-6 - Least Privilege",null,null,"RSK-30 Problem Management"]
["Department of Health Professions",null,"SEC530 AC-6-CE - Least Privilege",null,null,"RSK-31 Procurement"]
["Department of Historic Resources",null,"SEC530 AC-7 - Unsuccessful Login Attempts",null,null,"RSK-32 Project Management"]
["Department of Housing and Community Development",null,"SEC530 AC-7-CE - Unsuccessful Login Attempts",null,null,"RSK-33 Protection of Physical Assets"]
["Department of Human Resource Management",null,"SEC530 AC-8 - System Use Notification",null,null,"RSK-34 Quality Management"]
["Department of Juvenile Justice",null,"SEC530 AC-8-COV - System Use Notification",null,null,"RSK-35 Regulatory Commitment"]
["Department of Labor and Industry",null,"SEC530 AT-1 - Security Awareness and Training Policy and Procedures",null,null,"RSK-36 Risk Management"]
["Department of Medical Assistance Services",null,"SEC530 AT-2 - Literacy Training and Awareness",null,null,"RSK-37 Security Management"]
["Department of Military Affairs",null,"SEC530 AT-2-CE - Literacy Training and Awareness",null,null,"RSK-38 Separation of Duties - Responsibilities"]
["Department of Motor Vehicles",null,"SEC530 AT-2-COV - Literacy Training and Awareness",null,null,"RSK-39 Separation of Duties - Technical"]
["Department of Planning and Budget",null,"SEC530 AT-3 - Roled-Based Training",null,null,"RSK-40 Business Continuity and Service Availability"]
["Department of Professional and Occupational Regulation",null,"SEC530 AT-3-CE - Roled-Based Training",null,null,"RSK-41 Human Resources Management"]
["Department of Rail and Public Transportation",null,"SEC530 AT-4 - Training Records",null,null,"RSK-42 Strategic Direction"]
["Department of Small Business and Supplier Diversity",null,"SEC530 AT-6 - Training Feedback",null,null,"RSK-43 Technology Documentation"]
["Department of Social Services",null,"SEC530 AU-1 - Audit and Accountability Policy and Procedures",null,null,"RSK-44 Technology Infrastructure Management"]
["Department of Taxation",null,"SEC530 AU-11 - Audit Record Retention",null,null,"RSK-45 Technology Strategy"]
["Department of Treasury",null,"SEC530 AU-12 - Audit Record Generation",null,null,"RSK-46 Training and education"]
["Department of Veterans Services",null,"SEC530 AU-12-CE - Audit Record Generation",null,null,"RSK-47 Legal/Matters Management"]
["Department of Wildlife Resources",null,"SEC530 AU-13 - Monitoring for Information Disclosure",null,null,"RSK-48 Facilities Management"]
["Department of Workforce Development and Advancement",null,"SEC530 AU-2 - Events Logging",null,null,"RSK-49 Customer Delivery"]
["Division of Legislative Automated Systems",null,"SEC530 AU-3 - Content of Audit Records",null,null,"RSK-50 Privacy"]
["Division of Legislative Services",null,"SEC530 AU-3-CE - Content of Audit Records",null,null,"RSK-51 Financial transactions not recorded."]
