p1:Artificial Intelligence Risk Management


p2:Artificial Intelligence Risk Management


dropped 3 pre-body section(s) (title page, foreword, signature blocks, contents) before page 4


dropped 4 pre-body section(s) (title page, foreword, signature blocks, contents) before page 3


dropped 8 pre-body section(s) (title page, foreword, signature blocks, contents) before page 8


p31:the Software Supply Chain. Available at


p34:Medical Imaging & Technology Alliance


p34:Open Web Application Security Project


p34:Product Security Incident Response Team


p35:Secure Software Development Framework


p36:o Updated BSIMM, OWASPASVS, OWASPMASVS


dropped 48 pre-body section(s) (title page, foreword, signature blocks, contents) before page 9


dropped 9 pre-body section(s) (title page, foreword, signature blocks, contents) before page 10


dropped 30 pre-body section(s) (title page, foreword, signature blocks, contents) before page 20


shorter duplicate of P-1 on page 30 (summary table or contents)


shorter duplicate of P-2 on page 30 (summary table or contents)


shorter duplicate of P-3 on page 30 (summary table or contents)


shorter duplicate of P-4 on page 30 (summary table or contents)


shorter duplicate of P-5 on page 30 (summary table or contents)


shorter duplicate of P-6 on page 30 (summary table or contents)


shorter duplicate of P-7 on page 30 (summary table or contents)


shorter duplicate of P-1 on page 47 (summary table or contents)


shorter duplicate of P-2 on page 47 (summary table or contents)


shorter duplicate of P-3 on page 47 (summary table or contents)


shorter duplicate of P-4 on page 47 (summary table or contents)


shorter duplicate of P-5 on page 47 (summary table or contents)


shorter duplicate of P-6 on page 47 (summary table or contents)


shorter duplicate of P-3 on page 49 (summary table or contents)


shorter duplicate of P-7 on page 53 (summary table or contents)


shorter duplicate of P-8 on page 55 (summary table or contents)


shorter duplicate of P-9 on page 55 (summary table or contents)


shorter duplicate of P-10 on page 55 (summary table or contents)


shorter duplicate of P-11 on page 55 (summary table or contents)


shorter duplicate of P-12 on page 55 (summary table or contents)


shorter duplicate of P-13 on page 55 (summary table or contents)


shorter duplicate of P-14 on page 55 (summary table or contents)


shorter duplicate of P-15 on page 55 (summary table or contents)


shorter duplicate of P-16 on page 55 (summary table or contents)


shorter duplicate of P-17 on page 55 (summary table or contents)


shorter duplicate of P-18 on page 55 (summary table or contents)


shorter duplicate of C-1 on page 65 (summary table or contents)


shorter duplicate of C-3 on page 65 (summary table or contents)


shorter duplicate of C-2 on page 66 (summary table or contents)


shorter duplicate of S-1 on page 69 (summary table or contents)


shorter duplicate of S-2 on page 69 (summary table or contents)


shorter duplicate of S-3 on page 69 (summary table or contents)


shorter duplicate of S-4 on page 69 (summary table or contents)


shorter duplicate of S-5 on page 69 (summary table or contents)


shorter duplicate of S-6 on page 69 (summary table or contents)


shorter duplicate of S-2 on page 70 (summary table or contents)


shorter duplicate of I-1 on page 77 (summary table or contents)


shorter duplicate of I-2 on page 77 (summary table or contents)


shorter duplicate of A-1 on page 80 (summary table or contents)


shorter duplicate of A-2 on page 80 (summary table or contents)


shorter duplicate of A-3 on page 80 (summary table or contents)


shorter duplicate of A-4 on page 80 (summary table or contents)


shorter duplicate of A-5 on page 80 (summary table or contents)


shorter duplicate of A-6 on page 80 (summary table or contents)


shorter duplicate of R-1 on page 88 (summary table or contents)


shorter duplicate of R-2 on page 88 (summary table or contents)


shorter duplicate of R-3 on page 88 (summary table or contents)


shorter duplicate of R-4 on page 88 (summary table or contents)


shorter duplicate of R-5 on page 88 (summary table or contents)


shorter duplicate of M-1 on page 95 (summary table or contents)


shorter duplicate of M-2 on page 95 (summary table or contents)


shorter duplicate of M-3 on page 95 (summary table or contents)


shorter duplicate of M-4 on page 95 (summary table or contents)


shorter duplicate of M-5 on page 95 (summary table or contents)


shorter duplicate of M-6 on page 95 (summary table or contents)


shorter duplicate of M-7 on page 95 (summary table or contents)


shorter duplicate of P-1 on page 145 (summary table or contents)


shorter duplicate of P-2 on page 145 (summary table or contents)


shorter duplicate of P-3 on page 145 (summary table or contents)


shorter duplicate of P-4 on page 145 (summary table or contents)


shorter duplicate of P-5 on page 146 (summary table or contents)