["Frontier Culture Museum of Virginia",null,"SEC530 AU-4 - Audit Storage Capacity",null,null,"RSK-52 Enterprise-Class Controls"]
["General Assembly",null,"SEC530 AU-4-CE - Audit Storage Capacity",null,null,"RSK-53 Enterprise-class Security controls"]
["General District Courts",null,"SEC530 AU-5 - Response To Audit Processing Failures",null,null,"RSK-54 Enterprise Class Security Controls"]
["George Mason University",null,"SEC530 AU-5-CE - Response To Audit Processing Failures"]
["Gunston Hall",null,"SEC530 AU-6 - Audit Review, Analysis, and Reporting"]
["Human Rights Council",null,"SEC530 AU-6-CE - Audit Review, Analysis, and Reporting"]
["Indigent Defense Commission",null,"SEC530 AU-8 - Time Stamps"]
["Iron Bow",null,"SEC530 AU-9 - Protection of Audit Information"]
["James Madison University",null,"SEC530 AU-9-CE - Protection of Audit Information"]
["Jamestown-Yorktown Foundation",null,"SEC530 CA-1 - Security Assessment and Authorization Policies and Procedures"]
["Joint Legislative Audit and Review Commission",null,"SEC530 CA-2 - Security Assessments"]
["Judicial Inquiry and Review Commission",null,"SEC530 CA-2-CE - Security Assessments"]
["Juvenile and Domestic Relations District Courts",null,"SEC530 CA-3 - Information Exchange"]
["Library of Virginia",null,"SEC530 CA-3-COV - Information Exchange"]
["Longwood University",null,"SEC530 CA-5 - Plan of Action and Milestones"]
["Marine Resources Commission",null,"SEC530 CA-6 - Authorization"]
["Motor Vehicle Dealer Board",null,"SEC530 CA-7 - Continuous Monitoring"]
["New College Institute",null,"SEC530 CA-7-CE - Continuous Monitoring"]
["Norfolk State University",null,"SEC530 CA-8 - Penetration Testing"]
["Northrop Grumman",null,"SEC530 CA-9 - Internal system Connections"]
["NTT Data Inc",null,"SEC530 CA-9-CE - Internal system Connections"]
["Office for Childrens Services",null,"SEC530 CM-1 - Configuration Management Policy and Procedures"]
["Office of Attorney General",null,"SEC530 CM-10 - Software Usage Restrictions"]
["Office of Data Governance and Analytics",null,"SEC530 CM-10-CE - Software Usage Restrictions"]
["Office of State Inspector General",null,"SEC530 CM-11 - User installed software"]
["Office of the Governor",null,"SEC530 CM-11-CE - User installed software"]
["Office of the Lieutenant Governor",null,"SEC530 CM-12 - Information Location"]
["Old Dominion University",null,"SEC530 CM-14 - Sign Components"]
["Peraton",null,"SEC530 CM-2 - Baseline Configuration"]
["Potomac River Fisheries Commission",null,"SEC530 CM-2-CE - Baseline Configuration"]
["Radford University",null,"SEC530 CM-2-COV - Baseline Configuration"]
["RETIRED Southeastern Virginia Training Center",null,"SEC530 CM-3 - Configuration Change Control"]
["Richard Bland College",null,"SEC530 CM-3-CE - Configuration Change Control"]
["SAIC",null,"SEC530 CM-3-COV - Configuration Change Control"]
["Science Museum of Virginia",null,"SEC530 CM-4 - Impact Analysis"]
["Southampton County",null,"SEC530 CM-4-CE - Impact Analysis"]
["Southern Virginia Higher Education Center",null,"SEC530 CM-5 - Access Restrictions for Change"]
["Southwest Virginia Higher Education Center",null,"SEC530 CM-5-CE - Access Restrictions for Change"]
["State Corporation Commission",null,"SEC530 CM-6 - Configuration Settings"]
["State Council of Higher Education for Virginia",null,"SEC530 CM-7 - Least Functionality"]
["State Lottery Department",null,"SEC530 CM-7-CE - Least Functionality"]
["Supreme Court",null,"SEC530 CM-8 - System Component Inventory"]
["Tempus Nova",null,"SEC530 CM-8-CE - System Component Inventory"]
["Tobacco Region Revitalization Commission",null,"SEC530 CM-9 - Configuration Management Plan"]
["Unisys",null,"SEC530 CM-9-CE - Configuration Management Plan"]
["University of Mary Washington",null,"SEC530 CP-1 - Contingency Planning Policy and Procedures"]
["University Of Virginia",null,"SEC530 CP-10 - Information System Recovery and Reconstitution"]
["Verizon",null,"SEC530 CP-10-CE - Information System Recovery and Reconstitution"]
["Virginia Alcohol Safety Action Program",null,"SEC530 CP-11 - Alternate Communications Protocols"]
["Virginia Board for People with Disabilities",null,"SEC530 CP-1-COV-1 - Contingency Planning Policy and Procedures"]
["Virginia College Savings Plan",null,"SEC530 CP-1-COV-2 - Contingency Planning Policy and Procedures"]
["Virginia Commission for the Arts",null,"SEC530 CP-2 - Contingency Plan"]
["Virginia Commonwealth University",null,"SEC530 CP-2-CE - Contingency Plan"]
["Virginia Community College System",null,"SEC530 CP-3 - Contingency Training"]
["Virginia Criminal Sentencing Commission",null,"SEC530 CP-3-CE - Contingency Training"]
["Virginia Department of Agriculture and Consumer Services",null,"SEC530 CP-4 - Contingency Plan Testing"]
["Virginia Department of Emergency Management",null,"SEC530 CP-4-CE - Contingency Plan Testing"]
["Virginia Department of Health",null,"SEC530 CP-6 - Alternate Storage Site"]
["Virginia Department of Transportation",null,"SEC530 CP-6-CE - Alternate Storage Site"]
["Virginia Economic Development Partnership",null,"SEC530 CP-7 - Alternate Processing Site"]
["Virginia Employment Commission",null,"SEC530 CP-7-CE - Alternate Processing Site"]
["Virginia Energy",null,"SEC530 CP-8 - Telecommunications Services"]
["Virginia Foundation for Healthy Youth",null,"SEC530 CP-8-CE - Telecommunications Services"]
["Virginia Fusion Center",null,"SEC530 CP-9 - Information System Backup"]
["Virginia Housing Development Authority",null,"SEC530 CP-9-CE - Information System Backup"]
["Virginia Information Technologies Agency",null,"SEC530 CP-9-COV - Information System Backup"]
["Virginia Innovation Partnership Corporation",null,"SEC530 IA-1 - Identification and Authentication Policy and Procedures"]
["Virginia Military Institute",null,"SEC530 IA-11 - Re-Authentication"]
["Virginia Museum of Fine Arts",null,"SEC530 IA-12 - Identity Proofing"]
["Virginia Museum of Natural History",null,"SEC530 IA-12-CE - Identity Proofing"]
["Virginia Office for Protection and Advocacy",null,"SEC530 IA-2 - Identification and Authentication (Organizational Users)"]
["Virginia Outdoors Foundation",null,"SEC530 IA-2-CE - Identification and Authentication (Organizational Users)"]
["Virginia Passenger Rail Authority",null,"SEC530 IA-4 - Identifier Management"]
["Virginia Port Authority",null,"SEC530 IA-4-CE - Identifier Management"]
["Virginia Racing Commission",null,"SEC530 IA-5 - Authenticator Management"]
["Virginia Resources Authority",null,"SEC530 IA-5-CE - Authenticator Management"]