shorter duplicate of P-6 on page 146 (summary table or contents)


shorter duplicate of P-7 on page 146 (summary table or contents)


shorter duplicate of P-8 on page 146 (summary table or contents)


shorter duplicate of P-9 on page 146 (summary table or contents)


shorter duplicate of P-10 on page 147 (summary table or contents)


shorter duplicate of P-11 on page 147 (summary table or contents)


shorter duplicate of P-12 on page 147 (summary table or contents)


shorter duplicate of P-13 on page 147 (summary table or contents)


shorter duplicate of P-14 on page 147 (summary table or contents)


shorter duplicate of P-15 on page 147 (summary table or contents)


shorter duplicate of P-16 on page 148 (summary table or contents)


shorter duplicate of P-17 on page 148 (summary table or contents)


shorter duplicate of P-18 on page 148 (summary table or contents)


shorter duplicate of C-1 on page 149 (summary table or contents)


shorter duplicate of C-2 on page 149 (summary table or contents)


shorter duplicate of C-3 on page 149 (summary table or contents)


shorter duplicate of S-1 on page 150 (summary table or contents)


shorter duplicate of S-3 on page 150 (summary table or contents)


shorter duplicate of S-4 on page 150 (summary table or contents)


shorter duplicate of S-5 on page 150 (summary table or contents)


shorter duplicate of S-6 on page 151 (summary table or contents)


shorter duplicate of I-1 on page 152 (summary table or contents)


shorter duplicate of I-2 on page 152 (summary table or contents)


shorter duplicate of A-1 on page 153 (summary table or contents)


shorter duplicate of A-2 on page 153 (summary table or contents)


shorter duplicate of A-3 on page 153 (summary table or contents)


shorter duplicate of A-4 on page 153 (summary table or contents)


shorter duplicate of A-5 on page 153 (summary table or contents)


shorter duplicate of A-6 on page 154 (summary table or contents)


shorter duplicate of R-1 on page 155 (summary table or contents)


shorter duplicate of R-2 on page 155 (summary table or contents)


shorter duplicate of R-3 on page 155 (summary table or contents)


shorter duplicate of R-4 on page 155 (summary table or contents)


shorter duplicate of R-5 on page 155 (summary table or contents)


dropped 12 pre-body section(s) (title page, foreword, signature blocks, contents) before page 10


AC-2(10) 'Shared and Group Account Credential Change' marked withdrawn in OSCAL


AC-3(1) 'Restricted Access to Privileged Functions' marked withdrawn in OSCAL


AC-3(6) 'Protection of User and System Information' marked withdrawn in OSCAL


AC-4(16) 'Information Transfers on Interconnected Systems' marked withdrawn in OSCAL


AC-4(18) 'Security Attribute Binding' marked withdrawn in OSCAL


AC-7(1) 'Automatic Account Lock' marked withdrawn in OSCAL


AC-13 'Supervision and Review — Access Control' marked withdrawn in OSCAL


AC-14(1) 'Necessary Uses' marked withdrawn in OSCAL


AC-15 'Automated Marking' marked withdrawn in OSCAL


AC-17(5) 'Monitoring for Unauthorized Connections' marked withdrawn in OSCAL


AC-17(7) 'Additional Protection for Security Function Access' marked withdrawn in OSCAL


AC-17(8) 'Disable Nonsecure Network Protocols' marked withdrawn in OSCAL


AC-18(2) 'Monitoring Unauthorized Connections' marked withdrawn in OSCAL


AC-19(1) 'Use of Writable and Portable Storage Devices' marked withdrawn in OSCAL


AC-19(2) 'Use of Personally Owned Portable Storage Devices' marked withdrawn in OSCAL


AC-19(3) 'Use of Portable Storage Devices with No Identifiable Owner' marked withdrawn in OSCAL


AT-3(4) 'Suspicious Communications and Anomalous System Behavior' marked withdrawn in OSCAL


AT-5 'Contacts with Security Groups and Associations' marked withdrawn in OSCAL


AU-2(1) 'Compilation of Audit Records from Multiple Sources' marked withdrawn in OSCAL


AU-2(2) 'Selection of Audit Events by Component' marked withdrawn in OSCAL


AU-2(3) 'Reviews and Updates' marked withdrawn in OSCAL


AU-2(4) 'Privileged Functions' marked withdrawn in OSCAL


AU-3(2) 'Centralized Management of Planned Audit Record Content' marked withdrawn in OSCAL


AU-6(2) 'Automated Security Alerts' marked withdrawn in OSCAL


AU-6(10) 'Audit Level Adjustment' marked withdrawn in OSCAL


AU-7(2) 'Automatic Sort and Search' marked withdrawn in OSCAL


AU-8(1) 'Synchronization with Authoritative Time Source' marked withdrawn in OSCAL