["Virginia Retirement System",null,"SEC530 IA-5-COV-01 - Authenticator Management"]
["Virginia School for the Deaf and Blind",null,"SEC530 IA-5-COV-02 - Authenticator Management"]
["Virginia State Bar",null,"SEC530 IA-6 - Authenticator Feedback"]
["Virginia State Police",null,"SEC530 IA-7 - Cryptographic Module Authentication"]
["Virginia State University",null,"SEC530 IA-8 - Identification and Authentication (Non-organizational Users)"]
["Virginia Tech",null,"SEC530 IA-8-CE - Identification and Authentication (Non-organizational Users)"]
["Virginia Workers Compensation Commission",null,"SEC530 IA-8-COV - Identification and Authentication (Non-organizational Users)"]
["William and Mary",null,"SEC530 IA-9 - Service Identification and Authentication"]
["Wilson Workforce and Rehabilitation Center",null,"SEC530 IR-1 - Incident Response Policy and Procedures"]
["Xerox",null,"SEC530 IR-1-COV - Incident Response Policy and Procedures"]
[null,null,"SEC530 IR-2 - Incident Response Training"]
[null,null,"SEC530 IR-2-CE - Incident Response Training"]
[null,null,"SEC530 IR-3 - Incident Response Testing and Exercises"]
[null,null,"SEC530 IR-3-CE - Incident Response Testing and Exercises"]
[null,null,"SEC530 IR-4 - Incident Handling"]
[null,null,"SEC530 IR-4-CE - Incident Handling"]
[null,null,"SEC530 IR-4-COV-1 - Incident Handling"]
[null,null,"SEC530 IR-4-COV-2 - Incident Handling"]
[null,null,"SEC530 IR-5 - Incident Monitoring"]
[null,null,"SEC530 IR-5-CE - Incident Monitoring"]
[null,null,"SEC530 IR-6 - Incident Reporting"]
[null,null,"SEC530 IR-6-CE - Incident Reporting"]
[null,null,"SEC530 IR-6-COV - Incident Reporting"]
[null,null,"SEC530 IR-7 - Incident Response Assistance"]
[null,null,"SEC530 IR-7-CE - Incident Response Assistance"]
[null,null,"SEC530 IR-8 - Incident Response Plan"]
[null,null,"SEC530 IR-8-CE - Incident Response Plan"]
[null,null,"SEC530 MA-1 - System Maintenance Policy and Procedures"]
[null,null,"SEC530 MA-2 - Controlled Maintenance"]
[null,null,"SEC530 MA-3 - Maintenance Tools"]
[null,null,"SEC530 MA-3-CE - Maintenance Tools"]
[null,null,"SEC530 MA-4 - Nonlocal Maintenance"]
[null,null,"SEC530 MA-4-CE - Nonlocal Maintenance"]
[null,null,"SEC530 MA-5 - Maintenance Personnel"]
[null,null,"SEC530 MA-5-COV - Maintenance Personnel"]
[null,null,"SEC530 MA-6 - Timely Maintenance"]
[null,null,"SEC530 MA-6-CE - Timely Maintenance"]
[null,null,"SEC530 MP-1 - Media Protection Policy and Procedures"]
[null,null,"SEC530 MP-1-COV - Media Protection Policy and Procedures"]
[null,null,"SEC530 MP-2 - Media Access"]
[null,null,"SEC530 MP-3 - Media Marking"]
[null,null,"SEC530 MP-4 - Media Storage"]
[null,null,"SEC530 MP-5 - Media Transport"]
[null,null,"SEC530 MP-5-CE - Media Transport"]
[null,null,"SEC530 MP-6 - Media Sanitization"]
[null,null,"SEC530 MP-6-CE - Media Sanitization"]
[null,null,"SEC530 MP-6-COV - Media Sanitization"]
[null,null,"SEC530 MP-7 - Media Use"]
[null,null,"SEC530 MP-7-CE - Media Use"]
[null,null,"SEC530 PE-01 - Physical and Environmental Protection Policy and Procedures"]
[null,null,"SEC530 PE-10 - Emergency Shutoff"]
[null,null,"SEC530 PE-11 - Emergency Power"]
[null,null,"SEC530 PE-11-CE - Emergency Power"]
[null,null,"SEC530 PE-13 - Fire Protection"]
[null,null,"SEC530 PE-13-CE - Fire Protection"]
[null,null,"SEC530 PE-14 - Environmental Controls"]
[null,null,"SEC530 PE-14-CE - Environmental Controls"]
[null,null,"SEC530 PE-15 - Water Damage Protection"]
[null,null,"SEC530 PE-15-CE - Water Damage Protection"]
[null,null,"SEC530 PE-16 - Delivery and Removal"]
[null,null,"SEC530 PE-17 - Alternate Work Site"]
[null,null,"SEC530 PE-18 - Location of System Components"]
[null,null,"SEC530 PE-18-COV - Location of Information System Components"]
[null,null,"SEC530 PE-1-COV - Physical and Environmental Protection Policy and Procedures"]
[null,null,"SEC530 PE-2 - Physical Access Authorizations"]
[null,null,"SEC530 PE-23 - Facility Location"]
[null,null,"SEC530 PE-2-CE - Physical Access Authorizations"]
[null,null,"SEC530 PE-2-COV - Physical Access Authorizations"]
[null,null,"SEC530 PE-3 - Physical Access Control"]
[null,null,"SEC530 PE-3-CE - Physical Access Control"]
[null,null,"SEC530 PE-3-COV - Physical Access Control"]
[null,null,"SEC530 PE-4 - Access Control for Transmission Medium"]
[null,null,"SEC530 PE-5 - Access Control for Output Devices"]
[null,null,"SEC530 PE-6 - Monitoring Physical Access"]
[null,null,"SEC530 PE-6-CE - Monitoring Physical Access"]
[null,null,"SEC530 PE-8 - Visitor Access Records"]
[null,null,"SEC530 PE-9 - Power Equipment and Power Cabling"]
[null,null,"SEC530 PE-9-CE - Power Equipment and Power Cabling"]
[null,null,"SEC530 PL-02 - System Security and Privacy Plan"]
[null,null,"SEC530 PL-04-COV - Rules of Behavior"]
[null,null,"SEC530 PL-1 - Planning Policy and Procedures"]
[null,null,"SEC530 PL-10 - Baseline Selection"]
[null,null,"SEC530 PL-11 - Baseline Tailoring"]
[null,null,"SEC530 PL-2-COV - System Security and Privacy Plan"]
[null,null,"SEC530 PL-4 - Rules of Behavior"]
[null,null,"SEC530 PL-4-CE - Rules of Behavior"]
[null,null,"SEC530 PL-8 - Security and Privacy Architecture"]
[null,null,"SEC530 PL-8-CE - Security and Privacy Architecture"]
[null,null,"SEC530 PL-9 - Central Management"]
[null,null,"SEC530 PM-1 - Information Security Program Plan"]
[null,null,"SEC530 PM-10 - Authorization Process"]
[null,null,"SEC530 PM-11 - Mission and Business Process Definition"]
[null,null,"SEC530 PM-14 - Testing, Training, and Monitoring"]
[null,null,"SEC530 PM-2 - Information Security Program Leadership Role"]
[null,null,"SEC530 PM-25 - Minimization of Personally Identifiacble Information Used in Testing, Training, and Research"]
[null,null,"SEC530 PM-28 - Risk Framing"]
[null,null,"SEC530 PM-3 - Information Security and Privacy Resources"]
[null,null,"SEC530 PM-31 - Continous Monitoring Strategy"]
[null,null,"SEC530 PM-32 - Purposing"]
[null,null,"SEC530 PM-4 - Plan Action and Milestones Process"]
[null,null,"SEC530 PM-5 - System Inventory"]
[null,null,"SEC530 PM-5-CE - System Inventory"]
[null,null,"SEC530 PM-6 - Measures of Performance"]
[null,null,"SEC530 PM-7 - Enterprise Architecture"]
[null,null,"SEC530 PM-8 - Critical Infrastructure Plan"]
[null,null,"SEC530 PM-9 - Risk Management Strategy"]
[null,null,"SEC530 PS-1 - Personnel Security Policy and Procedures"]
[null,null,"SEC530 PS-3 - Personnel Screening"]
[null,null,"SEC530 PS-4 - Personnel Termination"]
[null,null,"SEC530 PS-5 - Personnel Transfer"]
[null,null,"SEC530 PS-6 - Access Agreements"]