AU-8(2) 'Secondary Authoritative Time Source' marked withdrawn in OSCAL


AU-10(5) 'Digital Signatures' marked withdrawn in OSCAL


AU-14(2) 'Capture and Record Content' marked withdrawn in OSCAL


AU-15 'Alternate Audit Logging Capability' marked withdrawn in OSCAL


CA-3(1) 'Unclassified National Security System Connections' marked withdrawn in OSCAL


CA-3(2) 'Classified National Security System Connections' marked withdrawn in OSCAL


CA-3(3) 'Unclassified Non-national Security System Connections' marked withdrawn in OSCAL


CA-3(4) 'Connections to Public Networks' marked withdrawn in OSCAL


CA-3(5) 'Restrictions on External System Connections' marked withdrawn in OSCAL


CA-4 'Security Certification' marked withdrawn in OSCAL


CA-7(2) 'Types of Assessments' marked withdrawn in OSCAL


CM-2(1) 'Reviews and Updates' marked withdrawn in OSCAL


CM-2(4) 'Unauthorized Software' marked withdrawn in OSCAL


CM-2(5) 'Authorized Software' marked withdrawn in OSCAL


CM-5(2) 'Review System Changes' marked withdrawn in OSCAL


CM-5(3) 'Signed Components' marked withdrawn in OSCAL


CM-5(7) 'Automatic Implementation of Security Safeguards' marked withdrawn in OSCAL


CM-6(3) 'Unauthorized Change Detection' marked withdrawn in OSCAL


CM-6(4) 'Conformance Demonstration' marked withdrawn in OSCAL


CM-8(5) 'No Duplicate Accounting of Components' marked withdrawn in OSCAL


CM-11(1) 'Alerts for Unauthorized Installations' marked withdrawn in OSCAL


CP-2(4) 'Resume All Mission and Business Functions' marked withdrawn in OSCAL


CP-5 'Contingency Plan Update' marked withdrawn in OSCAL


CP-7(5) 'Equivalent Information Security Safeguards' marked withdrawn in OSCAL


CP-9(4) 'Protection from Unauthorized Modification' marked withdrawn in OSCAL


CP-10(1) 'Contingency Plan Testing' marked withdrawn in OSCAL


CP-10(3) 'Compensating Security Controls' marked withdrawn in OSCAL


CP-10(5) 'Failover Capability' marked withdrawn in OSCAL


IA-2(3) 'Local Access to Privileged Accounts' marked withdrawn in OSCAL


IA-2(4) 'Local Access to Non-privileged Accounts' marked withdrawn in OSCAL


IA-2(7) 'Network Access to Non-privileged Accounts — Separate Device' marked withdrawn in OSCAL


IA-2(9) 'Network Access to Non-privileged Accounts — Replay Resistant' marked withdrawn in OSCAL


IA-2(11) 'Remote Access — Separate Device' marked withdrawn in OSCAL


IA-3(2) 'Cryptographic Bidirectional Network Authentication' marked withdrawn in OSCAL


IA-4(2) 'Supervisor Authorization' marked withdrawn in OSCAL


IA-4(3) 'Multiple Forms of Certification' marked withdrawn in OSCAL


IA-4(7) 'In-person Registration' marked withdrawn in OSCAL


IA-5(3) 'In-person or Trusted External Party Registration' marked withdrawn in OSCAL


IA-5(4) 'Automated Support for Password Strength Determination' marked withdrawn in OSCAL