[null,null,"SEC530 PS-7 - External Personnel Security"]
[null,null,"SEC530 PS-8 - Personnel Sanctions"]
[null,null,"SEC530 PS-9 - Position Descriptions"]
[null,null,"SEC530 RA-1 - Risk Assessment Policy and Procedures"]
[null,null,"SEC530 RA-10 - Threat Hunting"]
[null,null,"SEC530 RA-2 - Security Categorization"]
[null,null,"SEC530 RA-2-CE - Security Categorization"]
[null,null,"SEC530 RA-3 - Risk Assessment"]
[null,null,"SEC530 RA-3-CE - Risk Assessment"]
[null,null,"SEC530 RA-5 - Vulnerability Monitoring and Scanning"]
[null,null,"SEC530 RA-5-CE - Vulnerability Monitoring and Scanning"]
[null,null,"SEC530 RA-9 - Criticality Analysis"]
[null,null,"SEC530 SA-01 - Systems & Services Acquisitions Policies"]
[null,null,"SEC530 SA-10 - Developer Configuration Management"]
[null,null,"SEC530 SA-10-CE - Developer Configuration Management"]
[null,null,"SEC530 SA-11 - Developer Testing and Evaluation"]
[null,null,"SEC530 SA-11-CE - Developer Testing and Evaluation"]
[null,null,"SEC530 SA-15 - Development Process, Standards and Tools"]
[null,null,"SEC530 SA-15-CE - Development Process, Standards and Tools"]
[null,null,"SEC530 SA-16 - Developer-Provided Training"]
[null,null,"SEC530 SA-17 - Developer Security and Privacy Architecture & Design"]
[null,null,"SEC530 SA-17-CE - Developer Security and Privacy Architecture & Design"]
[null,null,"SEC530 SA-2 - Allocation of Resources"]
[null,null,"SEC530 SA-22 - Unsupported System Components"]
[null,null,"SEC530 SA-3 - System Development Life Cycle"]
[null,null,"SEC530 SA-3-CE - System Development Life Cycle"]
[null,null,"SEC530 SA-3-COV-1 - Life Cycle Support"]
[null,null,"SEC530 SA-3-COV-2 - Life Cycle Support"]
[null,null,"SEC530 SA-4 - Acquisitions"]
[null,null,"SEC530 SA-4-CE - Acquisitions"]
[null,null,"SEC530 SA-4-COV-1 - Acquisitions"]
[null,null,"SEC530 SA-5 - System Documentation"]
[null,null,"SEC530 SA-6-COV - Software Usage Restrictions"]
[null,null,"SEC530 SA-8 - Security and Privacy Engineering Principles"]
[null,null,"SEC530 SA-8-CE - Security and Privacy Engineering Principles"]
[null,null,"SEC530 SA-9 - External System Services"]
[null,null,"SEC530 SA-9-CE - External System Services"]
[null,null,"SEC530 SA-9-COV-1 - External System Services"]
[null,null,"SEC530 SA-9-COV-2 - External System Services"]
[null,null,"SEC530 SA-9-COV-3 - External System Services"]
[null,null,"SEC530 SC-1 - System and Communications Protection Policy and Procedures"]
[null,null,"SEC530 SC-10 - Network Disconnect"]
[null,null,"SEC530 SC-12 - Cryptographic Key Establishment and Management"]
[null,null,"SEC530 SC-12-CE - Cryptographic Key Establishment and Management"]
[null,null,"SEC530 SC-12-COV - Cryptographic Key Establishment and Management"]
[null,null,"SEC530 SC-13 - Use of Cryptography"]
[null,null,"SEC530 SC-13-COV - Use of Cryptography"]
[null,null,"SEC530 SC-15 - Collaborative Computing Devices and Applications"]
[null,null,"SEC530 SC-15-CE - Collaborative Computing Devices and Applications"]
[null,null,"SEC530 SC-17 - Public Key Infrastructure Certificates"]
[null,null,"SEC530 SC-18 - Mobile Code"]
[null,null,"SEC530 SC-2 - Separation of System and User Functionality"]
[null,null,"SEC530 SC-20 - Secure Name / Address Resolution Service (Authoritative Source)"]
[null,null,"SEC530 SC-20-CE - Secure Name / Address Resolution Service (Authoritative Source)"]
[null,null,"SEC530 SC-21 - Secure Name / Address Resolution Service (recursive or Caching Resolver)"]
[null,null,"SEC530 SC-22 - Architecture and Provisioning for Name/ Address Resolution Service"]
[null,null,"SEC530 SC-23 - Session Authenticity"]
[null,null,"SEC530 SC-23-CE - Session Authenticity"]
[null,null,"SEC530 SC-28 - Protection of Information At Rest"]
[null,null,"SEC530 SC-28-CE - Protection of Information At Rest"]
[null,null,"SEC530 SC-2-CE - Separation of System and User Functionality"]
[null,null,"SEC530 SC-3 - Security Function Isolation"]
[null,null,"SEC530 SC-37 - Out of Band Channels"]
[null,null,"SEC530 SC-37-CE - Out of Band Channels"]
[null,null,"SEC530 SC-39 - Process Isolation"]
[null,null,"SEC530 SC-4 - Information In Shared System Resources"]
[null,null,"SEC530 SC-42 - Sensor Capability and Data"]
[null,null,"SEC530 SC-42-CE - Sensor Capability and Data"]
[null,null,"SEC530 SC-42-COV - Sensor Capability and Data"]
[null,null,"SEC530 SC-43 - Usage Restrictions"]
[null,null,"SEC530 SC-44 - Detonation Chambers"]
[null,null,"SEC530 SC-45 - System Time Synchronization"]
[null,null,"SEC530 SC-45-CE - System Time Synchronization"]
[null,null,"SEC530 SC-46 - Cross Domain Policy Enforcement"]
[null,null,"SEC530 SC-47 - Alternate Communications Paths"]
[null,null,"SEC530 SC-5 - Denial-of-Service Protection"]
[null,null,"SEC530 SC-50 - Software-Enforced Separation and Policy Enforcement"]
[null,null,"SEC530 SC-5-CE - Denial-of-Service Protection"]
[null,null,"SEC530 SC-6 - Resource Availability"]
[null,null,"SEC530 SC-7 - Boundary Protection"]
[null,null,"SEC530 SC-7-CE - Boundary Protection"]
[null,null,"SEC530 SC-8 - Transmission Confidentiality and Integrity"]
[null,null,"SEC530 SC-8-CE - Transmission Confidentiality and Integrity"]
[null,null,"SEC530 SC-8-COV - Transmission Integrity"]
[null,null,"SEC530 SI-1 - System and Information Integrity Policy and Procedures"]
[null,null,"SEC530 SI-10 - Information Input Validation"]
[null,null,"SEC530 SI-10-CE - Information Input Validation"]
[null,null,"SEC530 SI-11 - Error handling"]
[null,null,"SEC530 SI-12 - Information Management and Retention"]
[null,null,"SEC530 SI-12-CE - Information Management and Retention"]
[null,null,"SEC530 SI-16 - Memory Protection"]
[null,null,"SEC530 SI-2 - Flaw Remediation"]
[null,null,"SEC530 SI-20 - Tainting"]
[null,null,"SEC530 SI-2-CE - Flaw Remediation"]
[null,null,"SEC530 SI-2-COV - Flaw Remediation"]
[null,null,"SEC530 SI-3 - Malicious Code Protection"]
[null,null,"SEC530 SI-3-CE - Malicious Code Protection"]
[null,null,"SEC530 SI-3-COV - Malicious Code Protection"]
[null,null,"SEC530 SI-4 - Information System Monitoring"]
[null,null,"SEC530 SI-4-CE - Information System Monitoring"]
[null,null,"SEC530 SI-5 - Security Alerts, Advisories, and Directives"]
[null,null,"SEC530 SI-6 - Security and Privacy Function Verification"]
[null,null,"SEC530 SI-6-CE - Security and Privacy Function Verification"]
[null,null,"SEC530 SI-7 - Software, Firmware and Information Integrity"]
[null,null,"SEC530 SI-7-CE - Software, Firmware and Information Integrity"]
[null,null,"SEC530 SI-8 - Spam Protection"]
[null,null,"SEC530 SI-8-CE - Spam Protection"]