IA-5(11) 'Hardware Token-based Authentication' marked withdrawn in OSCAL


IA-8(3) 'Use of FICAM-approved Products' marked withdrawn in OSCAL


IA-9(1) 'Information Exchange' marked withdrawn in OSCAL


IA-9(2) 'Transmission of Decisions' marked withdrawn in OSCAL


IR-9(1) 'Responsible Personnel' marked withdrawn in OSCAL


IR-10 'Integrated Information Security Analysis Team' marked withdrawn in OSCAL


MA-2(1) 'Record Content' marked withdrawn in OSCAL


MA-4(2) 'Document Nonlocal Maintenance' marked withdrawn in OSCAL


MP-2(1) 'Automated Restricted Access' marked withdrawn in OSCAL


MP-2(2) 'Cryptographic Protection' marked withdrawn in OSCAL


MP-4(1) 'Cryptographic Protection' marked withdrawn in OSCAL


MP-5(1) 'Protection Outside of Controlled Areas' marked withdrawn in OSCAL


MP-5(2) 'Documentation of Activities' marked withdrawn in OSCAL


MP-5(4) 'Cryptographic Protection' marked withdrawn in OSCAL


MP-6(4) 'Controlled Unclassified Information' marked withdrawn in OSCAL


MP-6(5) 'Classified Information' marked withdrawn in OSCAL


MP-6(6) 'Media Destruction' marked withdrawn in OSCAL


MP-7(1) 'Prohibit Use Without Owner' marked withdrawn in OSCAL


PE-3(6) 'Facility Penetration Testing' marked withdrawn in OSCAL


PE-5(1) 'Access to Output by Authorized Individuals' marked withdrawn in OSCAL


PE-5(3) 'Marking Output Devices' marked withdrawn in OSCAL


PE-7 'Visitor Control' marked withdrawn in OSCAL


PE-8(2) 'Physical Access Records' marked withdrawn in OSCAL


PE-10(1) 'Accidental and Unauthorized Activation' marked withdrawn in OSCAL


PE-13(3) 'Automatic Fire Suppression' marked withdrawn in OSCAL


PE-18(1) 'Facility Site' marked withdrawn in OSCAL


PL-2(1) 'Concept of Operations' marked withdrawn in OSCAL


PL-2(2) 'Functional Architecture' marked withdrawn in OSCAL


PL-2(3) 'Plan and Coordinate with Other Organizational Entities' marked withdrawn in OSCAL


PL-3 'System Security Plan Update' marked withdrawn in OSCAL


PL-5 'Privacy Impact Assessment' marked withdrawn in OSCAL


PL-6 'Security-related Activity Planning' marked withdrawn in OSCAL


PS-6(1) 'Information Requiring Special Protection' marked withdrawn in OSCAL


RA-4 'Risk Assessment Update' marked withdrawn in OSCAL


RA-5(1) 'Update Tool Capability' marked withdrawn in OSCAL


RA-5(7) 'Automated Detection and Notification of Unauthorized Components' marked withdrawn in OSCAL


RA-5(9) 'Penetration Testing and Analyses' marked withdrawn in OSCAL


SA-4(4) 'Assignment of Components to Systems' marked withdrawn in OSCAL


SA-5(1) 'Functional Properties of Security Controls' marked withdrawn in OSCAL


SA-5(2) 'Security-relevant External System Interfaces' marked withdrawn in OSCAL


SA-5(3) 'High-level Design' marked withdrawn in OSCAL


SA-5(4) 'Low-level Design' marked withdrawn in OSCAL


SA-5(5) 'Source Code' marked withdrawn in OSCAL


SA-6 'Software Usage Restrictions' marked withdrawn in OSCAL


SA-7 'User-installed Software' marked withdrawn in OSCAL


SA-12 'Supply Chain Protection' marked withdrawn in OSCAL


SA-12(1) 'Acquisition Strategies / Tools / Methods' marked withdrawn in OSCAL


SA-12(2) 'Supplier Reviews' marked withdrawn in OSCAL


SA-12(3) 'Trusted Shipping and Warehousing' marked withdrawn in OSCAL


SA-12(4) 'Diversity of Suppliers' marked withdrawn in OSCAL


SA-12(5) 'Limitation of Harm' marked withdrawn in OSCAL


SA-12(6) 'Minimizing Procurement Time' marked withdrawn in OSCAL


SA-12(7) 'Assessments Prior to Selection / Acceptance / Update' marked withdrawn in OSCAL


SA-12(8) 'Use of All-source Intelligence' marked withdrawn in OSCAL


SA-12(9) 'Operations Security' marked withdrawn in OSCAL


SA-12(10) 'Validate as Genuine and Not Altered' marked withdrawn in OSCAL


SA-12(11) 'Penetration Testing / Analysis of Elements, Processes, and Actors' marked withdrawn in OSCAL


SA-12(12) 'Inter-organizational Agreements' marked withdrawn in OSCAL


SA-12(13) 'Critical Information System Components' marked withdrawn in OSCAL


SA-12(14) 'Identity and Traceability' marked withdrawn in OSCAL


SA-12(15) 'Processes to Address Weaknesses or Deficiencies' marked withdrawn in OSCAL


SA-13 'Trustworthiness' marked withdrawn in OSCAL


SA-14 'Criticality Analysis' marked withdrawn in OSCAL


SA-14(1) 'Critical Components with No Viable Alternative Sourcing' marked withdrawn in OSCAL


SA-15(4) 'Threat Modeling and Vulnerability Analysis' marked withdrawn in OSCAL


SA-15(9) 'Use of Live Data' marked withdrawn in OSCAL


SA-18 'Tamper Resistance and Detection' marked withdrawn in OSCAL


SA-18(1) 'Multiple Phases of System Development Life Cycle' marked withdrawn in OSCAL


SA-18(2) 'Inspection of Systems or Components' marked withdrawn in OSCAL


SA-19 'Component Authenticity' marked withdrawn in OSCAL


SA-19(1) 'Anti-counterfeit Training' marked withdrawn in OSCAL


SA-19(2) 'Configuration Control for Component Service and Repair' marked withdrawn in OSCAL


SA-19(3) 'Component Disposal' marked withdrawn in OSCAL


SA-19(4) 'Anti-counterfeit Scanning' marked withdrawn in OSCAL


SA-21(1) 'Validation of Screening' marked withdrawn in OSCAL


SA-22(1) 'Alternative Sources for Continued Support' marked withdrawn in OSCAL


SC-4(1) 'Security Levels' marked withdrawn in OSCAL


SC-7(1) 'Physically Separated Subnetworks' marked withdrawn in OSCAL


SC-7(2) 'Public Access' marked withdrawn in OSCAL


SC-7(6) 'Response to Recognized Failures' marked withdrawn in OSCAL


SC-9 'Transmission Confidentiality' marked withdrawn in OSCAL


SC-12(4) 'PKI Certificates' marked withdrawn in OSCAL


SC-12(5) 'PKI Certificates / Hardware Tokens' marked withdrawn in OSCAL


SC-13(1) 'FIPS-validated Cryptography' marked withdrawn in OSCAL


SC-13(2) 'NSA-approved Cryptography' marked withdrawn in OSCAL


SC-13(3) 'Individuals Without Formal Access Approvals' marked withdrawn in OSCAL


SC-13(4) 'Digital Signatures' marked withdrawn in OSCAL


SC-14 'Public Access Protections' marked withdrawn in OSCAL


SC-15(2) 'Blocking Inbound and Outbound Communications Traffic' marked withdrawn in OSCAL


SC-19 'Voice Over Internet Protocol' marked withdrawn in OSCAL


SC-20(1) 'Child Subspaces' marked withdrawn in OSCAL


SC-21(1) 'Data Origin and Integrity' marked withdrawn in OSCAL


SC-23(2) 'User-initiated Logouts and Message Displays' marked withdrawn in OSCAL


SC-23(4) 'Unique Session Identifiers with Randomization' marked withdrawn in OSCAL


SC-26(1) 'Detection of Malicious Code' marked withdrawn in OSCAL


SC-30(1) 'Virtualization Techniques' marked withdrawn in OSCAL


SC-33 'Transmission Preparation Integrity' marked withdrawn in OSCAL


SC-34(3) 'Hardware-based Protection' marked withdrawn in OSCAL


SC-42(3) 'Prohibit Use of Devices' marked withdrawn in OSCAL


SI-2(1) 'Central Management' marked withdrawn in OSCAL


SI-3(1) 'Central Management' marked withdrawn in OSCAL


SI-3(2) 'Automatic Updates' marked withdrawn in OSCAL


SI-3(3) 'Non-privileged Users' marked withdrawn in OSCAL


SI-3(5) 'Portable Storage Devices' marked withdrawn in OSCAL


SI-3(7) 'Nonsignature-based Detection' marked withdrawn in OSCAL


SI-3(9) 'Authenticate Remote Commands' marked withdrawn in OSCAL


SI-4(6) 'Restrict Non-privileged Users' marked withdrawn in OSCAL


SI-4(8) 'Protection of Monitoring Information' marked withdrawn in OSCAL


SI-6(1) 'Notification of Failed Security Tests' marked withdrawn in OSCAL


SI-7(4) 'Tamper-evident Packaging' marked withdrawn in OSCAL


SI-7(11) 'Confined Environments with Limited Privileges' marked withdrawn in OSCAL


SI-7(13) 'Code Execution in Protected Environments' marked withdrawn in OSCAL


SI-7(14) 'Binary or Machine Executable Code' marked withdrawn in OSCAL


SI-8(1) 'Central Management' marked withdrawn in OSCAL


SI-9 'Information Input Restrictions' marked withdrawn in OSCAL


SI-13(2) 'Time Limit on Process Execution Without Supervision' marked withdrawn in OSCAL


p17:3.1 Security Categories and Objectives


dropped 14 pre-body section(s) (title page, foreword, signature blocks, contents) before page 15


p257:APPENDIX E: LEGISLATIVE AND EXECUTIVE SOURCES ESTABLISHING

SP 800-60 Vol 2 Appendix E (OMB memoranda and legal-provision tables), pages 257-304, excluded from v1


p257:Table 6: Legal Information Disclosure Prohibitions


p258:Table 6: Legal Information Disclosure Prohibitions


p259:Table 6: Legal Information Disclosure Prohibitions


p260:Table 6: Legal Information Disclosure Prohibitions


p261:Table 6: Legal Information Disclosure Prohibitions


p262:Table 6: Legal Information Disclosure Prohibitions


p263:Table 6: Legal Information Disclosure Prohibitions


p264:Table 6: Legal Information Disclosure Prohibitions


p265:Table 6: Legal Information Disclosure Prohibitions


p266:Table 6: Legal Information Disclosure Prohibitions


p267:Table 6: Legal Information Disclosure Prohibitions


p268:Table 6: Legal Information Disclosure Prohibitions


p269:Table 6: Legal Information Disclosure Prohibitions


p270:Table 6: Legal Information Disclosure Prohibitions


p271:Table 6: Legal Information Disclosure Prohibitions


p272:Table 6: Legal Information Disclosure Prohibitions


p273:Table 6: Legal Information Disclosure Prohibitions


p274:Table 6: Legal Information Disclosure Prohibitions


p275:Table 6: Legal Information Disclosure Prohibitions


p276:Table 6: Legal Information Disclosure Prohibitions


p277:Table 6: Legal Information Disclosure Prohibitions


p278:Table 6: Legal Information Disclosure Prohibitions


p279:Table 6: Legal Information Disclosure Prohibitions


p280:Table 6: Legal Information Disclosure Prohibitions


p281:Table 6: Legal Information Disclosure Prohibitions


p282:Table 6: Legal Information Disclosure Prohibitions


p283:Table 6: Legal Information Disclosure Prohibitions


p284:Table 6: Legal Information Disclosure Prohibitions


p285:Table 6: Legal Information Disclosure Prohibitions


p286:Table 6: Legal Information Disclosure Prohibitions


p287:Table 6: Legal Information Disclosure Prohibitions


p288:Table 6: Legal Information Disclosure Prohibitions


p289:Table 6: Legal Information Disclosure Prohibitions


p289:E.2.1 Office of Management and Budget Memoranda and Guidelin


p289:MEMORANDUM FOR THE CHIEF INFORMATION SECURITY OFFICERS


p289:MEMORANDUM FOR HEADS OF DEPARTMENTS AND AGENCIES


p289:MEMORANDUM FOR THE HEADS OF DEPARTMENTS AND AGENCIES


p290:MEMORANDUM FOR THE HEADS OF DEPARTMENTS AND AGENCIES


p290:MEMORANDUM FOR HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES


p290:MEMORANDUM TO CHIEF INFORMATION OFFICERS AND PROGRAM


p290:MEMORANDUM TO ALL DEPARTMENT AND AGENCY HEADS


p291:MEMORANDUM FOR HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES


p291:MEMORANDUM TO THE HEADS OF ALL DEPARTMENTS AND AGENCIES


p291:MEMORANDUM FOR THE HEADS OF DEPARTMENTS AND AGENCIES


p291:MEMORANDUM FOR THE HEADS OF ALL DEPARTMENTS AND AGENCIES


p292:MEMORANDUM FOR HEADS OF DEPARTMENT AND AGENCIES


p292:MEMORANDUM FOR THE HEADS OF DEPARTMENTS AND AGENCIES


p292:MEMORANDUM FOR CHIEF INFORMATION OFFICERS


p292:MEMORANDUM FOR HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES


p293:MEMORANDUM FOR HEADS OF DEPARTMENTS AND AGENCIES


p293:MEMORANDUM FOR HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES


p293:E.2.2 Presidential Directives and Executive Orders


p293:SECURITY REQUIREMENTS FOR GOVERNMENT EMPLOYEES


p293:Section 8 (a) The investigations conducted pursuant to this


p293:RELATING TO THE TRANSFER OF TELECOMMUNICATIONS FUNCTIONS


p294:ASSIGMMENT OF EMERGENCY PREPAREDNESS RESPONSIBILITIES


p294:DECLASSIFICATION AND RELEASE OF MATERIALS PERTAINING TO PRIS


p295:RELEASE OF IMAGERY ACQUIRED BY SPACE-BASED NATIONAL


p295:Section 1. Public Release of Historical Intelligence


p295:CLASSIFIED NATIONAL SECURITY INFORMATION


p295:Section 3.7. Processing Requests and Reviews. In response to


p296:Section 5.2. Review Proceedings for Denials or Revocations o


p296:ESTABLISHING THE OFFICE OF HOMELAND SECURITY AND THE HOMELAN


p297:CRITICAL INFRASTRUCTURE PROTECTION IN THE INFORMATION AGE


p297:FURTHER IMPLEMENTATION OF THE PRESIDENTIAL RECORDS ACT


p297:DETENTION, TREATMENT, AND TRIAL OF CERTAIN NON-CITIZENS IN T


p297:Section 4. Authority of the Secretary of Defense Regarding T


p298:AMENDMENT OF EXECUTIVE ORDERS, AND OTHER ACTIONS, IN CONNECT


p298:WITH THE ESTABLISHMENT OF THE DEPARTMENT OF HOMELAND SECURIT


p298:Section 19. Functions of Certain Officials in the Department


p298:Section 7. Executive Order 13231 of October 16, 2001 (“Criti


p298:Section 1.4. Classification Categories. Information shall no


p299:CLASSIFIED NATIONAL SECURITY INFORMATION


p299:Section 1.7. Classification Prohibitions and Limitations.


p300:Section 1.8. Classification Challenges.


p300:HOMELAND SECURITY INFORMATION SHARING


p300:Section 1. Assignment of Functions.


p302:E.3 OMB and Case Law Interpretations


p304:Section 208 of the E-Government Act of 2002 requires that OM


p304:2003 Memorandum for Heads of Executive Departments and Agenc


156 chars, no following sibling section to merge into


86 chars, no following sibling section to merge into


45 chars, no following sibling section to merge into


41 chars, no following sibling section to merge into


46 chars, no following sibling section to merge into


47 chars, no following sibling section to merge into


58 chars, no following sibling section to merge into


42 chars, no following sibling section to merge into


130 chars, no following sibling section to merge into


73 chars, no following sibling section to merge into


55 chars, no following sibling section to merge into


87 chars, no following sibling section to merge into


40 chars, no following sibling section to merge into


52 chars, no following sibling section to merge into


63 chars, no following sibling section to merge into


43 chars, no following sibling section to merge into


72 chars, no following sibling section to merge into


107 chars, no following sibling section to merge into


128 chars, no following sibling section to merge into


78 chars, no following sibling section to merge into


84 chars, no following sibling section to merge into


122 chars, no following sibling section to merge into


103 chars, no following sibling section to merge into


45 chars, no following sibling section to merge into


121 chars, no following sibling section to merge into


155 chars, no following sibling section to merge into


184 chars, no following sibling section to merge into


70 chars outside [80, 8000] for ai_rmf_subcategory


section text begins mid-sentence: 'of AI systems reflect systemic and human cognitive biases. A'


48 chars outside [80, 8000] for definition


64 chars outside [80, 8000] for definition


59 chars outside [80, 8000] for definition


75 chars outside [80, 8000] for definition


section text begins mid-sentence: 'continuous monitoring of several NIST SP 800-53 security con'


section text begins mid-sentence: 'threats of violation of computer security policies, acceptab'


section text begins mid-sentence: '53 security controls including AC-5, Separation of Duties; A'


section text begins mid-sentence: '53 security controls including AC-5, Separation of Duties; C'


section text begins mid-sentence: 'may also need to demonstrate compliance with security requir'


section text begins mid-sentence: 'security control compliance activities, and security measure'


section text begins mid-sentence: 'responsible for patch management, security control assessmen'


text is a reference-list entry (citation apparatus, no guidance)


section text begins mid-sentence: 'are most likely to find this publication of interest:\n\n• Sec'


section text begins mid-sentence: 'meet the following secure software development recommendatio'


section text begins mid-sentence: 'and outdated risk analysis. [IR7864]\n\nMost aspects of securi'


section text begins mid-sentence: 'high level include the following:\n\n• Can be used by organiza'


section text begins mid-sentence: 'software development practices in place\n\n• Makes the practic'


section text begins mid-sentence: 'development model (e.g., agile, DevOps)\n\n• Can assist organi'


section text begins mid-sentence: 'among both internal and external organizational stakeholders'


section text begins mid-sentence: 'clearly communicate with each other about secure software de'


section text begins mid-sentence: 'vulnerabilities)3\n\nThe SSDF practices may help support the N'


section text begins mid-sentence: 'government-off-the-shelf [GOTS] software developers, softwar'


section text begins mid-sentence: 'practices to their customers, or define requirements for the'


section text begins mid-sentence: 'their confidentiality, integrity, and/or availability protec'


section text begins mid-sentence: 'practitioners from industry and government with expertise in'


section text begins mid-sentence: 'tasks to accommodate the unique aspects of AI model developm'


section text begins mid-sentence: 'other types of risk include:\n\n• AI Risk Management Framework'


section text begins mid-sentence: 'o High: Critically important for AI model development securi'


section text begins mid-sentence: 'does not contain recommendations, considerations, or notes s'


section text begins mid-sentence: 'containing requirements, recommendations, considerations, or'


section text begins mid-sentence: 'and attacker goals, objectives, and capabilities, as well as'


text is a reference-list entry (citation apparatus, no guidance)


section text begins mid-sentence: 'for Improving Privacy Through Enterprise Risk Management, Ve'


section text begins mid-sentence: 'artificial intelligence red-teaming\n\nA structured testing ef'


section text begins mid-sentence: 'generative artificial intelligence\n\nThe class of AI models t'


section text begins mid-sentence: 'describes the process of assessing information security risk'


section text begins mid-sentence: 'transparent the risk perceptions that organizations routinel'


section text begins mid-sentence: 'factors can be functionally combined to evaluate risk; and ('


section text begins mid-sentence: 'the intent and targeting aspects of a potential attack helps'


section text begins mid-sentence: '1 or Tier 2 levels (e.g., exposure of a core mission/busines'


section text begins mid-sentence: 'assessments as inputs to Tier 1 risk assessments is shaped b'


section text begins mid-sentence: 'descriptions of vulnerabilities in the systems, an assessmen'


section text begins mid-sentence: '2 activity). Risk is introduced if the implementation of a c'


section text begins mid-sentence: 'infrastructure and support services, threats, vulnerabilitie'


section text begins mid-sentence: 'of the organizational risk management strategy need not be r'


section text begins mid-sentence: 'management strategy, the information need not be repeated in'


section text begins mid-sentence: 'provides a set of exemplary tables for use in identifying th'


section text begins mid-sentence: 'provides a set of exemplary tables for use in identifying vu'


section text begins mid-sentence: 'provides a set of exemplary tables for use in determining li'


section text begins mid-sentence: 'repositories, information systems, applications, information'


section text begins mid-sentence: 'provides a set of exemplary tables for use in determining ad'


section text begins mid-sentence: 'provides a set of exemplary tables for use in determining ri'


section text begins mid-sentence: 'such situations, monitoring only the security posture of inf'


64 chars outside [80, 8000] for definition


54 chars outside [80, 8000] for definition


69 chars outside [80, 8000] for definition


50 chars outside [80, 8000] for definition


62 chars outside [80, 8000] for definition


63 chars outside [80, 8000] for definition


56 chars outside [80, 8000] for definition


53 chars outside [80, 8000] for definition


76 chars outside [80, 8000] for definition


75 chars outside [80, 8000] for definition


52 chars outside [80, 8000] for definition


44 chars outside [80, 8000] for definition


59 chars outside [80, 8000] for definition


section text begins mid-sentence: 'by the authorized disclosure of PII. While managing privacy '


section text begins mid-sentence: 'describes the tasks required to implement the steps in the R'


section text begins mid-sentence: 'of common controls typically carry out the remaining steps i'


section text begins mid-sentence: 'management levels-that is, some of the outcomes are universa'


section text begins mid-sentence: 'requirements, and the costs to the organization. Appendix G '


section text begins mid-sentence: 'protection needs of organizational stakeholders. Controls ar'


section text begins mid-sentence: 'and [OMB A-130] require external providers handling federal '


section text begins mid-sentence: 'services or commercial off-the-shelf products. The level of '


section text begins mid-sentence: 'controls described in the system security plans and privacy '


section text begins mid-sentence: 'operational decisions. This strategy includes the strategic-'


section text begins mid-sentence: 'of operation; physical or other processes controlled by syst'


section text begins mid-sentence: 'be provided. The terms and conditions for the common control'


section text begins mid-sentence: 'provides additional guidance on authorization decisions, the'


section text begins mid-sentence: 'documentation; security and privacy assessment reports; plan'


text is a reference-list entry (citation apparatus, no guidance)


section text begins mid-sentence: 'involve co-authorizing officials.116 If so, agreements are e'


section text begins mid-sentence: 'has oversight responsibility for common controls in place or'


section text begins mid-sentence: 'missions and business functions, mission/business processes,'


section text begins mid-sentence: 'accountability and provides active support and oversight of '


section text begins mid-sentence: 'mission/business success. The risk executive (function) coor'


section text begins mid-sentence: 'or organizations may choose to retain the risk executive (fu'


section text begins mid-sentence: 'systems and system elements through security or privacy arch'


section text begins mid-sentence: 'operation or the provision of common controls is acceptable.'


section text begins mid-sentence: 'ensure that system owners, common control providers, and aut'


section text begins mid-sentence: 'time-driven authorization frequency is specified. Within any'


section text begins mid-sentence: 'reviewing the authorization package, the customer organizati'


section text begins mid-sentence: 'customer organization if there is a significant event that c'


section text begins mid-sentence: 'authorization rescission. Authorizing officials can rescind '


section text begins mid-sentence: 'common controls are authorized on a time-driven basis in acc'


section text begins mid-sentence: 'sufficient to support the authorizing official in making ris'


section text begins mid-sentence: 'the appropriate functionality to notify the responsible and '


section text begins mid-sentence: 'lowest to the highest impact levels for the systems within t'


section text begins mid-sentence: 'reports, and plans of action and milestones-focused only on '


section text begins mid-sentence: 'in conjunction with authorized site-specific controls160 or '


section text begins mid-sentence: 'for the interconnection of the subsystems to eliminate or re'


section text begins mid-sentence: 'the assurance or confidence that the risk from using externa'


section text begins mid-sentence: 'risks (including supply chain risks) to organizational opera'


section text begins mid-sentence: 'describes several trust models that can be applied in an org'


section text begins mid-sentence: 'owners, chief information officers, chief information securi'


section text begins mid-sentence: 'may or may not be the same as the system owner. A single inf'


section text begins mid-sentence: 'also responsible for deciding who has access to the system ('


section text begins mid-sentence: 'senior information security officers, and the risk executive'


section text begins mid-sentence: 'common security services). Subordinate organizations, in a s'


section text begins mid-sentence: 'organizations, brokers the trust relationship between the tw'


section text begins mid-sentence: 'oriented. An example of this application might be the use of'


section text begins mid-sentence: 'there is still need for a well-defined, established organiza'


section text begins mid-sentence: 'transfer (i.e., the focus must be on mission/business succes'


section text begins mid-sentence: '199 potential impact value of high. [FIPS 200]\n\nNational Sec'


text identical to SP-800-60v1r1/section/fips-200


text identical to SP-800-60v1r1/section/c.2.3-planning-budgeting


text identical to SP-800-60v1r1/section/c.3.3-human-resource-management